Edit tour

Windows Analysis Report
mode11_N1Fz.exe

Overview

General Information

Sample name:	mode11_N1Fz.exe
Analysis ID:	1583719
MD5:	5a2ad2d9d41aacfd8b0e51077ab36b9b
SHA1:	6afe484fc93369222f765e6f8006e437a417393d
SHA256:	d49c2451497109ae9f2646d06aa6dcf51b0f6af825d07f516b8dd59c03602401
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Performs DNS queries to domains with low reputation

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

IP address seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

mode11_N1Fz.exe (PID: 6564 cmdline: "C:\Users\user\Desktop\mode11_N1Fz.exe" MD5: 5A2AD2D9D41AACFD8B0E51077AB36B9B)

conhost.exe (PID: 6392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 8443, "SleepTime": 12000, "MaxGetSize": 1403642, "Jitter": 60, "C2Server": "632313373.xyz,/js/jquery-3.3.1.min.js", "HttpPostUri": "/post", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 4016 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": "Host: 632313373.xyz\r\n"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3529152410.000000C000088000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x34d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3529152410.000000C000088000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x3096a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x31c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30d60:$a39: %s as %s\%s: %d 0x401e2:$a41: beacon.x64.dll 0x31f70:$a46: %s (admin) 0x30ed8:$a48: %s%s: %s 0x30d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x30db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31fd9:$a51: Content-Length: %d
00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x32760:$a39: %s as %s\%s: %d 0x41be2:$a41: beacon.x64.dll 0x33970:$a46: %s (admin) 0x328d8:$a48: %s%s: %s 0x3278c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x327b8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x339d9:$a51: Content-Length: %d
00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1a4ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x1986e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x5ad60:$a39: %s as %s\%s: %d 0x90d60:$a39: %s as %s\%s: %d 0xd4d60:$a39: %s as %s\%s: %d 0xa01e2:$a41: beacon.x64.dll 0xe41e2:$a41: beacon.x64.dll 0x5bf70:$a46: %s (admin) 0x91f70:$a46: %s (admin) 0xd5f70:$a46: %s (admin) 0x5aed8:$a48: %s%s: %s 0x90ed8:$a48: %s%s: %s 0xd4ed8:$a48: %s%s: %s 0x5ad8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x5adb8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x90d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x90db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xd4d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xd4db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x5bfd9:$a51: Content-Length: %d 0x91fd9:$a51: Content-Length: %d 0xd5fd9:$a51: Content-Length: %d
00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x46d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x7cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0xc0d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x4296a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x43c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x7896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x79c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xbc96a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xbdc9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Process Memory Space: mode11_N1Fz.exe PID: 6564	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_N1Fz.exe PID: 6564	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_N1Fz.exe PID: 6564	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_N1Fz.exe PID: 6564	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x4b65d3:$a39: %s as %s\%s: %d 0x6660fb:$a39: %s as %s\%s: %d 0x8dbcc3:$a39: %s as %s\%s: %d 0x4ba182:$a41: beacon.x64.dll 0x669eb6:$a41: beacon.x64.dll 0x8df872:$a41: beacon.x64.dll 0x4b6959:$a46: %s (admin) 0x4b69d8:$a46: %s (admin) 0x666481:$a46: %s (admin) 0x666500:$a46: %s (admin) 0x8dc049:$a46: %s (admin) 0x8dc0c8:$a46: %s (admin) 0x4b66f1:$a48: %s%s: %s 0x666219:$a48: %s%s: %s 0x8dbde1:$a48: %s%s: %s 0x4b65ed:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x4b6616:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x4b6799:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x666115:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x66613e:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x6662c1:$a50: %02d/%02d/%02d %02d:%02d:%02d
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.mode11_N1Fz.exe.c000088000.1.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x34d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_N1Fz.exe.c000088000.1.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x3096a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x31c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_N1Fz.exe.c000088000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x3333c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_N1Fz.exe.c000088000.1.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x2fd6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_N1Fz.exe.c0000e0000.4.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x4113c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_N1Fz.exe.c0000e0000.4.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x3cf6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x3e29b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_N1Fz.exe.c000106000.6.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x4513c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_N1Fz.exe.c000106000.6.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1909b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x40d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x4209b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30d60:$a39: %s as %s\%s: %d 0x401e2:$a41: beacon.x64.dll 0x31f70:$a46: %s (admin) 0x30ed8:$a48: %s%s: %s 0x30d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x30db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31fd9:$a51: Content-Length: %d
0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1909b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x5ad60:$a39: %s as %s\%s: %d 0x90d60:$a39: %s as %s\%s: %d 0xd4d60:$a39: %s as %s\%s: %d 0xa01e2:$a41: beacon.x64.dll 0xe41e2:$a41: beacon.x64.dll 0x5bf70:$a46: %s (admin) 0x91f70:$a46: %s (admin) 0xd5f70:$a46: %s (admin) 0x5aed8:$a48: %s%s: %s 0x90ed8:$a48: %s%s: %s 0xd4ed8:$a48: %s%s: %s 0x5ad8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x5adb8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x90d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x90db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xd4d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xd4db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x5bfd9:$a51: Content-Length: %d 0x91fd9:$a51: Content-Length: %d 0xd5fd9:$a51: Content-Length: %d
0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x46d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x7cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0xc0d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x4296a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x43c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x7896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x79c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xbc96a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xbdc9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Click to see the 23 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/W	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/_	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/c	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js_	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsX	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsK	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsO	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/;	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsy	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsg	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder;	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06ad	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/3	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jss	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsq	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/0	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd065d	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/#	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js#	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderw	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js7	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsnt:	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsdero	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	Avira URL Cloud: Label: malware
Source: https://632313373.xyz/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderk	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsINEER-PC	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06P5	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/c	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsows	Avira URL Cloud: Label: malware
Source: 632313373.xyz	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 8443, "SleepTime": 12000, "MaxGetSize": 1403642, "Jitter": 60, "C2Server": "632313373.xyz,/js/jquery-3.3.1.min.js", "HttpPostUri": "/post", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 4016 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": "Host: 632313373.xyz\r\n"}

Multi AV Scanner detection for submitted file

Source: mode11_N1Fz.exe	Virustotal: Detection: 19%			Perma Link
Source: mode11_N1Fz.exe	ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: mode11_N1Fz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 632313373.xyz

Performs DNS queries to domains with low reputation

Source:

DNS query: 632313373.xyz

Source: global traffic

TCP traffic: 192.168.2.6:49717 -> 188.114.96.3:8443

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\mode11_N1Fz.exe

Code function: 0_2_000001F779F1E68C _snprintf,_snprintf,_snprintf,InternetQueryDataAvailable,InternetReadFile,InternetCloseHandle,

0_2_000001F779F1E68C

Source: global traffic

DNS traffic detected: DNS query: 632313373.xyz

Source: mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.go
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570543877.000001F734B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570543877.000001F734B2A000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792751377.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/PCUeQViQlYc.crl0
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570543877.000001F734B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570543877.000001F734B2A000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792751377.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt0
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/lk00%
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz/
Source: mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/#
Source: mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/0
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/3
Source: mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/_
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/c
Source: mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js
Source: mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js#
Source: mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js/
Source: mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3
Source: mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/
Source: mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/;
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/W
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/c
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06
Source: mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd065d
Source: mode11_N1Fz.exe, 00000000.00000003.2621399596.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06P5
Source: mode11_N1Fz.exe, 00000000.00000003.2621399596.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06ad
Source: mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js7
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsINEER-PC
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsK
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsO
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsX
Source: mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js_
Source: mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsc
Source: mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder
Source: mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder;
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderc
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderk
Source: mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsdero
Source: mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderw
Source: mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsg
Source: mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy
Source: mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsk
Source: mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsnt:
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jso
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsows
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsq
Source: mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jss
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsy
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/what?indextype=1&__cfduid=
Source: mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467195329.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734ACB000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570510123.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399854749.000001F734B24000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483349830.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535704719.000001F734B23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/what?indextype=1&__cfduid=tb052J35p8RaKSXMmpBHSiaAfIZcen7AuR6EL9CgDZHBgGfVzq7

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.mode11_N1Fz.exe.c000088000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_N1Fz.exe.c000088000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_N1Fz.exe.c000088000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_N1Fz.exe.c000088000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_N1Fz.exe.c0000e0000.4.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_N1Fz.exe.c0000e0000.4.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_N1Fz.exe.c000106000.6.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_N1Fz.exe.c000106000.6.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3529152410.000000C000088000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3529152410.000000C000088000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: Process Memory Space: mode11_N1Fz.exe PID: 6564, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown

Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779ED239C	0_2_000001F779ED239C
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EDC397	0_2_000001F779EDC397
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779ED0374	0_2_000001F779ED0374
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EC0334	0_2_000001F779EC0334
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EB9680	0_2_000001F779EB9680
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EDC680	0_2_000001F779EDC680
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EBCE3C	0_2_000001F779EBCE3C
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EDE600	0_2_000001F779EDE600
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779ECF5A8	0_2_000001F779ECF5A8
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779ED5914	0_2_000001F779ED5914
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EDCFF0	0_2_000001F779EDCFF0
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EDB7B0	0_2_000001F779EDB7B0
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EC6F38	0_2_000001F779EC6F38
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EDAAB0	0_2_000001F779EDAAB0
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779ED1264	0_2_000001F779ED1264
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EB916C	0_2_000001F779EB916C
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779ED1928	0_2_000001F779ED1928
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F3DBF0	0_2_000001F779F3DBF0
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F27B38	0_2_000001F779F27B38
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F31E64	0_2_000001F779F31E64
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F32528	0_2_000001F779F32528
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F32F9C	0_2_000001F779F32F9C
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F3D280	0_2_000001F779F3D280
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F301A8	0_2_000001F779F301A8

Source: 0.2.mode11_N1Fz.exe.c000088000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_N1Fz.exe.c000088000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_N1Fz.exe.c000088000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_N1Fz.exe.c000088000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_N1Fz.exe.c0000e0000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_N1Fz.exe.c0000e0000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_N1Fz.exe.c000106000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_N1Fz.exe.c000106000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3529152410.000000C000088000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3529152410.000000C000088000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: Process Memory Space: mode11_N1Fz.exe PID: 6564, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.winEXE@2/0@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:120:WilError_03

Source: mode11_N1Fz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mode11_N1Fz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mode11_N1Fz.exe	Virustotal: Detection: 19%
Source: mode11_N1Fz.exe	ReversingLabs: Detection: 13%

Source: mode11_N1Fz.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoned" not supported for cpu option "MapIter.Value called before Nextuse of closed network connectioncrypto/aes: output not full blockCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyW142108547152020037174224853515625710542735760100185871124267578125too many levels of symbolic linksslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeGODEBUG: no value specified for "reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangewaiting for unsupported file typecrypto/aes: invalid buffer overlapillegal base64 data at input byte CM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModes3552713678800500929355621337890625too many references: cannot spliceslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeunexpected runtime.netpoll error: encoding/hex: odd length hex stringSubscribeServiceChangeNotifications1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9network dropped connection on resettransport endpoint is not connectedpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid
Source: mode11_N1Fz.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoned" not supported for cpu option "MapIter.Value called before Nextuse of closed network connectioncrypto/aes: output not full blockCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyW142108547152020037174224853515625710542735760100185871124267578125too many levels of symbolic linksslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeGODEBUG: no value specified for "reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangewaiting for unsupported file typecrypto/aes: invalid buffer overlapillegal base64 data at input byte CM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModes3552713678800500929355621337890625too many references: cannot spliceslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeunexpected runtime.netpoll error: encoding/hex: odd length hex stringSubscribeServiceChangeNotifications1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9network dropped connection on resettransport endpoint is not connectedpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid
Source: mode11_N1Fz.exe	String found in binary or memory: C:/Program Files/Go/src/net/addrselect.go

Source: unknown	Process created: C:\Users\user\Desktop\mode11_N1Fz.exe "C:\Users\user\Desktop\mode11_N1Fz.exe"
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\mode11_N1Fz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: mode11_N1Fz.exe

Static file information: File size 4033024 > 1048576

Source: mode11_N1Fz.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2dc400

Source: mode11_N1Fz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: mode11_N1Fz.exe	Static PE information: section name: .xdata
Source: mode11_N1Fz.exe	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779EE776C push 0000006Ah; retf	0_2_000001F779EE7784
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F403FC push ebp; iretd	0_2_000001F779F40401
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F1A35D push edi; iretd	0_2_000001F779F1A35E
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F1BD58 push ebp; iretd	0_2_000001F779F1BD59
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F20901 push ebx; iretd	0_2_000001F779F20902
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F3B898 push ebp; iretd	0_2_000001F779F3B899
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F3B86F push ebp; iretd	0_2_000001F779F3B870
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F3B84F push ebp; iretd	0_2_000001F779F3B850
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F1A71E push cs; retf	0_2_000001F779F1A71F
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Code function: 0_2_000001F779F1C91C pushad ; retf	0_2_000001F779F1C91D

Source: C:\Users\user\Desktop\mode11_N1Fz.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mode11_N1Fz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\mode11_N1Fz.exe

Last function: Thread delayed

Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734AE2000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734ACB000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\mode11_N1Fz.exe

Code function: 0_2_000001F779F25E28 GetUserNameA,strrchr,_snprintf,

0_2_000001F779F25E28

Source: C:\Users\user\Desktop\mode11_N1Fz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mode11_N1Fz.exe.1f779eb0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mode11_N1Fz.exe.c000106000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mode11_N1Fz.exe PID: 6564, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Obfuscated Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mode11_N1Fz.exe	19%	Virustotal		Browse
mode11_N1Fz.exe	13%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/W	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/_	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/c	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js_	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsX	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsK	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsO	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/;	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsy	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsg	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder;	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06ad	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/3	100%	Avira URL Cloud	malware
http://c.pki.go	0%	Avira URL Cloud	safe
https://632313373.xyz:8443/js/jquery-3.3.1.min.jss	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsq	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/0	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd065d	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/#	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js#	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderw	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js7	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsnt:	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsdero	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	100%	Avira URL Cloud	malware
https://632313373.xyz/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderk	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsINEER-PC	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06P5	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/c	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsows	100%	Avira URL Cloud	malware
632313373.xyz	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
632313373.xyz	188.114.96.3	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
632313373.xyz	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://o.pki.goog/s/we1/lk00%	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsX	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/c	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsc	mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/W	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/_	mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js_	mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderc	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsK	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/what?indextype=1&__cfduid=	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A5C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsO	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/what?indextype=1&__cfduid=tb052J35p8RaKSXMmpBHSiaAfIZcen7AuR6EL9CgDZHBgGfVzq7	mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467195329.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734ACB000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570510123.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399854749.000001F734B24000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483349830.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535704719.000001F734B23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/;	mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsy	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js	mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/	mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/r4.crl0	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570543877.000001F734B2A000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792751377.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i.pki.goog/r4.crt0	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570543877.000001F734B2A000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792751377.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsk	mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsg	mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder;	mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.go	mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://632313373.xyz:8443/3	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06ad	mode11_N1Fz.exe, 00000000.00000003.2621399596.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jss	mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsq	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/0	mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734ACB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jso	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd065d	mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/#	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js#	mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/we1.crt0	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/gsr1.crl0	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570543877.000001F734B2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsnt:	mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderw	mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js7	mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/we1/PCUeQViQlYc.crl0	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143342736.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderk	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/gsr1.crt0-	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3108123500.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997781416.000001F734B37000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2535670629.000001F734B31000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997652358.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792732203.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2792654163.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2399909682.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638369388.000001F734B2B000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2945200996.000001F734B35000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734B3D000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3143276738.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B38000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621582441.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467259295.000001F734B29000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B23000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2570543877.000001F734B2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz/	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734AAD000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734ACB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsdero	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsINEER-PC	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06P5	mode11_N1Fz.exe, 00000000.00000003.2621399596.000001F734AEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/c	mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3	mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2467278904.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2483283434.000001F734B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsows	mode11_N1Fz.exe, 00000000.00000002.3531068018.000001F734A8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js/	mode11_N1Fz.exe, 00000000.00000003.2638356184.000001F734B17000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2944993989.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.3072346567.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2997796113.000001F734B19000.00000004.00000020.00020000.00000000.sdmp, mode11_N1Fz.exe, 00000000.00000003.2621513298.000001F734B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	632313373.xyz	European Union		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583719
Start date and time:	2025-01-03 13:04:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mode11_N1Fz.exe
Detection:	MAL
Classification:	mal100.troj.winEXE@2/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:05:25	API Interceptor	63x Sleep call for process: mode11_N1Fz.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
632313373.xyz	m.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
632313373.xyz	svchostinter.exe	Get hash	malicious	CobaltStrike	Browse	172.67.175.230

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://t1.awagama2.org	Get hash	malicious	Unknown	Browse	188.114.96.3
	m.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
	http://www.escudier-sas.fr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.18.11.207
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	http://www.technoafriwave.rw	Get hash	malicious	Unknown	Browse	1.1.1.1
	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.645697811149242
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mode11_N1Fz.exe
File size:	4'033'024 bytes
MD5:	5a2ad2d9d41aacfd8b0e51077ab36b9b
SHA1:	6afe484fc93369222f765e6f8006e437a417393d
SHA256:	d49c2451497109ae9f2646d06aa6dcf51b0f6af825d07f516b8dd59c03602401
SHA512:	760dd4699cefcf2916f2b28292a23ff23643e2571c8a2e974125a842d3dc781452701d3762befd5b2f039a375ee7409b2016e258d1d4867f5e9ab8d10163c9a6
SSDEEP:	49152:tgD5mHuE0r0VOjjC4mkZMyITWt1U4yP21Qsq8VT/0+2Ow2:tpGa
TLSH:	1A16BF0BBCE119B9C0A993328AB652567B71BC090F3263D73A50B37C2F76BD49936744
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........;......."..........n................@..............................`B...........`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46ec80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	d42595b695fc008ef2c56aabd8efd68e

Entrypoint Preview

Instruction
jmp 00007F4950822C30h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [00387812h]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007F49508264D5h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007F4950830AABh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x401000	0x53e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3fa000	0x5370	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x402000	0x499c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39a1a0	0x178	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbbbfc	0xbbc00	259f9be87cc369b51e3690ecee691075	False	0.47511130992010653	data	6.267039806214186	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xbd000	0x2dc3c0	0x2dc400	e426b568121764e8b535d618f091f0a1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x39a000	0x5fe40	0x16e00	8c4e4f11f08e7fa32a2461d8e5b73897	False	0.2855297984972678	data	3.2077810161720848	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3fa000	0x5370	0x5400	6b7df8b45d2250e08eb91fb84ea19749	False	0.4015531994047619	data	4.9405195822402	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x400000	0xb4	0x200	d5a432b15ea1de5871ba1b040f244088	False	0.228515625	shared library	1.787112262798912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x401000	0x53e	0x600	1eed92b78c29d6c28ea4846d7c7f7421	False	0.3776041666666667	OpenPGP Public Key	4.017189066074398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x402000	0x499c	0x4a00	07327396c5ce6db70861b1b3714f3a06	False	0.30938555743243246	data	5.393634428702928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x407000	0x1ee90	0x1f000	70c30b7d79d0b6e5d94720c5d893a1df	False	0.2522681451612903	data	5.088176736804498	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 13:05:24.635742903 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:24.640516996 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:24.640630007 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:24.650001049 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:24.655061960 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:25.088118076 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:25.088135958 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:25.088148117 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:25.088263988 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:25.105864048 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:25.110647917 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:25.199531078 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:25.199605942 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:25.239198923 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:25.243995905 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.389962912 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.389983892 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.390017986 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.390038013 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.390041113 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.390065908 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.390077114 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.390126944 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.390139103 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.390149117 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.390150070 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.390157938 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.390183926 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.390197039 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.960829973 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.965679884 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:26.965744019 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.966048956 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:26.970837116 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:27.443366051 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:27.443435907 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:27.444328070 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:27.445853949 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:27.449534893 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:27.451097965 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:28.553162098 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:28.553175926 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:28.553188086 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:28.553210020 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:28.553220987 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:28.553231955 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:28.553258896 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:28.553320885 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:33.569614887 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:33.570364952 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:33.575323105 CET	8443	49717	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:33.575392962 CET	49717	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:33.575913906 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:33.576046944 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:33.576257944 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:33.581856966 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:34.100667000 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:34.100780964 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:34.101469994 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:34.102638006 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:34.106215954 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:34.107444048 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.211838007 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.211867094 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.211874962 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.211889982 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.211961985 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.211977005 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.211983919 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.212049961 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.319521904 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.324593067 CET	8443	49718	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.324670076 CET	49718	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.327171087 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.332070112 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.332154036 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.332447052 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.337238073 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.798968077 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.799098015 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.799643993 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.800738096 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:35.804425955 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:35.805556059 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:36.918308973 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:36.918320894 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:36.918329000 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:36.918334007 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:36.918342113 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:36.918349028 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:36.918431044 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:36.918472052 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.022535086 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.023019075 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.027549982 CET	8443	49719	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:37.027620077 CET	49719	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.027787924 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:37.027863026 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.028095007 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.032870054 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:37.512507915 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:37.512633085 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.513489962 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.514571905 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:37.518229008 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:37.519406080 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.609838963 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.609870911 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.609884977 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.609896898 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.609904051 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.609915972 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.609925985 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.609927893 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.609939098 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.609951973 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.609970093 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.730807066 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.731545925 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.735888004 CET	8443	49720	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.735980988 CET	49720	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.736337900 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:38.736403942 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.736902952 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:38.741698980 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:39.179245949 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:39.179308891 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:39.179828882 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:39.181077003 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:39.184689045 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:39.185930014 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.285166979 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.285192013 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.285214901 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.285226107 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.285235882 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.285247087 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.285255909 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.285255909 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.285300016 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.399250984 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.399934053 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.404241085 CET	8443	49721	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.404303074 CET	49721	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.404815912 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.404872894 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.405397892 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.410275936 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.869597912 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.869652033 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.870124102 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.873451948 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:40.874908924 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:40.878249884 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:41.946784019 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:41.946810007 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:41.946820974 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:41.946835995 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:41.946846962 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:41.946851015 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:41.946892977 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:41.946917057 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:41.946950912 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:41.946950912 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.053812981 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.058921099 CET	8443	49722	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:42.058976889 CET	49722	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.064965010 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.069776058 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:42.069839954 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.070138931 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.074909925 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:42.526900053 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:42.526958942 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.535751104 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.539411068 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:42.540551901 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:42.544215918 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.662344933 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.662408113 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.662445068 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.662457943 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.662470102 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.662482023 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.662492990 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.662512064 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.662539959 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.662539959 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.789187908 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.793018103 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.794234037 CET	8443	49727	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.794357061 CET	49727	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.798042059 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:43.798136950 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.800925970 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:43.805994034 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:44.265562057 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:44.265618086 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:44.266535997 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:44.267920017 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:44.271383047 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:44.272664070 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432656050 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432672024 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432723999 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.432770014 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432830095 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432841063 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432852983 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432867050 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432877064 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.432883978 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.432898998 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.432929993 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.538397074 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.539060116 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.543530941 CET	8443	49730	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.543847084 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.546622038 CET	49730	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.546643972 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.546977997 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.551747084 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.996598005 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:45.996822119 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.997369051 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:45.998272896 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:46.002433062 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:46.003038883 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.071996927 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.072010040 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.072026968 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.072040081 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.072051048 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.072065115 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.072066069 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.072073936 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.072105885 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.179003954 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.179696083 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.184082985 CET	8443	49731	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.184143066 CET	49731	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.184505939 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.184576035 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.184990883 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.189771891 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.646096945 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.646212101 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.646658897 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.647735119 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:47.651412010 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:47.652466059 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.770565987 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.770622015 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.770632029 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.770643950 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.770657063 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.770668030 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.770678997 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.770694017 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:48.770735979 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:48.901390076 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:48.906431913 CET	8443	49732	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.906490088 CET	49732	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:48.911667109 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:48.916409016 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:48.916513920 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:48.916807890 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:48.921555996 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:49.384639025 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:49.384713888 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:49.447208881 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:49.451967001 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:49.490125895 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:49.494875908 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.544395924 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.544429064 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.544456005 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.544476986 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.544487953 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.544493914 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:50.544498920 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.544512987 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.544522047 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:50.544572115 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:50.647682905 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:50.648324013 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:50.652718067 CET	8443	49733	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.652811050 CET	49733	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:50.653101921 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:50.653186083 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:50.653635979 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:50.658416033 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:51.101268053 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:51.101360083 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:51.101783991 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:51.102788925 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:51.106494904 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:51.107615948 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.276736975 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.276758909 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.276771069 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.276782990 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.276794910 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.276804924 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.276829004 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.276881933 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.382157087 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.387092113 CET	8443	49734	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.387149096 CET	49734	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.390760899 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.395603895 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.395675898 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.396176100 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.400919914 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.865788937 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.866039991 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.866520882 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.867503881 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:52.871252060 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:52.872277975 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.011389017 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.011405945 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.011419058 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.011434078 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.011437893 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.011449099 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.011462927 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.011497974 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.011559963 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.116493940 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.116975069 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.121598005 CET	8443	49735	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.121684074 CET	49735	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.121793032 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.121862888 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.122334957 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.127099037 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.577954054 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.578021049 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.578519106 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.579526901 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:54.583292961 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:54.584316969 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.664237976 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.664263964 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.664278984 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.664290905 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.664308071 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.664305925 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:55.664321899 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.664330006 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.664345980 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:55.664381027 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:55.786844969 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:55.787309885 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:55.792133093 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.792248011 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:55.792282104 CET	8443	49736	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:55.792345047 CET	49736	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:55.792556047 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:55.797323942 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:56.267334938 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:56.267476082 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:56.268006086 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:56.269068956 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:56.272758007 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:56.273824930 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.365695000 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.365730047 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.365740061 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.365751982 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.365765095 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.365777016 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.365788937 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.365842104 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.365871906 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.474208117 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.479213953 CET	8443	49737	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.479269981 CET	49737	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.498169899 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.503046036 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.503132105 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.503379107 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.508207083 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.957045078 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.957216978 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.957685947 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.958973885 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:57.962517977 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:57.963715076 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.056441069 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.056489944 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.056510925 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.056528091 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.056548119 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.056559086 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.056577921 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.056595087 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.056607008 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.056642056 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.058758974 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.161823988 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.166860104 CET	8443	49738	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.166965008 CET	49738	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.175980091 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.182351112 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.182444096 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.182686090 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.189508915 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.631088018 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.631171942 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.631690025 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.632690907 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:05:59.636547089 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:05:59.637518883 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.736103058 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.736128092 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.736141920 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.736152887 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.736164093 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.736175060 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.736176014 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.736186028 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.736196995 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.736202955 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.736219883 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.736238003 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.849147081 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.849663973 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.854453087 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.854533911 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.854720116 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:00.859476089 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.866770983 CET	8443	49739	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:00.866835117 CET	49739	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:01.349277020 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:01.349329948 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:01.349764109 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:01.350908041 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:01.354504108 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:01.355734110 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.494030952 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.494050980 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.494071007 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.494085073 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.494085073 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.494102955 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.494108915 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.494122028 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.494162083 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.494174004 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.599772930 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.600298882 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.604815006 CET	8443	49740	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.604948997 CET	49740	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.605148077 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:02.605227947 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.619522095 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:02.624495983 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:03.070494890 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:03.070566893 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:03.070960999 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:03.071930885 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:03.075769901 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:03.076796055 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.245392084 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.245444059 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.245454073 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.245480061 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.245496035 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.245515108 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.245527983 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.245553970 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.245615005 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.245615005 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.245615005 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.245615005 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.246392965 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.349287987 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.349808931 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.355498075 CET	8443	49741	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.355520964 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.355566978 CET	49741	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.355607033 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.355806112 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.360835075 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.817154884 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.817254066 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.817699909 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.818741083 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:04.822506905 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:04.823582888 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:05.898806095 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:05.898835897 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:05.898854017 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:05.898859978 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:05.898879051 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:05.898883104 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:05.898891926 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:05.898894072 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:05.898911953 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:05.898916006 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:05.898931026 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:05.898955107 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:10.833904982 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:10.834378958 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:10.838912010 CET	8443	49742	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:10.839004040 CET	49742	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:10.839262962 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:10.839338064 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:10.845354080 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:10.850178957 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:11.283102036 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:11.283205032 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:11.284028053 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:11.284979105 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:11.288810968 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:11.289711952 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.381365061 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.381382942 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.381395102 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.381407022 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.381418943 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.381455898 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:12.381510019 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:12.467962027 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.468024015 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:12.583693027 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:12.584212065 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:12.588793993 CET	8443	49743	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.588851929 CET	49743	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:12.589238882 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:12.589318037 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:12.589653015 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:12.594621897 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:13.051002026 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:13.051085949 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:13.051593065 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:13.052736998 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:13.056344032 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:13.057562113 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.208625078 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.208692074 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.208693027 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.208709955 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.208722115 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.208734035 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.208744049 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.208746910 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.208784103 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.208797932 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.599595070 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.604624033 CET	8443	49744	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.604680061 CET	49744	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.612006903 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.616852999 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:14.616919994 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.617472887 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:14.622267962 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:15.080879927 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:15.080934048 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:15.081398964 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:15.082391977 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:15.086174965 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:15.087167025 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.247104883 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.247174025 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.247288942 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.247302055 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.247318983 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.247332096 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.247343063 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.247347116 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.247384071 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.349481106 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.349996090 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.354445934 CET	8443	49745	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.354551077 CET	49745	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.354746103 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.354823112 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.360197067 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.365010023 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.809223890 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.809340000 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.809711933 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.810777903 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:16.814455032 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:16.815547943 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.867728949 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.867763996 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.867779970 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.867784977 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.867795944 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.867810965 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.867819071 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.867822886 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.867835045 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.867866039 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.867866039 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.867866039 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.974308968 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.974863052 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.979240894 CET	8443	49746	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.979293108 CET	49746	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.979701042 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:17.979850054 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.980014086 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:17.984724045 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:18.478012085 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:18.478100061 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:18.479042053 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:18.480720043 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:18.483879089 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:18.485524893 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.561496019 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.561523914 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.561534882 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.561552048 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.561568975 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.561582088 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.561592102 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.561734915 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:19.677390099 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:19.677850962 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:19.682369947 CET	8443	49747	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.682446957 CET	49747	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:19.682660103 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:19.682732105 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:19.683062077 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:19.687834024 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:20.156894922 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:20.156960964 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:20.157331944 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:20.158284903 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:20.162142038 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:20.163078070 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.256418943 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.256434917 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.256448030 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.256468058 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.256484985 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.256496906 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.256500006 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.256546021 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.364896059 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.365334988 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.369776011 CET	8443	49749	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.369893074 CET	49749	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.370208025 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.370305061 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.370683908 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.375504971 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.844732046 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.844830990 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.845956087 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.847187042 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:21.850799084 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:21.851927042 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:22.939260960 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:22.939274073 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:22.939285994 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:22.939296961 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:22.939306974 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:22.939327955 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:22.939367056 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:22.939425945 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.092859030 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.093734980 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.097831964 CET	8443	49750	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:23.097906113 CET	49750	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.098527908 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:23.098588943 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.106589079 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.111347914 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:23.545622110 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:23.545691967 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.546161890 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.547478914 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:23.550950050 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:23.552273035 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.634177923 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.634197950 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.634211063 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.634222984 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.634236097 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.634248018 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.634272099 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:24.634321928 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:24.771193027 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:24.771691084 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:24.776173115 CET	8443	49751	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.776249886 CET	49751	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:24.776474953 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:24.776545048 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:24.776793003 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:24.781605959 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:25.228116989 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:25.228235006 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:25.228713989 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:25.229762077 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:25.233464956 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:25.234639883 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.367191076 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.367258072 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.367269993 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.367281914 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.367300034 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.367311001 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.367341042 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.367388964 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.474251986 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.474785089 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.479178905 CET	8443	49752	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.479526043 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.479600906 CET	49752	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.479635000 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.479832888 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.484580040 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.964303970 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.964421988 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.964982986 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.965986967 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:26.969702959 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:26.970721960 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.033730030 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.033751011 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.033761024 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.033781052 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.033792019 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.033806086 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.033817053 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.033951044 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.033951044 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.033951044 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.146276951 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.146696091 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.151289940 CET	8443	49753	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.151354074 CET	49753	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.151509047 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.151573896 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.151798010 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.156550884 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.599680901 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.599765062 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.600173950 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.601160049 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:28.604953051 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:28.605962992 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.718710899 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.718732119 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.718743086 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.718763113 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.718780041 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.718791962 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.718826056 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:29.718874931 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:29.833700895 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:29.839042902 CET	8443	49754	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.839121103 CET	49754	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:29.857620001 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:29.862504005 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:29.862590075 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:29.862876892 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:29.867705107 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:30.312796116 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:30.312963963 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:30.313471079 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:30.314435005 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:30.318281889 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:30.319233894 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.445029974 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.445060968 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.445072889 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.445095062 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.445111036 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.445125103 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.445131063 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:31.445142031 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.445163012 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:31.445187092 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:31.552498102 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:31.553101063 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:31.558150053 CET	8443	49755	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.558248997 CET	49755	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:31.558619022 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:31.558696985 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:31.559020996 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:31.564301014 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:32.040751934 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:32.040843964 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:32.041321039 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:32.042604923 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:32.046117067 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:32.047367096 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.133409023 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.133492947 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.133505106 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.133517027 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.133513927 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.133528948 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.133541107 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.133553982 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.133588076 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.396682978 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.397186041 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.401762962 CET	8443	49756	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.401839018 CET	49756	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.401973963 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.402045965 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.408586025 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.413424969 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.879072905 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.879127026 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.879836082 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.882376909 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:33.884625912 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:33.887142897 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:34.983963013 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:34.983983040 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:34.983994961 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:34.984005928 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:34.984016895 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:34.984018087 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:34.984030008 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:34.984056950 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:34.984066010 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.099525928 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.105732918 CET	8443	49757	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:35.105815887 CET	49757	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.126915932 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.131761074 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:35.131849051 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.132169008 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.136931896 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:35.601967096 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:35.602092028 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.930876970 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.932174921 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:35.935722113 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:35.936995029 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.093081951 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.093100071 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.093111992 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.093122959 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.093133926 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.093146086 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.093159914 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.093173981 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.093211889 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.208782911 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.209283113 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.213845015 CET	8443	49758	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.214066982 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.214148045 CET	49758	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.214194059 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.214453936 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.219171047 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.676182032 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.677222013 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.677676916 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.678679943 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:37.682408094 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:37.683501005 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.762608051 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.762686014 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.762700081 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.762720108 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.762723923 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.762736082 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.762749910 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.762765884 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.762785912 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.866905928 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.867125034 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.974435091 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.974950075 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.979491949 CET	8443	49759	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.979563951 CET	49759	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.979799032 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:38.979861021 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.980037928 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:38.984874010 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:39.578924894 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:39.579015017 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:39.579543114 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:39.580594063 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:39.584306002 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:39.585395098 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.669503927 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.669564962 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.669576883 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.669589996 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.669600010 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.669610977 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.669639111 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:40.669683933 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:40.786870956 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:40.787364006 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:40.791846991 CET	8443	49760	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.791913033 CET	49760	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:40.792160988 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:40.792217016 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:40.792414904 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:40.797131062 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:41.239450932 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:41.239578009 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:41.240453005 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:41.243587971 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:41.245242119 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:41.248418093 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.347918034 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.347934008 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.347945929 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.347956896 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.347968102 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.347979069 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.348030090 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:42.348093033 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:42.693078041 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:42.693553925 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:42.698179960 CET	8443	49761	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.698231936 CET	49761	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:42.698323011 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:42.698395014 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:42.698576927 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:42.703353882 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:43.199445009 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:43.199515104 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:43.200165987 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:43.201109886 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:43.204894066 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:43.205862045 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.332083941 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.332108974 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.332119942 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.332130909 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.332144022 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.332155943 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.332195997 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.332236052 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.443114042 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.443830967 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.448086977 CET	8443	49763	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.448143959 CET	49763	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.448657036 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.448721886 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.449086905 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.453850985 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.904480934 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.904591084 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.919601917 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.920633078 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:44.924375057 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:44.925482988 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.041160107 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.041187048 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.041198969 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.041209936 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.041215897 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.041220903 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.041233063 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.041246891 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.041294098 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.146570921 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.151607990 CET	8443	49764	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.151664972 CET	49764	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.159161091 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.163969040 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.164031029 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.164488077 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.169298887 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.619241953 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.619329929 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.626810074 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.628474951 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:46.631591082 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:46.633213043 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:47.774427891 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:47.774458885 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:47.774470091 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:47.774482012 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:47.774496078 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:47.774508953 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:47.774539948 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:47.774580002 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:47.774593115 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:47.776587009 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.007482052 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.008358002 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.012525082 CET	8443	49765	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:48.012581110 CET	49765	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.013142109 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:48.013206005 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.013448954 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.018181086 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:48.455804110 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:48.455991983 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.456628084 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.457675934 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:48.461430073 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:48.462426901 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.556857109 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.556890011 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.556900978 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.556911945 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.556931019 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.556941032 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.556952953 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.556993008 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:49.557033062 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:49.661902905 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:49.666924000 CET	8443	49766	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.667032957 CET	49766	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:49.670631886 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:49.675479889 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:49.676625013 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:49.676840067 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:49.681616068 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:50.144573927 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:50.144649029 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:50.145051956 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:50.146018028 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:50.149856091 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:50.150846958 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.315736055 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.315753937 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.315766096 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.315777063 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.315788984 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.315802097 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.315926075 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.427613020 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.428092003 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.432652950 CET	8443	49767	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.432750940 CET	49767	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.432921886 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.432996988 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.433336020 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.438193083 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.911295891 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.911609888 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.912034035 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.913053989 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:51.916788101 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:51.917912006 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.017030001 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.017059088 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.017071009 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.017083883 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.017087936 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.017096043 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.017108917 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.017115116 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.017115116 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.017139912 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.017159939 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.153767109 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.157919884 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.158833981 CET	8443	49768	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.158895016 CET	49768	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.162736893 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.162810087 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.171298981 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.178410053 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.629219055 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.629326105 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.629895926 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.631141901 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:53.634641886 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:53.635987043 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.724767923 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.724791050 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.724802017 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.724822044 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.724834919 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.724845886 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.724858046 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.724874973 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:54.724926949 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:54.833731890 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:54.834294081 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:54.839590073 CET	8443	49769	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.839606047 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:54.839674950 CET	49769	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:54.839720964 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:54.840110064 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:54.844857931 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:55.288178921 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:55.288264990 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:55.288675070 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:55.289874077 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:55.293504953 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:55.294711113 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.341547966 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.341558933 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.341569901 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.341582060 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.341593027 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.341604948 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.341614008 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.341649055 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.341701031 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.453104019 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.453587055 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.458102942 CET	8443	49770	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.458180904 CET	49770	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.458405018 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.458482027 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.458766937 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.463576078 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.904289007 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.904378891 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.904805899 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.905720949 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:56.909627914 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:56.910515070 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:57.981527090 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:57.981542110 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:57.981553078 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:57.981563091 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:57.981575966 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:57.981587887 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:57.981645107 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:57.981687069 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.093842983 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.094311953 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.099172115 CET	8443	49771	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:58.099189043 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:58.099234104 CET	49771	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.099267960 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.099463940 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.104253054 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:58.565736055 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:58.565924883 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.566359997 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.567390919 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:58.571165085 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:58.572144985 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.660362959 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.660388947 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.660399914 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.660444021 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.660454988 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.660465956 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.660578966 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.660578966 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.660578966 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.660578966 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.765845060 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.766294956 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.771085024 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.771100044 CET	8443	49772	188.114.96.3	192.168.2.6
Jan 3, 2025 13:06:59.771169901 CET	49772	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.771188021 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.771539927 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:06:59.776304960 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:00.222798109 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:00.222929955 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:00.223486900 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:00.224433899 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:00.228302956 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:00.229182005 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.396835089 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.396850109 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.396861076 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.396879911 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.396892071 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.396903992 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.396913052 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.396929979 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.397125959 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.500194073 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.500649929 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.505181074 CET	8443	49773	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.505232096 CET	49773	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.505464077 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.505517960 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.505714893 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.510451078 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.976852894 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.976906061 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.977539062 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.980262995 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:01.982299089 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:01.985037088 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.068543911 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.068622112 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.068636894 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.068651915 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.068665981 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.068681002 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.068694115 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.068744898 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.172601938 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.173079967 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.177659988 CET	8443	49774	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.177738905 CET	49774	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.177907944 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.177973986 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.180835009 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.185611963 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.621309996 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.621397018 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.621889114 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.622894049 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:03.626630068 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:03.627620935 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.743201017 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.743213892 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.743225098 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.743237019 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.743247986 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.743294954 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:04.743333101 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:04.829338074 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.829435110 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:04.937601089 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:04.938081980 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:04.942600965 CET	8443	49775	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.942650080 CET	49775	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:04.942913055 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:04.942975044 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:04.943226099 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:04.948873997 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:05.412131071 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:05.412205935 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:05.412646055 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:05.413584948 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:05.417458057 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:05.418401957 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.533562899 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.533586025 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.533601999 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.533612967 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.533623934 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.533636093 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.533653021 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:06.533694983 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:06.640780926 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:06.641376019 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:06.645704985 CET	8443	49776	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.645766020 CET	49776	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:06.646117926 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:06.646178007 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:06.646460056 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:06.651176929 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:07.116118908 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:07.116225004 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:07.116616964 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:07.117532015 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:07.121390104 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:07.122265100 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.221697092 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.221750021 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.221760988 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.221770048 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.221781969 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.221785069 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.221793890 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.221811056 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.221813917 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.221848965 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.328207970 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.328656912 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.333208084 CET	8443	49777	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.333257914 CET	49777	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.333489895 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.333551884 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.333777905 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.338609934 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.815126896 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.815185070 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.815609932 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.816567898 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:08.820355892 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:08.821278095 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:09.916436911 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:09.916464090 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:09.916487932 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:09.916500092 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:09.916505098 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:09.916512012 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:09.916522980 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:09.916536093 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:09.916575909 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.059065104 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.059513092 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.064405918 CET	8443	49778	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:10.064459085 CET	49778	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.064629078 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:10.064688921 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.065356970 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.070570946 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:10.510201931 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:10.510312080 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.510766029 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.511923075 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:10.515573978 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:10.516719103 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.624003887 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.624027967 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.624038935 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.624051094 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.624068975 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:11.624069929 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.624080896 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.624092102 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.624106884 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:11.624150991 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:11.734472990 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:11.734951019 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:11.739483118 CET	8443	49779	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.739586115 CET	49779	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:11.739731073 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:11.739798069 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:11.740037918 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:11.744815111 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:12.189718962 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:12.189815044 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:12.190331936 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:12.191296101 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:12.195106030 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:12.196094036 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.300318003 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.300331116 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.300342083 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.300384998 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.300389051 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.300398111 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.300410986 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.300421000 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.300430059 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.300442934 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.300462008 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.406487942 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.407006979 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.411595106 CET	8443	49780	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.411667109 CET	49780	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.411849976 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.411920071 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.412276983 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.417167902 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.870189905 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.870265961 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.870913029 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.871958017 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:13.875731945 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:13.876802921 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.019146919 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.019227028 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.019243002 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.019257069 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.019273043 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.019289970 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.019294024 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.019309998 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.019309998 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.019337893 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.125056028 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.125529051 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.130074978 CET	8443	49781	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.130142927 CET	49781	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.130458117 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.130517960 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.130712986 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.135519981 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.605519056 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.605576038 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.605958939 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.607137918 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:15.610769033 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:15.611999035 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.694349051 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.694364071 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.694375992 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.694386005 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.694397926 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.694407940 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.694431067 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:16.694475889 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:16.796953917 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:16.797467947 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:16.801912069 CET	8443	49782	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.801973104 CET	49782	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:16.802208900 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:16.802268982 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:16.802468061 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:16.807197094 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:17.255646944 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:17.255740881 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:17.260339022 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:17.261357069 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:17.265132904 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:17.266141891 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383610010 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383631945 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383650064 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383661032 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383671045 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383681059 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383694887 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383709908 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.383771896 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.383881092 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.500972033 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.502139091 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.505958080 CET	8443	49783	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.506076097 CET	49783	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.507008076 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.507116079 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.507630110 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.512379885 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.963108063 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.963201046 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.966986895 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.971735954 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:18.988897085 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:18.993772984 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.111433029 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.111524105 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.111534119 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.111545086 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.111557961 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.111568928 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.111581087 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.111612082 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.111638069 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.219842911 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.220263004 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.224838018 CET	8443	49784	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.224927902 CET	49784	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.225006104 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.225102901 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.225346088 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.230106115 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.689419985 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.690227985 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.690634012 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.691647053 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:20.695398092 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:20.696391106 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.789361954 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.789422035 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.789447069 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.789458036 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.789463997 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.789469004 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.789463997 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.789483070 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.789493084 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.789582014 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.891609907 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.892096043 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.896644115 CET	8443	49785	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.896703005 CET	49785	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.896893024 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:21.896955013 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.897154093 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:21.901915073 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:22.356193066 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:22.356350899 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:22.356894016 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:22.357927084 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:22.361609936 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:22.362716913 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.454266071 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.454286098 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.454297066 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.454308033 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.454318047 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.454329014 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.454349041 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:23.454385996 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:23.562714100 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:23.563297033 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:23.568409920 CET	8443	49786	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.568474054 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:23.568494081 CET	49786	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:23.568542957 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:23.568941116 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:23.573676109 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:24.035759926 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:24.035844088 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:24.036264896 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:24.037147045 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:24.040996075 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:24.041907072 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.117899895 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.117913008 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.117919922 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.117929935 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.117940903 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.117952108 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.117981911 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.118020058 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.234750032 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.235340118 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.239811897 CET	8443	49787	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.239902973 CET	49787	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.240155935 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.240230083 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.240576982 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.245368958 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.699531078 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.699589014 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.700038910 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.700978041 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:25.705123901 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:25.706254959 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.791415930 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.791434050 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.791445971 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.791456938 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.791467905 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.791469097 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:26.791480064 CET	8443	49789	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.791501999 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:26.791512012 CET	49789	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:26.906814098 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:26.907285929 CET	49790	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:26.911897898 CET	8443	49788	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.911947966 CET	49788	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:26.912031889 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:26.912090063 CET	49790	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:26.912343025 CET	49790	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:26.917145967 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:27.359674931 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:27.359724045 CET	49790	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:27.363787889 CET	49790	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:27.364780903 CET	49790	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:27.368576050 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:27.369560957 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:28.436065912 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:28.436100960 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:28.436113119 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:28.436124086 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:28.436136007 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:28.436147928 CET	8443	49790	188.114.96.3	192.168.2.6
Jan 3, 2025 13:07:28.436151028 CET	49790	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:28.436177969 CET	49790	8443	192.168.2.6	188.114.96.3
Jan 3, 2025 13:07:28.436207056 CET	49790	8443	192.168.2.6	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 13:05:24.617070913 CET	62228	53	192.168.2.6	1.1.1.1
Jan 3, 2025 13:05:24.631814003 CET	53	62228	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 13:05:24.617070913 CET	192.168.2.6	1.1.1.1	0x8079	Standard query (0)	632313373.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 13:05:24.631814003 CET	1.1.1.1	192.168.2.6	0x8079	No error (0)	632313373.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 13:05:24.631814003 CET	1.1.1.1	192.168.2.6	0x8079	No error (0)	632313373.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	07:05:22
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\mode11_N1Fz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mode11_N1Fz.exe"
Imagebase:	0xf60000
File size:	4'033'024 bytes
MD5 hash:	5A2AD2D9D41AACFD8B0E51077AB36B9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3529152410.000000C000088000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3529152410.000000C000088000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3530321544.000000C000106000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:05:22
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.3%
Total number of Nodes:	207
Total number of Limit Nodes:	26

Executed Functions

Function 000001F779F1E68C Relevance: 9.3, APIs: 6, Instructions: 260
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000001F779F1E725

Part of subcall function 000001F779F2F63C: _errno.LIBCMT ref: 000001F779F2F673
Part of subcall function 000001F779F2F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F2F67E

_snprintf.LIBCMT ref: 000001F779F1E7BD
InternetQueryDataAvailable.WININET ref: 000001F779F1E87A

Part of subcall function 000001F779F22D70: strchr.LIBCMT ref: 000001F779F22DD6
Part of subcall function 000001F779F22D70: _snprintf.LIBCMT ref: 000001F779F22E0C

Part of subcall function 000001F779F22C0C: strchr.LIBCMT ref: 000001F779F22C69
Part of subcall function 000001F779F22C0C: _snprintf.LIBCMT ref: 000001F779F22CB3

_snprintf.LIBCMT ref: 000001F779F1E7D4

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$AvailableDataInternetQuery_errno_invalid_parameter_noinfo
String ID:
API String ID: 2459009813-0
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: bd6c546e5bea7246cc1ef69336f629544378dc15c85c1d06ec1e228b8c3fe1ee
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: AD81713162CA898FEB59FB18D8897FAB3E5FB94711F10063AA44BC31D1DE64D9028781

Function 000001F779F25E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F779F25FEC: malloc.LIBCMT ref: 000001F779F26008

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,?,-00000001,?,00000002,000001F779F1CC89), ref: 000001F779F25EAF
strrchr.LIBCMT ref: 000001F779F25EED
_snprintf.LIBCMT ref: 000001F779F25F9B

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: NameUser_snprintfmallocstrrchr
String ID:
API String ID: 1238167203-0
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: 1b604093e8d024554e062ea0816e5b10d122d015e1d61c30bb5ad0c4a45df470
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: FD51513072CA894FEB58BB68945A7FD72E2E789710F14462DF48FC32D7D924D8428786

Function 000001F779F1CA74 Relevance: 7.9, APIs: 6, Instructions: 411
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F779F25FEC: malloc.LIBCMT ref: 000001F779F26008

malloc.LIBCMT ref: 000001F779F1CB3B

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

Part of subcall function 000001F779F2C230: malloc.LIBCMT ref: 000001F779F2C29C

Part of subcall function 000001F779F2EAA8: malloc.LIBCMT ref: 000001F779F2EAF8

Part of subcall function 000001F779F2EAA8: realloc.LIBCMT ref: 000001F779F2EB07

malloc.LIBCMT ref: 000001F779F1CC4A
_snprintf.LIBCMT ref: 000001F779F1CCC1
_snprintf.LIBCMT ref: 000001F779F1CCE7
_snprintf.LIBCMT ref: 000001F779F1CD0E
free.LIBCMT ref: 000001F779F1CEC6

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction ID: b3f7c41f8cdc9349490469a5845fcdc17e4e84c98dc2b8b1eec67bb4626f6316
Opcode Fuzzy Hash: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction Fuzzy Hash: 3BD1533072EA864BFB58BB64889A7FD72F1EB89311F54463DA447C32D3DE24D9058782

Function 000001F779F1F014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000001F779F1F042
WSAIoctl.WS2_32 ref: 000001F779F1F08F
closesocket.WS2_32 ref: 000001F779F1F0EE

Strings

_Cy, xrefs: 000001F779F1F0A1

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: IoctlSocketclosesocket
String ID: _Cy
API String ID: 3445158922-1085951347
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: b32be18442c191855cfc5fa017410e36fdab72f10049bb1932177f1dcf1e95e4
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: 6831B63061DA898BDB54EF2898897B6B7E1FBA8315F114B3EE54BC32E1DB34C5418781

Function 000001F779F1EA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000001F779F1EB0C
InternetConnectA.WININET ref: 000001F779F1EB7A

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction ID: 596aa570dbf7703db2106aaa32d6811341dadcd434ee7d36d0b3769ee1446a37
Opcode Fuzzy Hash: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction Fuzzy Hash: 8051B43022DB458FEB59EF28D8997B973E1FB89305F15053DE487C32D2DA3899068782

Function 000001F779EC96B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001F779EC977B

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction ID: 7112bcbb9b7ae802aa179350718c6b9a2d2e48265c1461e45efb807434f9bfcb
Opcode Fuzzy Hash: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction Fuzzy Hash: EE718736219B8486CAA0CB0AE49036AB7B0F7C9B94F544125EFCE87B68DF7DD555CB00

Function 000001F779EC9324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001F779EC9471

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction ID: e4ce2ad299d35c57717926a238a31e161740c3afb122e9f2db595e5833c7dbd2
Opcode Fuzzy Hash: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction Fuzzy Hash: D741BA72629B8487DB50DB19E48471AB7B1F3C9B94F101225FADE83BA8DB3CD4518F00

Function 00FCF220 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3527825363.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3527784123.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3527917955.000000000101D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528403204.00000000012FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528419406.00000000012FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528436006.0000000001301000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528485128.000000000130E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.000000000130F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.0000000001328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.000000000132B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.000000000132E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.0000000001356000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.0000000001358000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528775211.000000000135A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528805034.0000000001361000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528819371.0000000001362000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_mode11_N1Fz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a83c295b55d1fb3924cfc6086ff6026e810ee76d85704118357723c5304dc2
Instruction ID: f4eea7c2b13f26ce1771c98ace0b9625a52617a82984f091687ba75f291571fd
Opcode Fuzzy Hash: a2a83c295b55d1fb3924cfc6086ff6026e810ee76d85704118357723c5304dc2
Instruction Fuzzy Hash: B1319A6791CFC482D3218B24F5417AAB364F7A9784F15A715EFC812A1ADF38E2E5CB40

Function 00FCB5C0 Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3527825363.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3527784123.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3527917955.000000000101D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528403204.00000000012FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528419406.00000000012FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528436006.0000000001301000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528485128.000000000130E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.000000000130F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.0000000001328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.000000000132B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.000000000132E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.0000000001356000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528532410.0000000001358000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528775211.000000000135A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528805034.0000000001361000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3528819371.0000000001362000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_mode11_N1Fz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f426410239744f5ba57e2b78151ac65bfe157d6a2c0a85e8369f5e0dce230c44
Instruction ID: febb82414c9601695d1a52c687048c8d197aa63e8f98309b89b80f404ee0bd40
Opcode Fuzzy Hash: f426410239744f5ba57e2b78151ac65bfe157d6a2c0a85e8369f5e0dce230c44
Instruction Fuzzy Hash:

Non-executed Functions

Function 000001F779ED239C Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001F779ED23FD

Part of subcall function 000001F779ED0A00: _getptd.LIBCMT ref: 000001F779ED0A16
Part of subcall function 000001F779ED0A00: __updatetlocinfo.LIBCMT ref: 000001F779ED0A4B
Part of subcall function 000001F779ED0A00: __updatetmbcinfo.LIBCMT ref: 000001F779ED0A72

_errno.LIBCMT ref: 000001F779ED2402

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

_fileno.LIBCMT ref: 000001F779ED242F

Part of subcall function 000001F779ED4E54: _errno.LIBCMT ref: 000001F779ED4E5D
Part of subcall function 000001F779ED4E54: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ED4E68

write_multi_char.LIBCMT ref: 000001F779ED2A6B
write_string.LIBCMT ref: 000001F779ED2A88
write_multi_char.LIBCMT ref: 000001F779ED2AA5
write_string.LIBCMT ref: 000001F779ED2B04
write_string.LIBCMT ref: 000001F779ED2B3B
write_multi_char.LIBCMT ref: 000001F779ED2B5D
free.LIBCMT ref: 000001F779ED2B71
_isleadbyte_l.LIBCMT ref: 000001F779ED2C42
write_char.LIBCMT ref: 000001F779ED2C58
write_char.LIBCMT ref: 000001F779ED2C79
_errno.LIBCMT ref: 000001F779ED2D7C
_invalid_parameter_noinfo.LIBCMT ref: 000001F779ED2D87

Strings

@, xrefs: 000001F779ED241B
, xrefs: 000001F779ED2A3F

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction ID: 6cecf7e5c9f73f14cd5d113ef042998445bca2933cf742739160d5022f13dbee
Opcode Fuzzy Hash: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction Fuzzy Hash: 4852EC3362E68686FB65AA1495C83FE7BB0B745784F1C0225DA47077E8DBF9C960CB00

Function 000001F779F32F9C Relevance: 30.8, APIs: 15, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

Part of subcall function 000001F779F31600: _getptd.LIBCMT ref: 000001F779F31616
Part of subcall function 000001F779F31600: __updatetlocinfo.LIBCMT ref: 000001F779F3164B
Part of subcall function 000001F779F31600: __updatetmbcinfo.LIBCMT ref: 000001F779F31672

_errno.LIBCMT ref: 000001F779F33002

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

_fileno.LIBCMT ref: 000001F779F3302F

Part of subcall function 000001F779F35A54: _errno.LIBCMT ref: 000001F779F35A5D
Part of subcall function 000001F779F35A54: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F35A68

write_multi_char.LIBCMT ref: 000001F779F3366B
write_string.LIBCMT ref: 000001F779F33688
write_multi_char.LIBCMT ref: 000001F779F336A5
write_string.LIBCMT ref: 000001F779F33704
write_multi_char.LIBCMT ref: 000001F779F3375D
free.LIBCMT ref: 000001F779F33771
_isleadbyte_l.LIBCMT ref: 000001F779F33842
write_char.LIBCMT ref: 000001F779F33858
write_char.LIBCMT ref: 000001F779F33879
_errno.LIBCMT ref: 000001F779F3397C
_invalid_parameter_noinfo.LIBCMT ref: 000001F779F33987

Strings

, xrefs: 000001F779F3363F
@, xrefs: 000001F779F3301B

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3613058218-1077428164
Opcode ID: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction ID: bbb2eb0de96be965e18de4d26d2f05c28a8fa2a63bf9fbfc27e0a3f5c2af1c03
Opcode Fuzzy Hash: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction Fuzzy Hash: 4C62D53192EAC78AFB69EA18C4493F9B7F1FB95310FA4433DD497C31D1D6AC98428641

Function 000001F779F32528 Relevance: 29.0, APIs: 15, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001F779F31600: _getptd.LIBCMT ref: 000001F779F31616
Part of subcall function 000001F779F31600: __updatetlocinfo.LIBCMT ref: 000001F779F3164B
Part of subcall function 000001F779F31600: __updatetmbcinfo.LIBCMT ref: 000001F779F31672

_errno.LIBCMT ref: 000001F779F3258E

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

_fileno.LIBCMT ref: 000001F779F325BB

Part of subcall function 000001F779F35A54: _errno.LIBCMT ref: 000001F779F35A5D
Part of subcall function 000001F779F35A54: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F35A68

write_multi_char.LIBCMT ref: 000001F779F32BEB
write_string.LIBCMT ref: 000001F779F32C08
write_multi_char.LIBCMT ref: 000001F779F32C25
write_string.LIBCMT ref: 000001F779F32C84
write_multi_char.LIBCMT ref: 000001F779F32CDD
free.LIBCMT ref: 000001F779F32CF1
_isleadbyte_l.LIBCMT ref: 000001F779F32DC2
write_char.LIBCMT ref: 000001F779F32DD8
write_char.LIBCMT ref: 000001F779F32DF9
_errno.LIBCMT ref: 000001F779F32EF3
_invalid_parameter_noinfo.LIBCMT ref: 000001F779F32EFE

Strings

, xrefs: 000001F779F32BBF

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3613058218-3916222277
Opcode ID: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction ID: 04a2857a540813b0f85fa7d7e786c862a4a456825d971a43c3f365421d5324fe
Opcode Fuzzy Hash: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction Fuzzy Hash: 8162B73093EAC78AFB68AA589C593F977F1FB95310F24433DD987C31D2DA2899428641

Function 000001F779ED1928 Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 645COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001F779ED1989

Part of subcall function 000001F779ED0A00: _getptd.LIBCMT ref: 000001F779ED0A16
Part of subcall function 000001F779ED0A00: __updatetlocinfo.LIBCMT ref: 000001F779ED0A4B
Part of subcall function 000001F779ED0A00: __updatetmbcinfo.LIBCMT ref: 000001F779ED0A72

_errno.LIBCMT ref: 000001F779ED198E

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

_fileno.LIBCMT ref: 000001F779ED19BB

Part of subcall function 000001F779ED4E54: _errno.LIBCMT ref: 000001F779ED4E5D
Part of subcall function 000001F779ED4E54: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ED4E68

write_multi_char.LIBCMT ref: 000001F779ED1FEB
write_string.LIBCMT ref: 000001F779ED2008
_errno.LIBCMT ref: 000001F779ED22F3
_invalid_parameter_noinfo.LIBCMT ref: 000001F779ED22FE

Strings

0, xrefs: 000001F779ED1D28
-, xrefs: 000001F779ED1F9C

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$0
API String ID: 3246410048-417717675
Opcode ID: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction ID: 6020adfd7b34f5bb428ceb10f094fc62407960186b94c533b03e7f7fd25dba5e
Opcode Fuzzy Hash: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction Fuzzy Hash: 5A42F07362E68686FB69EB2595C83FE7BB0B745780F1C4225DA47067D4D7B9C860CB00

Function 000001F779ED5914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001F779ED596A
_errno.LIBCMT ref: 000001F779ED5971
_invalid_parameter_noinfo.LIBCMT ref: 000001F779ED597C

Strings

U, xrefs: 000001F779ED5EDE

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction ID: 662424e9295b87b15bf22d4a8d7e0d8bd0a13284bdb623f68ce4962f4f1a968e
Opcode Fuzzy Hash: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction Fuzzy Hash: 6612F43322A64286EB20AF24D4C83FEB7B1F785754F580226EA4B476D8DFB9C555CB10

Function 000001F779F27B38 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001F779F27CA5
_snprintf.LIBCMT ref: 000001F779F27D66
_snprintf.LIBCMT ref: 000001F779F27D83
_snprintf.LIBCMT ref: 000001F779F27FD8
_snprintf.LIBCMT ref: 000001F779F280E8
_snprintf.LIBCMT ref: 000001F779F281A6
_snprintf.LIBCMT ref: 000001F779F2825E
_snprintf.LIBCMT ref: 000001F779F28002

Part of subcall function 000001F779F2F63C: _errno.LIBCMT ref: 000001F779F2F673
Part of subcall function 000001F779F2F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F2F67E

_snprintf.LIBCMT ref: 000001F779F28276
_snprintf.LIBCMT ref: 000001F779F28334

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: dbe3a77beab3e4a1db0730ae5a8e82d59f3c9d7f5753fe02a73a2a6c4cb9fa17
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: A452A13052DD8A9BE759AB2CD4467F9F3F0FF68305F445228D986C71A2EB34E5828781

Function 000001F779EC6F38 Relevance: 13.0, APIs: 10, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001F779EC7166
_snprintf.LIBCMT ref: 000001F779EC7183
_snprintf.LIBCMT ref: 000001F779EC70A5

Part of subcall function 000001F779ECEA3C: _errno.LIBCMT ref: 000001F779ECEA73
Part of subcall function 000001F779ECEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ECEA7E

_snprintf.LIBCMT ref: 000001F779EC73D8
_snprintf.LIBCMT ref: 000001F779EC7734

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: bef1442e98e39d787231f8adda2a512aa0bb8d7ee763728319e25eb16681cf83
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: 5C42D772229F8691EB159B28D0452F9B3B0FF95755F005221EFCA17BA1EF79D2A2C300

Function 000001F779EDB7B0 Relevance: 5.9, Strings: 4, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 000001F779EDBE63
e ', xrefs: 000001F779EDC405, 000001F779EDC47E, 000001F779EDC4F7, 000001F779EDC570
<, xrefs: 000001F779EDBE6E
ailure #%d - %s, xrefs: 000001F779EDC41F, 000001F779EDC498, 000001F779EDC511, 000001F779EDC58A

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID: $<$ailure #%d - %s$e '
API String ID: 0-963976815
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: 43c966dfa065a3b56461171f807af760b442c0ae465cde826ecfb9c883404899
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: 8D92E0B2329A8187DB58CB1DE4A573AB7A1F3C8B80F44513AE79B87794CA7CC551CB04

Function 000001F779EDC397 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

e ', xrefs: 000001F779EDC405, 000001F779EDC47E, 000001F779EDC4F7, 000001F779EDC570
ailure #%d - %s, xrefs: 000001F779EDC41F, 000001F779EDC498, 000001F779EDC511, 000001F779EDC58A

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID: ailure #%d - %s$e '
API String ID: 0-4163927988
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: d40c7b74c63bb1ac85cf2599782e6d0fae8286ec8f71b609a46af97e91f439bc
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: 49612CB6219A518BD714CB09E4D467AB7E1F3CC784F88431AE38B877A8CA3CD545CB40

Function 000001F779F301A8 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 000001F779F301DC

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction ID: 7ac71a196e18bc864584f9c0099b6f03ade94a8aafae2d193121d659b8a1922c
Opcode Fuzzy Hash: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction Fuzzy Hash: 95A1DC71619A498FEF54FFB5EC98AAA37B2F768301721893A900AC3174DABCD545CB40

Function 000001F779F3DBF0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: ffab3345ad5abd5acb7c5523dfdba7f64f9ad747a283b9d541998824c186a9ed
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 5B620A312286558FD31CCB1CC5B1B7AB7E1FB89340F44896DE287CB692C639DA45CB91

Function 000001F779F3D280 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 6c8856c7deff6a834fdedcb2cf73049d1a6c32f59dbde30fe58ccd2fb3839fc3
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 3852EE312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE28ACB692C639E545CB91

Function 000001F779EDCFF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: 048ee9d4ec294fba91daa0eaca1014676e4fed6d095dc164d0ecdcb39089165d
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 185261B221898587D708CB1DE4A177AB7E1F3C9B80F44862AE7878B799CE7DD554CB00

Function 000001F779EDC680 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 3c8610bcb867ddba0076629f2e172e480febd2fa066084aad7371c98f43d1119
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: C45252B221898187D708CB1DE4A577AB7F1F3C9B80F44862AE7878B799CA7DD544CB40

Function 000001F779EB9680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction ID: 116b2057563cc66cecb28c6aa1409269760515211270401f5c59b1c890770cce
Opcode Fuzzy Hash: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction Fuzzy Hash: 3DF1743332DA4382EB20AA1594D4BFE73B1F796798F500335DA4A877C9EAB4C905CB40

Function 000001F779EBCE3C Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74bee57ece39a3ee739721ddd6b8b7c874878cbec99e002ba7fd2a6b2694298
Instruction ID: 600b3a79de5a47ce6c928c47bfe47d286b0fbd34cb54e568fb5e2cc79050bcf3
Opcode Fuzzy Hash: f74bee57ece39a3ee739721ddd6b8b7c874878cbec99e002ba7fd2a6b2694298
Instruction Fuzzy Hash: 3DE17EB362974283EB64AB25E8857FA73B1F745754F444235DB8B966C2EABCE481C300

Function 000001F779EB916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction ID: 783559b0adcd7ac14d158dbd968d6d9d3c3a6dbfac72eb68b3ae963da9af9536
Opcode Fuzzy Hash: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction Fuzzy Hash: 36E1B33372AA4391EB10AA14D4C4AFE77B1F79678CF810331DA4B97AD9EAB4C905C740

Function 000001F779EC0334 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction ID: d7bab19505b98287d7a9f4e7fce1b4f36860280d2f102f3da5ecb7450fd80581
Opcode Fuzzy Hash: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction Fuzzy Hash: D071617322AB4286FB60AF65E4C83AD73B1F749B95F005635DA8A437D5DFB8C4848B40

Function 000001F779F36E1C Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F36E4E

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

__doserrno.LIBCMT ref: 000001F779F36E45

Part of subcall function 000001F779F31CA8: _getptd_noexit.LIBCMT ref: 000001F779F31CAC

__doserrno.LIBCMT ref: 000001F779F36EAB
_errno.LIBCMT ref: 000001F779F36EB2
_invalid_parameter_noinfo.LIBCMT ref: 000001F779F36F16

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction ID: 63a9ee442deb6d8bcd6f8061706c6adbf4e5fbcdaaa50f01767b5cb170568404
Opcode Fuzzy Hash: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction Fuzzy Hash: 8831947123EA864FF319BF78988B3F936A0EB46320F520779E417872D3D67898414391

Function 000001F779ED1B48 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

write_multi_char.LIBCMT ref: 000001F779ED1FEB
write_string.LIBCMT ref: 000001F779ED2008
write_multi_char.LIBCMT ref: 000001F779ED2025
write_string.LIBCMT ref: 000001F779ED2084
write_multi_char.LIBCMT ref: 000001F779ED20DD
free.LIBCMT ref: 000001F779ED20F1

Strings

, xrefs: 000001F779ED1FBF

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: write_multi_char$write_string$free
String ID:
API String ID: 2630409672-3916222277
Opcode ID: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction ID: 0455487cc12b9b2b6b5b649f1cdcf4cc622b969723e5dd48112171d53098b090
Opcode Fuzzy Hash: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction Fuzzy Hash: 56A1F33362D64286FB25EB65A4883FE7BB0B785784F181221EE4B177D8CBB5C851CB00

Function 000001F779F37C08 Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F37C33

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

__doserrno.LIBCMT ref: 000001F779F37C2B

Part of subcall function 000001F779F31CA8: _getptd_noexit.LIBCMT ref: 000001F779F31CAC

__lock_fhandle.LIBCMT ref: 000001F779F37C77
_lseeki64_nolock.LIBCMT ref: 000001F779F37C90
_unlock_fhandle.LIBCMT ref: 000001F779F37CB3

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction ID: 1d199c2d9bac97ad2a8a286f68a0dfc07133529ae2924ec2b02faa8673b1a2ac
Opcode Fuzzy Hash: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction Fuzzy Hash: D821F73072EA824FF359BB68988A3FD72F0EB87361F550379E417872D3D66C580142A1

Function 000001F779F37A90 Relevance: 15.1, APIs: 10, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F37ABB

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

__doserrno.LIBCMT ref: 000001F779F37AB3

Part of subcall function 000001F779F31CA8: _getptd_noexit.LIBCMT ref: 000001F779F31CAC

__lock_fhandle.LIBCMT ref: 000001F779F37AFF
_lseek_nolock.LIBCMT ref: 000001F779F37B18
_unlock_fhandle.LIBCMT ref: 000001F779F37B39

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction ID: 0afd916cc824c0d8def878f74f42bc3b80b37123eef5b76ad2b8c1b9e8de33da
Opcode Fuzzy Hash: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction Fuzzy Hash: 8221B03162E6824FF319BB68988A3FD76F0EB83331F150379E457872E7D66C580142A2

Function 000001F779ED621C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ED624E

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

__doserrno.LIBCMT ref: 000001F779ED6245

Part of subcall function 000001F779ED10A8: _getptd_noexit.LIBCMT ref: 000001F779ED10AC

__doserrno.LIBCMT ref: 000001F779ED62AB
_errno.LIBCMT ref: 000001F779ED62B2
_invalid_parameter_noinfo.LIBCMT ref: 000001F779ED6316

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction ID: d40b60a9c0878ae07d65634f4c6e266369b76420d13636cc05e51e98462b5b01
Opcode Fuzzy Hash: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction Fuzzy Hash: F831C53332AA4686E716BF7598C93FD3570AB81BA0F5D4335A913173D3C6B8C8618710

Function 000001F779EDF150 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F779EDF176
_errno.LIBCMT ref: 000001F779EDF16B

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction ID: d282c60dd35e2870ef1fc9e84ba0890450ab5e40d5ebdd3904c68f68b2fbfb37
Opcode Fuzzy Hash: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction Fuzzy Hash: 6541477763A25381FB20FB21848A3FD32F0E75AB94FD84731DA56036C9D7A4C9618700

Function 000001F779F36434 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F3645F

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

__doserrno.LIBCMT ref: 000001F779F36457

Part of subcall function 000001F779F31CA8: _getptd_noexit.LIBCMT ref: 000001F779F31CAC

__lock_fhandle.LIBCMT ref: 000001F779F364A3
_unlock_fhandle.LIBCMT ref: 000001F779F364DD

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction ID: d4027b670454e0aa8a5e9bace2846f08d64471c151af4e7faef6335127ba3deb
Opcode Fuzzy Hash: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction Fuzzy Hash: 2821BA31A2EA824EF355BB58D88B3FD76E0EB46321F260779E017872D3D66C580142A5

Function 000001F779F35C58 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F35C79

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

__doserrno.LIBCMT ref: 000001F779F35C71

Part of subcall function 000001F779F31CA8: _getptd_noexit.LIBCMT ref: 000001F779F31CAC

__lock_fhandle.LIBCMT ref: 000001F779F35CBD
_close_nolock.LIBCMT ref: 000001F779F35CD0
_unlock_fhandle.LIBCMT ref: 000001F779F35CE9

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction ID: 437aa54eaccd96dd7923ecdbee6bde5bbe3354de83dd8672ce899e48bf36fff5
Opcode Fuzzy Hash: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction Fuzzy Hash: B221C03162FA824EF315BB7598893F87AB0EB82361F250778E41B872E3C67C88004761

Function 000001F779ED6E90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ED6EBB

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

__doserrno.LIBCMT ref: 000001F779ED6EB3

Part of subcall function 000001F779ED10A8: _getptd_noexit.LIBCMT ref: 000001F779ED10AC

__lock_fhandle.LIBCMT ref: 000001F779ED6EFF
_lseek_nolock.LIBCMT ref: 000001F779ED6F18

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction ID: a893dc0c200aab1ba794da148cce3b5a3de53ddf1af75cd91ae60a707e80626d
Opcode Fuzzy Hash: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction Fuzzy Hash: 1621BE3372AE8245F715BF6598C93FD7570B780BA1F4D4335AA17072D2CBB888618754

Function 000001F779ED7008 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ED7033

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

__doserrno.LIBCMT ref: 000001F779ED702B

Part of subcall function 000001F779ED10A8: _getptd_noexit.LIBCMT ref: 000001F779ED10AC

__lock_fhandle.LIBCMT ref: 000001F779ED7077
_lseeki64_nolock.LIBCMT ref: 000001F779ED7090

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction ID: c20de6d68448eb0164698a6a9737d3dd19ecf87b958390492456c83e911ca499
Opcode Fuzzy Hash: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction Fuzzy Hash: 7A21F27332A24285FB057F2598893FD7930A780BB1F0D4335AA37073D2C7B988A183A0

Function 000001F779F2FF6C Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001F779F2FF9A

Part of subcall function 000001F779F2F244: RtlFreeHeap.NTDLL ref: 000001F779F2F25A
Part of subcall function 000001F779F2F244: _errno.LIBCMT ref: 000001F779F2F264

free.LIBCMT ref: 000001F779F2FFAF
free.LIBCMT ref: 000001F779F2FFD0
free.LIBCMT ref: 000001F779F2FFE5
free.LIBCMT ref: 000001F779F2FFF9
free.LIBCMT ref: 000001F779F30005
free.LIBCMT ref: 000001F779F30030
free.LIBCMT ref: 000001F779F30051
free.LIBCMT ref: 000001F779F3006A
free.LIBCMT ref: 000001F779F3009B

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: ec059df5096ccf5449d603666e7bd3a8fde359befae7094ddf7f838265169a64
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 1941833027AA8B8FFB95FB58D89ABF872F0F755315FA442799407C22E1CA6C8945C710

Function 000001F779ECF36C Relevance: 12.6, APIs: 10, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001F779ECF39A

Part of subcall function 000001F779ECE644: _errno.LIBCMT ref: 000001F779ECE664

free.LIBCMT ref: 000001F779ECF3AF
free.LIBCMT ref: 000001F779ECF3D0
free.LIBCMT ref: 000001F779ECF3E5
free.LIBCMT ref: 000001F779ECF3F9
free.LIBCMT ref: 000001F779ECF405
free.LIBCMT ref: 000001F779ECF430
free.LIBCMT ref: 000001F779ECF451
free.LIBCMT ref: 000001F779ECF46A
free.LIBCMT ref: 000001F779ECF49B

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction ID: dc1655c7b32e0efcb1385b29b6b57f7d8dc86809d09b4ecb58b74f046c106614
Opcode Fuzzy Hash: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction Fuzzy Hash: 8F31E83323BB4341FE94FB15E8EE3F43371AB56754F980736995B066D1EFA884948211

Function 000001F779F3FD50 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F779F3FD76
_errno.LIBCMT ref: 000001F779F3FD6B

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction ID: f7b63658b473907d7527812f767b52ec6942a2ce60fa01c29029c0c051d35e28
Opcode Fuzzy Hash: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction Fuzzy Hash: 4751B53053EA9B4AFF64BB19844E3F972F0EB58321FA4037AE457C72D6D62C88818741

Function 000001F779ED5834 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ED585F

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

__doserrno.LIBCMT ref: 000001F779ED5857

Part of subcall function 000001F779ED10A8: _getptd_noexit.LIBCMT ref: 000001F779ED10AC

__lock_fhandle.LIBCMT ref: 000001F779ED58A3

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction ID: 0afa040d5b81bc590cd18c9c4a221573215eaf43600e3315a4f763647323b1c0
Opcode Fuzzy Hash: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction Fuzzy Hash: 8721C23372E64245F7057F2598C93FD767067807A1F5D4335AA27072D6CAF888518750

Function 000001F779ED5058 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ED5079

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

__doserrno.LIBCMT ref: 000001F779ED5071

Part of subcall function 000001F779ED10A8: _getptd_noexit.LIBCMT ref: 000001F779ED10AC

__lock_fhandle.LIBCMT ref: 000001F779ED50BD
_close_nolock.LIBCMT ref: 000001F779ED50D0

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction ID: 665ec3dd0ca96aad9728653fa7d4e2814824fba2e96a5736859c6be47d5a5aca
Opcode Fuzzy Hash: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction Fuzzy Hash: E411B13362E68685F309BF359CC93FD7A70A782761F5D47359517072D6CAF488618390

Function 000001F779F1460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779F146A9

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

malloc.LIBCMT ref: 000001F779F146B3

Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F318
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F31D

malloc.LIBCMT ref: 000001F779F146BE
free.LIBCMT ref: 000001F779F1487E
free.LIBCMT ref: 000001F779F14886
free.LIBCMT ref: 000001F779F1488E

Part of subcall function 000001F779F154F0: malloc.LIBCMT ref: 000001F779F1553A
Part of subcall function 000001F779F154F0: malloc.LIBCMT ref: 000001F779F15545
Part of subcall function 000001F779F154F0: free.LIBCMT ref: 000001F779F1562C
Part of subcall function 000001F779F154F0: free.LIBCMT ref: 000001F779F15634

free.LIBCMT ref: 000001F779F1489A
free.LIBCMT ref: 000001F779F148A7
free.LIBCMT ref: 000001F779F148B4

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction ID: f5fa26ab907f988d0fa25bf4ab84411eb5add3c2a1ddc9e52635e49ad522547c
Opcode Fuzzy Hash: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction Fuzzy Hash: 2991B73037DB8A8BE759BA6C94557F973E1EBC5750F50076ED48BC32C6EE20980286C6

Function 000001F779EB3A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779EB3AA9

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

malloc.LIBCMT ref: 000001F779EB3AB3

Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE718
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE71D

malloc.LIBCMT ref: 000001F779EB3ABE
free.LIBCMT ref: 000001F779EB3C7E
free.LIBCMT ref: 000001F779EB3C86
free.LIBCMT ref: 000001F779EB3C8E

Part of subcall function 000001F779EB48F0: malloc.LIBCMT ref: 000001F779EB493A
Part of subcall function 000001F779EB48F0: malloc.LIBCMT ref: 000001F779EB4945
Part of subcall function 000001F779EB48F0: free.LIBCMT ref: 000001F779EB4A2C
Part of subcall function 000001F779EB48F0: free.LIBCMT ref: 000001F779EB4A34

free.LIBCMT ref: 000001F779EB3C9A
free.LIBCMT ref: 000001F779EB3CA7
free.LIBCMT ref: 000001F779EB3CB4

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction ID: 6fa764ada6ad7e9c01a636ff8feb1044ea14bb82f83db5d3ccbee52016b36f13
Opcode Fuzzy Hash: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction Fuzzy Hash: 8771F73332B78646EA20BB6694C9BFA77A1B786BC4F4453359D4707BC6DA78C805CB10

Function 000001F779F2FE10 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F2FE36

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779F2FE42
__crtIsPackagedApp.LIBCMT ref: 000001F779F2FE53
_dosmaperr.LIBCMT ref: 000001F779F2FE9D

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction ID: 0b9e83d4f1bbf405db5fd66a2c1755e9da741de7662a2a536445767146f1432f
Opcode Fuzzy Hash: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction Fuzzy Hash: DC318130639E4A4FEB55BB69984A3F976E1FB88320F14436DA44BC72D2D738C8418742

Function 000001F779F3A73C Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F3A755

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

__lock_fhandle.LIBCMT ref: 000001F779F3A79D
__doserrno.LIBCMT ref: 000001F779F3A7D2
_errno.LIBCMT ref: 000001F779F3A7D9
_unlock_fhandle.LIBCMT ref: 000001F779F3A7E9

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction ID: 52241821ed4144ceec4c653f67fe851fa629587eaa5033c62627545847789b4e
Opcode Fuzzy Hash: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction Fuzzy Hash: 8221B03062FA824EF759BB6A98D93FD76B0EB46310F55033CE527872D2D66C98418391

Function 000001F779ECF210 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ECF236

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779ECF242
__crtIsPackagedApp.LIBCMT ref: 000001F779ECF253
_dosmaperr.LIBCMT ref: 000001F779ECF29D

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction ID: 693051a47a6496bbb0287940fd19843b1c5ea1dd2e21d092d83e0646ce2fa22d
Opcode Fuzzy Hash: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction Fuzzy Hash: 6A31A73732AB4282FB14FB6594993BD76F1AB8AB94F5847349D46437D5DFB8C4508300

Function 000001F779EDEFD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001F779EDF004

Part of subcall function 000001F779ED0A00: _getptd.LIBCMT ref: 000001F779ED0A16
Part of subcall function 000001F779ED0A00: __updatetlocinfo.LIBCMT ref: 000001F779ED0A4B
Part of subcall function 000001F779ED0A00: __updatetmbcinfo.LIBCMT ref: 000001F779ED0A72

_errno.LIBCMT ref: 000001F779EDF01F
_invalid_parameter_noinfo.LIBCMT ref: 000001F779EDF02A

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction ID: b30f2b8309985fa17d32f8cbef9799088b96f9da17b5e24a04e30e3c75b0da78
Opcode Fuzzy Hash: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction Fuzzy Hash: 02318D73229785C5E620EB1194897BDB6B4F744BE0F1C8631AE5607BC9CBB4C8618740

Function 000001F779F30B10 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F30B4C

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779F30B57
memcpy_s.LIBCMT ref: 000001F779F30C1C
_fileno.LIBCMT ref: 000001F779F30C87
_filbuf.LIBCMT ref: 000001F779F30CB5
_errno.LIBCMT ref: 000001F779F30D05

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: 4574d791d6732ef03a6e3264647adf226e967a9f32ad2672f28dab4dba93fc38
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: 2D61A23023DF4B4AE76C662C545E2B972F1E795760F28033FE457C32D6DE68A85242C1

Function 000001F779ECFF10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ECFF4C

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779ECFF57
memcpy_s.LIBCMT ref: 000001F779ED001C
_fileno.LIBCMT ref: 000001F779ED0087
_filbuf.LIBCMT ref: 000001F779ED00B5
_errno.LIBCMT ref: 000001F779ED0105

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction ID: d1b325c88172bf2294457bf574be24016217fe56a55dd1de05d0f44c1998ef3b
Opcode Fuzzy Hash: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction Fuzzy Hash: 37512A3332E34192F614AA2654897F975B0B346BF4F1C4B31AE7B43BD5C7B4C4A18240

Function 000001F779F3FBD0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 000001F779F31600: _getptd.LIBCMT ref: 000001F779F31616
Part of subcall function 000001F779F31600: __updatetlocinfo.LIBCMT ref: 000001F779F3164B
Part of subcall function 000001F779F31600: __updatetmbcinfo.LIBCMT ref: 000001F779F31672

_errno.LIBCMT ref: 000001F779F3FC1F
_invalid_parameter_noinfo.LIBCMT ref: 000001F779F3FC2A

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: __updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808835054-0
Opcode ID: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction ID: fa66be01cf519f28f76108e1b9e1531c5688d974ef63b679960f13d588ea2c5d
Opcode Fuzzy Hash: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction Fuzzy Hash: A231923062DA8A4FEB54EF2890897B976E0FB58350F5403BDA84AC72D2CB74DD408781

Function 000001F779F30620 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F30577

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779F30582
_getstream.LIBCMT ref: 000001F779F305A2
_errno.LIBCMT ref: 000001F779F305B4
_errno.LIBCMT ref: 000001F779F305C6
_openfile.LIBCMT ref: 000001F779F305F4

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction ID: 977f9b54bb0e500fd2f3ae3f1134815b4728f19ae08e3c0f1b058b88676223d0
Opcode Fuzzy Hash: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction Fuzzy Hash: 4221607062DA8B8FF794FB2854093FE76F1EB99310F19067AA44AC32D2DA68CC414391

Function 000001F779ECFA20 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ECF977

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779ECF982
_getstream.LIBCMT ref: 000001F779ECF9A2
_errno.LIBCMT ref: 000001F779ECF9B4
_errno.LIBCMT ref: 000001F779ECF9C6
_openfile.LIBCMT ref: 000001F779ECF9F4

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction ID: 8efcd128a5c9ffd79c678b614681d8db6fa57b4feea3770b66d01dce4be4fcfa
Opcode Fuzzy Hash: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction Fuzzy Hash: 7521A43322E78351FB11BB61985A3BEB6B067467C0F484A31998A87BD6DBBCC4508700

Function 000001F779ED9B3C Relevance: 9.1, APIs: 6, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ED9B55

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

__lock_fhandle.LIBCMT ref: 000001F779ED9B9D
__doserrno.LIBCMT ref: 000001F779ED9BD2
_errno.LIBCMT ref: 000001F779ED9BD9

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2102446242-0
Opcode ID: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction ID: 80a3cfd89a933673fa9a69965ac0dd0c8032d2a83e29a4e528e6d1e56e091536
Opcode Fuzzy Hash: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction Fuzzy Hash: C6218E3332B68345F715BF659CC93FD76749781760F0E43389A17072D2DAE888A18318

Function 000001F779ECE3EC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779ECE40F

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

malloc.LIBCMT ref: 000001F779ECE41D

Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE718
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE71D

malloc.LIBCMT ref: 000001F779ECE43F
_snprintf.LIBCMT ref: 000001F779ECE45A

Part of subcall function 000001F779ECEA3C: _errno.LIBCMT ref: 000001F779ECEA73
Part of subcall function 000001F779ECEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ECEA7E

malloc.LIBCMT ref: 000001F779ECE475

Strings

dpoolWait, xrefs: 000001F779ECE444

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID: dpoolWait
API String ID: 2026495703-1875951006
Opcode ID: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction ID: 1c8b2f55de450e38b2253b2039bd759f967cefca681c551ba7963c4be563b77d
Opcode Fuzzy Hash: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction Fuzzy Hash: F7010C7272579141EA14EB12B4487A977A9F399FD0F05432DEF9A437C5CE78C8018780

Function 000001F779F231F4 Relevance: 9.0, APIs: 7, Instructions: 264stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000001F779F2322E
strchr.LIBCMT ref: 000001F779F2324C
malloc.LIBCMT ref: 000001F779F23264
malloc.LIBCMT ref: 000001F779F23271
rand.LIBCMT ref: 000001F779F2333D
free.LIBCMT ref: 000001F779F2345B
free.LIBCMT ref: 000001F779F23463

Part of subcall function 000001F779F2F244: RtlFreeHeap.NTDLL ref: 000001F779F2F25A
Part of subcall function 000001F779F2F244: _errno.LIBCMT ref: 000001F779F2F264

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$FreeHeap_errnorand
String ID:
API String ID: 3504763109-0
Opcode ID: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction ID: 1896979acaac44b27db7e5f1a7a54376faf80a01b397810bf5e6b71c56090331
Opcode Fuzzy Hash: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction Fuzzy Hash: B481C77063DEDA4BEB56BB2C98063F9B3E0FF99705F040279D58AC71D2DA2489468741

Function 000001F779EC25F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000001F779EC262E
strchr.LIBCMT ref: 000001F779EC264C
malloc.LIBCMT ref: 000001F779EC2664
malloc.LIBCMT ref: 000001F779EC2671
rand.LIBCMT ref: 000001F779EC273D
free.LIBCMT ref: 000001F779EC285B
free.LIBCMT ref: 000001F779EC2863

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction ID: b16d9403b4a6f432c09cce6db21c50e1d1cbd23e44f16126dd79803544574a9e
Opcode Fuzzy Hash: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction Fuzzy Hash: 1971077362EBC541FA25AB29A0593FA77B0EF96B84F085334DBC6177D2DE68C5428700

Function 000001F779F14170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779F141BD

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

malloc.LIBCMT ref: 000001F779F141C8

Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F318
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F31D

free.LIBCMT ref: 000001F779F142AF
free.LIBCMT ref: 000001F779F142B7
free.LIBCMT ref: 000001F779F142BF
free.LIBCMT ref: 000001F779F142CB
free.LIBCMT ref: 000001F779F142D8

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction ID: b75d579ca4a6924b63a5638e8b6035e6dc5321dd79a2b33d1ed8e112de88a4fd
Opcode Fuzzy Hash: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction Fuzzy Hash: 3351943462DE8B8BE759BB2894597F973E0FB89304F50067DD84BC32C7EA60D84286C5

Function 000001F779EB3570 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779EB35BD

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

malloc.LIBCMT ref: 000001F779EB35C8

Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE718
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE71D

free.LIBCMT ref: 000001F779EB36AF
free.LIBCMT ref: 000001F779EB36B7
free.LIBCMT ref: 000001F779EB36BF
free.LIBCMT ref: 000001F779EB36CB
free.LIBCMT ref: 000001F779EB36D8

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction ID: e64d9e361b792541efefc60db8dee3a2cb4ea113255afac8840f57e5f4e1ffa0
Opcode Fuzzy Hash: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction Fuzzy Hash: 7141E13332A79297EA58EB22959A7B93770B70AB80F440735DE4747B85EFB4D816C300

Function 000001F779ECB630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 000001F779ECB654

Part of subcall function 000001F779ECF84C: _getptd.LIBCMT ref: 000001F779ECF854

malloc.LIBCMT ref: 000001F779ECB69C
strtok.LIBCMT ref: 000001F779ECB700
strtok.LIBCMT ref: 000001F779ECB711

Strings

eThreadpoolTimer, xrefs: 000001F779ECB6DA

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: strtok$_getptd_time64malloc
String ID: eThreadpoolTimer
API String ID: 1522986614-2707337283
Opcode ID: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction ID: 0357531e0f489e902b0b1998063d992bf6dade1131fc4dc42d1f7ffd43f3759d
Opcode Fuzzy Hash: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction Fuzzy Hash: 5B21A0B3626B9581EB00EF12E0DC6A937B8F795B94F1A4329EE9B437C1CA74C451C780

Function 000001F779EBBE74 Relevance: 7.8, APIs: 6, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001F779EC53EC: malloc.LIBCMT ref: 000001F779EC5408

malloc.LIBCMT ref: 000001F779EBBF3B

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

Part of subcall function 000001F779ECB630: _time64.LIBCMT ref: 000001F779ECB654
Part of subcall function 000001F779ECB630: malloc.LIBCMT ref: 000001F779ECB69C
Part of subcall function 000001F779ECB630: strtok.LIBCMT ref: 000001F779ECB700
Part of subcall function 000001F779ECB630: strtok.LIBCMT ref: 000001F779ECB711

Part of subcall function 000001F779EC28A0: _time64.LIBCMT ref: 000001F779EC28AE

Part of subcall function 000001F779ECDEA8: malloc.LIBCMT ref: 000001F779ECDEF8

Part of subcall function 000001F779ECDEA8: realloc.LIBCMT ref: 000001F779ECDF07

malloc.LIBCMT ref: 000001F779EBC04A
_snprintf.LIBCMT ref: 000001F779EBC0C1
_snprintf.LIBCMT ref: 000001F779EBC0E7
_snprintf.LIBCMT ref: 000001F779EBC10E
free.LIBCMT ref: 000001F779EBC2C6

Part of subcall function 000001F779ECA144: malloc.LIBCMT ref: 000001F779ECA178
Part of subcall function 000001F779ECA144: free.LIBCMT ref: 000001F779ECA32F

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freestrtok$_callnewhrealloc
String ID:
API String ID: 1314452303-0
Opcode ID: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction ID: d4f5d3474e232213faa74f932009e097786be55a8b4e06659295b2d7d07f7817
Opcode Fuzzy Hash: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction Fuzzy Hash: A0C15A3362A78246FA14FB6594DDBF933B1AB87780F404739A987577C6DEB8C8468700

Function 000001F779F21694 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000001F779F25FEC: malloc.LIBCMT ref: 000001F779F26008

Part of subcall function 000001F779F30620: _errno.LIBCMT ref: 000001F779F30577
Part of subcall function 000001F779F30620: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F30582

fseek.LIBCMT ref: 000001F779F21730

Part of subcall function 000001F779F30EA4: _errno.LIBCMT ref: 000001F779F30ECC
Part of subcall function 000001F779F30EA4: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F30ED7

_ftelli64.LIBCMT ref: 000001F779F21738

Part of subcall function 000001F779F30F18: _errno.LIBCMT ref: 000001F779F30F36
Part of subcall function 000001F779F30F18: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F30F41

fseek.LIBCMT ref: 000001F779F21748

Part of subcall function 000001F779F30EA4: _fseek_nolock.LIBCMT ref: 000001F779F30EF5

malloc.LIBCMT ref: 000001F779F21788

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

fclose.LIBCMT ref: 000001F779F21845

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction ID: 9f74202f165d2e9f3576e5d803967fad67206ce44c8035595b0659e965d9d082
Opcode Fuzzy Hash: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction Fuzzy Hash: 2951613162DA894BE749FB28949A7FD72E1EB98310F50477EE44BC32D7DE24990286C1

Function 000001F779F3A348 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001F779F3A375

Part of subcall function 000001F779F33E58: _FF_MSGBANNER.LIBCMT ref: 000001F779F33E75
Part of subcall function 000001F779F33E58: _NMSG_WRITE.LIBCMT ref: 000001F779F33E7F

_lock.LIBCMT ref: 000001F779F3A388
_lock.LIBCMT ref: 000001F779F3A3E3
_calloc_crt.LIBCMT ref: 000001F779F3A49A

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction ID: b2b1c34f87a8d0e0342d874ddb994a8b4a3c91fc8667973e65566ab364dfe22e
Opcode Fuzzy Hash: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction Fuzzy Hash: A351E57012EA8A8BE754AF19C8893B5B7E0FB54310F51436DD88BC72E2D678D8428782

Function 000001F779F154F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779F1553A

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

malloc.LIBCMT ref: 000001F779F15545

Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F318
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F31D

free.LIBCMT ref: 000001F779F1562C
free.LIBCMT ref: 000001F779F15634
free.LIBCMT ref: 000001F779F15640
free.LIBCMT ref: 000001F779F1564D

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction ID: 792757db34fff514994725d11eaa56b2cbc0d3be438a810b16274010e7631776
Opcode Fuzzy Hash: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction Fuzzy Hash: E441C63027DB8E4BE759AA2C484A3BA76E5E796354F54463DD887C32C3EE20D80647C1

Function 000001F779F3239C Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001F779F323B9

Part of subcall function 000001F779F35A54: _errno.LIBCMT ref: 000001F779F35A5D
Part of subcall function 000001F779F35A54: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F35A68

_errno.LIBCMT ref: 000001F779F323C9

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

_errno.LIBCMT ref: 000001F779F323E5
_isatty.LIBCMT ref: 000001F779F32446
_getbuf.LIBCMT ref: 000001F779F32452

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction ID: 80bbc6138dcb3ec9960a8057544116902cf8d731c9b348fd8ff81baa05ab1c7e
Opcode Fuzzy Hash: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction Fuzzy Hash: 5A518030129A8A4FEB98FF18C8897F576E0FB45310F640769D85ACB2DBD678D8818781

Function 000001F779F29220 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779F2924F

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

_snprintf.LIBCMT ref: 000001F779F29267

Part of subcall function 000001F779F2F63C: _errno.LIBCMT ref: 000001F779F2F673
Part of subcall function 000001F779F2F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F2F67E

free.LIBCMT ref: 000001F779F2927E

Part of subcall function 000001F779F2F244: RtlFreeHeap.NTDLL ref: 000001F779F2F25A
Part of subcall function 000001F779F2F244: _errno.LIBCMT ref: 000001F779F2F264

malloc.LIBCMT ref: 000001F779F292CE
_snprintf.LIBCMT ref: 000001F779F292E6
free.LIBCMT ref: 000001F779F2930E

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction ID: 89362a408e7b3b1a648b35e5912bd47ef3d307a551d11106b3362d27f5133f0c
Opcode Fuzzy Hash: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction Fuzzy Hash: 0241733072DA890FE798BB6C651A7F877E2E789310F5446ADD08FC32D6DE249C428785

Function 000001F779EC0A94 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 000001F779EC53EC: malloc.LIBCMT ref: 000001F779EC5408

Part of subcall function 000001F779ECFA20: _errno.LIBCMT ref: 000001F779ECF977
Part of subcall function 000001F779ECFA20: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ECF982

fseek.LIBCMT ref: 000001F779EC0B30

Part of subcall function 000001F779ED02A4: _errno.LIBCMT ref: 000001F779ED02CC
Part of subcall function 000001F779ED02A4: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ED02D7

_ftelli64.LIBCMT ref: 000001F779EC0B38

Part of subcall function 000001F779ED0318: _errno.LIBCMT ref: 000001F779ED0336
Part of subcall function 000001F779ED0318: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ED0341

fseek.LIBCMT ref: 000001F779EC0B48

Part of subcall function 000001F779ED02A4: _fseek_nolock.LIBCMT ref: 000001F779ED02F5

malloc.LIBCMT ref: 000001F779EC0B88

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

Part of subcall function 000001F779EBC444: malloc.LIBCMT ref: 000001F779EBC457

fclose.LIBCMT ref: 000001F779EC0C45

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 1756087678-0
Opcode ID: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction ID: 20cb453c551266fef61bb4aea1e6b43f7fd21c6dd070c7bac9cd7e5fec56d2ef
Opcode Fuzzy Hash: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction Fuzzy Hash: 09416D3332E64182EA10FB1294997F97271B78ABD0F908335AE9B57BD6DEB8C5458700

Function 000001F779ECFA2C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ECFA64

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779ECFA6F
_flush.LIBCMT ref: 000001F779ECFB21
_fileno.LIBCMT ref: 000001F779ECFB42
_flsbuf.LIBCMT ref: 000001F779ECFB85

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction ID: e17862d91ef6ba3f30f94b5143b4c4ea3d25a103d2a590b03d3000644aaab249
Opcode Fuzzy Hash: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction Fuzzy Hash: 3B41EB3332A74246FA68AA2255EA3FDB5B1B746FD0F184B309E97477D1D7B4C4558200

Function 000001F779EB48F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779EB493A

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

malloc.LIBCMT ref: 000001F779EB4945

Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE718
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE71D

free.LIBCMT ref: 000001F779EB4A2C
free.LIBCMT ref: 000001F779EB4A34
free.LIBCMT ref: 000001F779EB4A40
free.LIBCMT ref: 000001F779EB4A4D

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction ID: 16a28c51fbaa5d8aefdaefb1d59e2b77e4413e969ec263e0bd6c02c0dd656265
Opcode Fuzzy Hash: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction Fuzzy Hash: D741C33323A78642EA15EB2654C8BB976B5B756B88F494334DD57877C1FE78C806C304

Function 000001F779F1FC64 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779F1FC85

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

free.LIBCMT ref: 000001F779F1FCC0
fwrite.LIBCMT ref: 000001F779F1FD01
fclose.LIBCMT ref: 000001F779F1FD09
free.LIBCMT ref: 000001F779F1FD16

Part of subcall function 000001F779F2F244: RtlFreeHeap.NTDLL ref: 000001F779F2F25A
Part of subcall function 000001F779F2F244: _errno.LIBCMT ref: 000001F779F2F264

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$free$FreeHeap_callnewhfclosefwritemalloc
String ID:
API String ID: 415550720-0
Opcode ID: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction ID: a7c3b081b518a869c02ccb123ac62cd083ecfaffbb30b9d354ee5788a8e5df79
Opcode Fuzzy Hash: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction Fuzzy Hash: 04214F3063DE8A4BE794F728845A3FEB2E1FB98340F54067EA54BC32C6ED24D9018781

Function 000001F779EC8620 Relevance: 7.6, APIs: 6, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779EC864F

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

_snprintf.LIBCMT ref: 000001F779EC8667

Part of subcall function 000001F779ECEA3C: _errno.LIBCMT ref: 000001F779ECEA73
Part of subcall function 000001F779ECEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ECEA7E

free.LIBCMT ref: 000001F779EC867E

Part of subcall function 000001F779ECE644: _errno.LIBCMT ref: 000001F779ECE664

malloc.LIBCMT ref: 000001F779EC86CE
_snprintf.LIBCMT ref: 000001F779EC86E6
free.LIBCMT ref: 000001F779EC870E

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction ID: b829f6f63afc1d5b951b1eb25fe6c7cf1f9795a40dd9f3bb8c7feed39ad5eae6
Opcode Fuzzy Hash: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction Fuzzy Hash: 8D31A03322938245F615FB6269983F97B716346FD0F484271DEE7077D6DAB8C4929300

Function 000001F779EBF064 Relevance: 7.6, APIs: 5, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779EBF085

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

free.LIBCMT ref: 000001F779EBF0C0
fwrite.LIBCMT ref: 000001F779EBF101
fclose.LIBCMT ref: 000001F779EBF109
free.LIBCMT ref: 000001F779EBF116

Part of subcall function 000001F779ECE644: _errno.LIBCMT ref: 000001F779ECE664

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction ID: ef725ea30366da0a8d1436f4d55665bcdfbdd35326e40c1cb1b3dca04dd929c7
Opcode Fuzzy Hash: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction Fuzzy Hash: E711637332E74241EA10F612A09A3FE73A1A786BD4F444735AE9B4B7CADEACC5058740

Function 000001F779F3A5EC Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F3A5FD

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

__doserrno.LIBCMT ref: 000001F779F3A5F5

Part of subcall function 000001F779F31CA8: _getptd_noexit.LIBCMT ref: 000001F779F31CAC

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: e7de4fc6c9294c0c14a743bb955237a72a1e981294b135f5754489675467b530
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: FA016D3063F98A4EF759F765C8593F832B0BB12329FA48374A0078B1E2E66C84418712

Function 000001F779ED99EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ED99FD

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

__doserrno.LIBCMT ref: 000001F779ED99F5

Part of subcall function 000001F779ED10A8: _getptd_noexit.LIBCMT ref: 000001F779ED10AC

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction ID: 8ab898882524005ddfb072e185227be9a9e801e8ec9a6deea6242864876ff12f
Opcode Fuzzy Hash: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction Fuzzy Hash: 7401697773BA4684FA09BB64C8C93FC76719B91B22F998321D52B073D2C6A848618210

Function 000001F779F1EC04 Relevance: 6.5, APIs: 5, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001F779F1ECD3
_snprintf.LIBCMT ref: 000001F779F1ECFE
_snprintf.LIBCMT ref: 000001F779F1ED1A
_snprintf.LIBCMT ref: 000001F779F1EDCF
_snprintf.LIBCMT ref: 000001F779F1EDE6

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 48f7a22de75de9267d3acc920f5145dd3742a306c4582344b2be8aaa5cdf9e9d
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: 66917F3162CA898FEB54FF18D889BEAB7F5FB95304F100679A447C31D2DA38D9458B81

Function 000001F779EBE004 Relevance: 6.4, APIs: 5, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001F779EBE0D3
_snprintf.LIBCMT ref: 000001F779EBE0FE
_snprintf.LIBCMT ref: 000001F779EBE11A
_snprintf.LIBCMT ref: 000001F779EBE1CF
_snprintf.LIBCMT ref: 000001F779EBE1E6

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 7e176fb8a18dfb9a1b6c184ae24d35d2badbfde6d55717fe72de19e9944bc0fe
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: 6F81393322AB8695EB50EB61D8887E933B1F78A784F840736DA8B137D5DBB8C545C740

Function 000001F779F2EFEC Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779F2F00F

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

malloc.LIBCMT ref: 000001F779F2F01D

Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F318
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F31D

malloc.LIBCMT ref: 000001F779F2F03F
_snprintf.LIBCMT ref: 000001F779F2F05A

Part of subcall function 000001F779F2F63C: _errno.LIBCMT ref: 000001F779F2F673
Part of subcall function 000001F779F2F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001F779F2F67E

malloc.LIBCMT ref: 000001F779F2F075

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction ID: 085339021d45c99f398b05a82b28537d84716798e5fea0c3cb8129aa731c236f
Opcode Fuzzy Hash: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction Fuzzy Hash: DF11513063DF454FE7A8EB6CA44A3A976E1E78D710F50466EE09AC33D6EA349C4147C1

Function 000001F779F3062C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F30664

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779F3066F
_flush.LIBCMT ref: 000001F779F30721
_fileno.LIBCMT ref: 000001F779F30742

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction ID: ec63e5f07001d7db4f92a4415e7b11e2ad77d538ac96513ca95ed80da7df8b89
Opcode Fuzzy Hash: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction Fuzzy Hash: B351F83022EF4E4BE668796D544E3B571F0E798710F28437FA49BC31E6EA64DC524581

Function 000001F779ECB3C0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: 41d0ab08498dfc1bfedf1e850a0edf6d095f6aa2c87e5f851c3d9d5827f86836
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: 29617D3322B70286E754AB15A5CD3F833B2A359B55F68473AD98B473E1EBB4C481CB40

Function 000001F779F110D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001F779F11117
clock.LIBCMT ref: 000001F779F11124
clock.LIBCMT ref: 000001F779F1112D
clock.LIBCMT ref: 000001F779F1113A

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: 3d03d75800f394110497975bc62e8b696a41ad38d3f334e2e7429c1a9c8b87a4
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 5221293165DB8A4FE768FDA894467B6F2E4DB45350F15073DE88793182E9518C4282D1

Function 000001F779EB04D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001F779EB0517
clock.LIBCMT ref: 000001F779EB0524
clock.LIBCMT ref: 000001F779EB052D
clock.LIBCMT ref: 000001F779EB053A

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: d34f39d85eb81d6635b94f15f268ffbba63a7954f419298b620c06473c13beed
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 68110A3311A74689F774BEA664C4EBBB6B0B745390F195335EE4603AC9E9B4D881C740

Function 000001F779EDE9D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001F779EDE9FC

Part of subcall function 000001F779ED0A00: _getptd.LIBCMT ref: 000001F779ED0A16
Part of subcall function 000001F779ED0A00: __updatetlocinfo.LIBCMT ref: 000001F779ED0A4B
Part of subcall function 000001F779ED0A00: __updatetmbcinfo.LIBCMT ref: 000001F779ED0A72

_errno.LIBCMT ref: 000001F779EDEA08

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779EDEA13
strchr.LIBCMT ref: 000001F779EDEA29

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction ID: 3afc1a591ce5dce0b22c5db812772494b23bfe0c0af7f749e5b4be28e27ceb59
Opcode Fuzzy Hash: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction Fuzzy Hash: F721233322E2A340FB68B61190DC3BDB6B0F340BD5F1C4339EA970AAD5D9A8C5618710

Function 000001F779EC13B0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779EC13D2

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

_snprintf.LIBCMT ref: 000001F779EC13F1

Part of subcall function 000001F779ECEA3C: _errno.LIBCMT ref: 000001F779ECEA73
Part of subcall function 000001F779ECEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001F779ECEA7E

remove.LIBCMT ref: 000001F779EC13FD
remove.LIBCMT ref: 000001F779EC1404

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID:
API String ID: 2566950902-0
Opcode ID: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction ID: 79260dd297f245983f8fdcbab5621be18b6d87bf0f6e81e06398b4063211d6fe
Opcode Fuzzy Hash: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction Fuzzy Hash: 0FF0623222A78189E210FB12B8452FEB270E785BC0F5C4234BF8A17BD6CEB8C8514744

Function 000001F779F2F860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779F2F8B1

Part of subcall function 000001F779F31D18: _getptd_noexit.LIBCMT ref: 000001F779F31D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779F2F8BC

Strings

B, xrefs: 000001F779F2F8E8

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: 2f45ed078b0e31be875905046de7830fe8bd989d78d65dd57d75b4619e035240
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: B9116030628B494FD754EF58944A7E9B6E1FB98324F6047AEA41AC32E1CB78C944C782

Function 000001F779ECEC60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001F779ECECB1

Part of subcall function 000001F779ED1118: _getptd_noexit.LIBCMT ref: 000001F779ED111C

_invalid_parameter_noinfo.LIBCMT ref: 000001F779ECECBC

Strings

B, xrefs: 000001F779ECECE8

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction ID: 93fa345a74ea72af124986b552f6ed0b4d4f3270ae712c503280b15cda80e32a
Opcode Fuzzy Hash: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction Fuzzy Hash: 54118E73629B8086EB14EB12D4847ADB660F799FE4F984324AB9907BD5CF78C540CB00

Function 000001F779EB10C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001F779EB116A

Part of subcall function 000001F779EDE208: _calloc_impl.LIBCMT ref: 000001F779EDE218
Part of subcall function 000001F779EDE208: _errno.LIBCMT ref: 000001F779EDE22B
Part of subcall function 000001F779EDE208: _errno.LIBCMT ref: 000001F779EDE235

free.LIBCMT ref: 000001F779EB12F3
free.LIBCMT ref: 000001F779EB12FD
free.LIBCMT ref: 000001F779EB130F

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction ID: c5d54adeb2452bef291d443adee47dba8a90a1181e0e141d66c8f0902b0d5485
Opcode Fuzzy Hash: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction Fuzzy Hash: 71C11B33219B858AE764DF55E8847AE77B4F389794F10422AEB8E43B98DF78C455CB00

Function 000001F779F2AD44 Relevance: 5.2, APIs: 4, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779F2AD78

Part of subcall function 000001F779F2F284: _FF_MSGBANNER.LIBCMT ref: 000001F779F2F2B4
Part of subcall function 000001F779F2F284: _NMSG_WRITE.LIBCMT ref: 000001F779F2F2BE
Part of subcall function 000001F779F2F284: _callnewh.LIBCMT ref: 000001F779F2F2F2
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F2FD
Part of subcall function 000001F779F2F284: _errno.LIBCMT ref: 000001F779F2F308

free.LIBCMT ref: 000001F779F2AEBF
free.LIBCMT ref: 000001F779F2AF23
free.LIBCMT ref: 000001F779F2AF2F

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction ID: ef9006bd5de01211f57c67a771453f988279d7a4f53a858fc56dc184392b7854
Opcode Fuzzy Hash: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction Fuzzy Hash: 2F61743023EA8A4BEB58FB2894597FD72F1EB94750F100B3DA447C35D7DA28D9028681

Function 000001F779F14300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779F14363

Memory Dump Source

Source File: 00000000.00000002.3531846820.000001F779F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F779F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779f10000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction ID: 8338847ac18c87555f11d3fdcea64212ce960f8535ad156b6bcd4fbdf49d96de
Opcode Fuzzy Hash: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction Fuzzy Hash: 2F51977026DA468BDB58FF2894892B973E1FBC5310F504A7DDC9BC32C6FA20DC528685

Function 000001F779ECA144 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779ECA178

Part of subcall function 000001F779ECE684: _FF_MSGBANNER.LIBCMT ref: 000001F779ECE6B4
Part of subcall function 000001F779ECE684: _NMSG_WRITE.LIBCMT ref: 000001F779ECE6BE
Part of subcall function 000001F779ECE684: _callnewh.LIBCMT ref: 000001F779ECE6F2
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE6FD
Part of subcall function 000001F779ECE684: _errno.LIBCMT ref: 000001F779ECE708

free.LIBCMT ref: 000001F779ECA2BF
free.LIBCMT ref: 000001F779ECA323
free.LIBCMT ref: 000001F779ECA32F

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction ID: 941b04443bb7491fa9833141403ba9a08b46625bd9a4fd34a29b20de848be9a5
Opcode Fuzzy Hash: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction Fuzzy Hash: BF51B43322A34751EA18BB2595E93FD73B2B782780F544B35AA8B577D6EEF9C4018700

Function 000001F779EB3700 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001F779EB3763

Memory Dump Source

Source File: 00000000.00000002.3531811192.000001F779EB0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F779EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f779eb0000_mode11_N1Fz.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction ID: a91001c40109258dbe117f00f0bca09c5ff3f4705c61c3133d2f0d6e85a76fb9
Opcode Fuzzy Hash: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction Fuzzy Hash: 3A41BF3362A78292EB54EA26A489ABD33B1F345B84F404735EE1B47BC5EF74D805C700

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mode11_N1Fz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
mode11_N1Fz.exe

Function 000001F779F1E68C Relevance: 9.3, APIs: 6, Instructions: 260
networkCOMMONLIBRARYCODE

Function 000001F779F25E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Function 000001F779F1CA74 Relevance: 7.9, APIs: 6, Instructions: 411
COMMONLIBRARYCODE

Function 000001F779F1F014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Function 000001F779F1EA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Function 000001F779EC96B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Function 000001F779EC9324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Function 00FCF220 Relevance: .1, Instructions: 57
COMMON

Function 00FCB5C0 Relevance: .0, Instructions: 2
COMMON