Edit tour

Windows Analysis Report
mode11_qLf2.exe

Overview

General Information

Sample name:	mode11_qLf2.exe
Analysis ID:	1583720
MD5:	434851e57e2ef7a2298111e7777ba2e3
SHA1:	777c10c935ec323e3397ce32bde2bd5d28143494
SHA256:	e1b6bd9876ca534e99b28403661e09b7a1ab7dac706df3962a0c975ba5b9e8ec
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Performs DNS queries to domains with low reputation

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

IP address seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

mode11_qLf2.exe (PID: 5784 cmdline: "C:\Users\user\Desktop\mode11_qLf2.exe" MD5: 434851E57E2EF7A2298111E7777BA2E3)

conhost.exe (PID: 2584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 8443, "SleepTime": 12000, "MaxGetSize": 1403642, "Jitter": 60, "C2Server": "632313373.xyz,/js/jquery-3.3.1.min.js", "HttpPostUri": "/post", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 4016 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": "Host: 632313373.xyz\r\n"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x32760:$a39: %s as %s\%s: %d 0x41be2:$a41: beacon.x64.dll 0x33970:$a46: %s (admin) 0x328d8:$a48: %s%s: %s 0x3278c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x327b8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x339d9:$a51: Content-Length: %d
00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1a4ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x1986e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30d60:$a39: %s as %s\%s: %d 0x401e2:$a41: beacon.x64.dll 0x31f70:$a46: %s (admin) 0x30ed8:$a48: %s%s: %s 0x30d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x30db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31fd9:$a51: Content-Length: %d
00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x7cd60:$a39: %s as %s\%s: %d 0xb2d60:$a39: %s as %s\%s: %d 0xf6d60:$a39: %s as %s\%s: %d 0xc21e2:$a41: beacon.x64.dll 0x1061e2:$a41: beacon.x64.dll 0x7df70:$a46: %s (admin) 0xb3f70:$a46: %s (admin) 0xf7f70:$a46: %s (admin) 0x7ced8:$a48: %s%s: %s 0xb2ed8:$a48: %s%s: %s 0xf6ed8:$a48: %s%s: %s 0x7cd8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x7cdb8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xb2d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xb2db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xf6d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xf6db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x7dfd9:$a51: Content-Length: %d 0xb3fd9:$a51: Content-Length: %d 0xf7fd9:$a51: Content-Length: %d
00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1ed3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x3ed3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x68d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x9ed3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0xe2d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1a96a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1bc9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x3a96a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x3bc9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x6496a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x65c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x9a96a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x9bc9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xde96a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xdfc9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1b8ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x3b8ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x658ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x9b8ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0xdf8ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x1ac6e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ... 0x3ac6e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ... 0x64c6e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ... 0x9ac6e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ... 0xdec6e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
Process Memory Space: mode11_qLf2.exe PID: 5784	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_qLf2.exe PID: 5784	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_qLf2.exe PID: 5784	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_qLf2.exe PID: 5784	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x13ef92:$a39: %s as %s\%s: %d 0x38df31:$a39: %s as %s\%s: %d 0x81cae4:$a39: %s as %s\%s: %d 0x142d4d:$a41: beacon.x64.dll 0x391ae0:$a41: beacon.x64.dll 0x820693:$a41: beacon.x64.dll 0x13f318:$a46: %s (admin) 0x13f397:$a46: %s (admin) 0x38e2b7:$a46: %s (admin) 0x38e336:$a46: %s (admin) 0x81ce6a:$a46: %s (admin) 0x81cee9:$a46: %s (admin) 0x13f0b0:$a48: %s%s: %s 0x38e04f:$a48: %s%s: %s 0x81cc02:$a48: %s%s: %s 0x13efac:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x13efd5:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x13f158:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x38df4b:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x38df74:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x38e0f7:$a50: %02d/%02d/%02d %02d:%02d:%02d
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.mode11_qLf2.exe.1c672010000.14.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.mode11_qLf2.exe.1c672010000.14.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.mode11_qLf2.exe.1c672010000.14.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.mode11_qLf2.exe.1c672010000.14.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_qLf2.exe.1c672010000.14.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1909b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30d60:$a39: %s as %s\%s: %d 0x401e2:$a41: beacon.x64.dll 0x31f70:$a46: %s (admin) 0x30ed8:$a48: %s%s: %s 0x30d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x30db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31fd9:$a51: Content-Length: %d
0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
Click to see the 8 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderrc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsjc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jszc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/Nc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/Vc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/bc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsZc-	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/fc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js.c9	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsnc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js32c	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsUI	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js~	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js&c1	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderRc%	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/m0	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsll	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsf	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jst	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsp	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsn	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/Rc%	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js2c	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/rc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsBc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsFc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder2c	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder:c	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsxI	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsVc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderbc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/jc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/Nc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/~	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jstUI	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/rc	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js&	Avira URL Cloud: Label: malware
Source: 632313373.xyz	Avira URL Cloud: Label: malware
Source: https://632313373.xyz/j	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 8443, "SleepTime": 12000, "MaxGetSize": 1403642, "Jitter": 60, "C2Server": "632313373.xyz,/js/jquery-3.3.1.min.js", "HttpPostUri": "/post", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 4016 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": "Host: 632313373.xyz\r\n"}

Multi AV Scanner detection for submitted file

Source: mode11_qLf2.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: mode11_qLf2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 632313373.xyz

Performs DNS queries to domains with low reputation

Source:

DNS query: 632313373.xyz

Source: global traffic

TCP traffic: 192.168.2.7:49707 -> 188.114.97.3:8443

Source: global traffic	TCP traffic: 192.168.2.7:52665 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:53927 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\mode11_qLf2.exe

Code function: 0_2_000001C67380E68C _snprintf,_snprintf,_snprintf,HttpOpenRequestA,InternetQueryDataAvailable,InternetReadFile,InternetCloseHandle,

0_2_000001C67380E68C

Source: global traffic

DNS traffic detected: DNS query: 632313373.xyz

Source: mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.go
Source: mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.go/gsr
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593305205.000001C66CB79000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628729027.000001C66CB80000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB71000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB80000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB77000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749639495.000001C66CB84000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB79000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB78000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB20000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610572895.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749617425.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/PCUeQViQlYc.crl0
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593305205.000001C66CB79000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628729027.000001C66CB80000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB71000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB80000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB77000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749639495.000001C66CB84000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB79000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB78000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB20000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610572895.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749617425.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt0
Source: mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt~B
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610572895.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749617425.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/lk00%
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz/
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz/j
Source: mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/Nc
Source: mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/Rc%
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/Vc
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/bc
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/fc
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/jc
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js&
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js&c1
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js.c9
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js2c
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/Nc
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/rc
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js32c
Source: mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsBc
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsFc
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsJc
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsUI
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsVc
Source: mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsZc-
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder2c
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder:c
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderRc%
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderbc
Source: mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderrc
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsf
Source: mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsjc
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsll
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsn
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsnc
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsp
Source: mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jst
Source: mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jstUI
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsxI
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jszc
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js~
Source: mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/m0
Source: mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/rc
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/~
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/what?indextype=1&__cfduid=
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB78000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB7D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB78000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841627605.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/what?indextype=1&__cfduid=qgDuYI0End8kMbmyyLed-IgG3nntO0SCTar0wwyvT24anHiYuYC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.mode11_qLf2.exe.1c672010000.14.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_qLf2.exe.1c672010000.14.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: Process Memory Space: mode11_qLf2.exe PID: 5784, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown

Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C672020334	0_2_000001C672020334
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C672030374	0_2_000001C672030374
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67203C397	0_2_000001C67203C397
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67203239C	0_2_000001C67203239C
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C672035914	0_2_000001C672035914
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C672031928	0_2_000001C672031928
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67201916C	0_2_000001C67201916C
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C672031264	0_2_000001C672031264
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67203AAB0	0_2_000001C67203AAB0
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C672026F38	0_2_000001C672026F38
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67203B7B0	0_2_000001C67203B7B0
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67203CFF0	0_2_000001C67203CFF0
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67202F5A8	0_2_000001C67202F5A8
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67203E600	0_2_000001C67203E600
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67201CE3C	0_2_000001C67201CE3C
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67203C680	0_2_000001C67203C680
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C672019680	0_2_000001C672019680
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67382DBF0	0_2_000001C67382DBF0
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C673817B38	0_2_000001C673817B38
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67382D280	0_2_000001C67382D280
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C6738201A8	0_2_000001C6738201A8
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C673822F9C	0_2_000001C673822F9C
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C673821E64	0_2_000001C673821E64
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C673822528	0_2_000001C673822528

Source: 0.2.mode11_qLf2.exe.1c672010000.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_qLf2.exe.1c672010000.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: Process Memory Space: mode11_qLf2.exe PID: 5784, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.winEXE@2/0@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2584:120:WilError_03

Source: mode11_qLf2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mode11_qLf2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mode11_qLf2.exe

ReversingLabs: Detection: 21%

Source: mode11_qLf2.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoned" not supported for cpu option "MapIter.Value called before Nextuse of closed network connectioncrypto/aes: output not full blockCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyW142108547152020037174224853515625710542735760100185871124267578125too many levels of symbolic linksslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeGODEBUG: no value specified for "reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangewaiting for unsupported file typecrypto/aes: invalid buffer overlapillegal base64 data at input byte CM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModes3552713678800500929355621337890625too many references: cannot spliceslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeunexpected runtime.netpoll error: encoding/hex: odd length hex stringSubscribeServiceChangeNotifications1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9network dropped connection on resettransport endpoint is not connectedpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid
Source: mode11_qLf2.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoned" not supported for cpu option "MapIter.Value called before Nextuse of closed network connectioncrypto/aes: output not full blockCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyW142108547152020037174224853515625710542735760100185871124267578125too many levels of symbolic linksslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeGODEBUG: no value specified for "reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangewaiting for unsupported file typecrypto/aes: invalid buffer overlapillegal base64 data at input byte CM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModes3552713678800500929355621337890625too many references: cannot spliceslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeunexpected runtime.netpoll error: encoding/hex: odd length hex stringSubscribeServiceChangeNotifications1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9network dropped connection on resettransport endpoint is not connectedpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid
Source: mode11_qLf2.exe	String found in binary or memory: C:/Program Files/Go/src/net/addrselect.go

Source: unknown	Process created: C:\Users\user\Desktop\mode11_qLf2.exe "C:\Users\user\Desktop\mode11_qLf2.exe"
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\mode11_qLf2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: mode11_qLf2.exe

Static file information: File size 3906560 > 1048576

Source: mode11_qLf2.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2dc400

Source: mode11_qLf2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: mode11_qLf2.exe	Static PE information: section name: .xdata
Source: mode11_qLf2.exe	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67204776C push 0000006Ah; retf	0_2_000001C672047784
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C6738303FC push ebp; iretd	0_2_000001C673830401
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67380A35D push edi; iretd	0_2_000001C67380A35E
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67380C91C pushad ; retf	0_2_000001C67380C91D
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67382B898 push ebp; iretd	0_2_000001C67382B899
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C673810901 push ebx; iretd	0_2_000001C673810902
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67382B84F push ebp; iretd	0_2_000001C67382B850
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67382B86F push ebp; iretd	0_2_000001C67382B870
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67380A71E push cs; retf	0_2_000001C67380A71F
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Code function: 0_2_000001C67380BD58 push ebp; iretd	0_2_000001C67380BD59

Source: C:\Users\user\Desktop\mode11_qLf2.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\mode11_qLf2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mode11_qLf2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\mode11_qLf2.exe

Last function: Thread delayed

Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPN
Source: mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa

Source: C:\Users\user\Desktop\mode11_qLf2.exe

Code function: 0_2_000001C673815E28 GetUserNameA,strrchr,_snprintf,

0_2_000001C673815E28

Source: C:\Users\user\Desktop\mode11_qLf2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 0.2.mode11_qLf2.exe.1c672010000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mode11_qLf2.exe PID: 5784, type: MEMORYSTR
Source: Yara match	File source: 0.2.mode11_qLf2.exe.1c672010000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Obfuscated Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mode11_qLf2.exe	21%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderrc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsjc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jszc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/Nc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/Vc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/bc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsZc-	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/fc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js.c9	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsnc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js32c	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsUI	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js~	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js&c1	100%	Avira URL Cloud	malware
http://c.pki.go/gsr	0%	Avira URL Cloud	safe
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderRc%	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/m0	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsll	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsf	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	100%	Avira URL Cloud	malware
http://c.pki.go	0%	Avira URL Cloud	safe
https://632313373.xyz:8443/js/jquery-3.3.1.min.jst	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsp	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsn	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/Rc%	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js2c	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/rc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsBc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsFc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder2c	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder:c	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsxI	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsVc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderbc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/jc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/Nc	100%	Avira URL Cloud	malware
https://632313373.xyz/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/~	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jstUI	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/rc	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js&	100%	Avira URL Cloud	malware
632313373.xyz	100%	Avira URL Cloud	malware
https://632313373.xyz/j	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
632313373.xyz	188.114.97.3	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
632313373.xyz	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://632313373.xyz:8443/Nc	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://o.pki.goog/s/we1/lk00%	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610572895.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749617425.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsZc-	mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsjc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/Vc	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/what?indextype=1&__cfduid=qgDuYI0End8kMbmyyLed-IgG3nntO0SCTar0wwyvT24anHiYuYC	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB78000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB7D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB78000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841627605.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsnc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderrc	mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jszc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/fc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/what?indextype=1&__cfduid=	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/bc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js.c9	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js32c	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/	mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/r4.crl0	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB78000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB20000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsUI	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js~	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/m0	mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/r4.crt0	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB78000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB20000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderRc%	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsll	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.go/gsr	mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js&c1	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsf	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jst	mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.go	mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i.pki.goog/we1.crt~B	mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsp	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsn	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/Rc%	mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js2c	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/rc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/we1.crt0	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610572895.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749617425.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsBc	mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/gsr1.crl0	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593305205.000001C66CB79000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628729027.000001C66CB80000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB71000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB80000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB77000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749639495.000001C66CB84000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB79000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsFc	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder2c	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder:c	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsxI	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsVc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderbc	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/jc	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/Nc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/we1/PCUeQViQlYc.crl0	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841715257.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1505276256.000001C66CB72000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610572895.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749617425.000001C66CB7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsJc	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://i.pki.goog/gsr1.crt0-	mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CA9C000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593305205.000001C66CB79000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841744385.000001C66CB74000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628729027.000001C66CB80000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB3D000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543178285.000001C66CB71000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1543040849.000001C66CB75000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749658845.000001C66CADE000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB80000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576634938.000001C66CB77000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749639495.000001C66CB84000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1576757790.000001C66CB7F000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB79000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1610478335.000001C66CB6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz/	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/~	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/rc	mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB40000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1628448768.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js&	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jstUI	mode11_qLf2.exe, 00000000.00000003.1593202853.000001C66CB41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz/j	mode11_qLf2.exe, 00000000.00000003.1841413831.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000002.2712224947.000001C66CB05000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1644942659.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp, mode11_qLf2.exe, 00000000.00000003.1749455734.000001C66CB04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	632313373.xyz	European Union		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583720
Start date and time:	2025-01-03 13:04:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mode11_qLf2.exe
Detection:	MAL
Classification:	mal100.troj.winEXE@2/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: mode11_qLf2.exe

Simulations

Behavior and APIs

Time	Type	Description
07:05:33	API Interceptor	68x Sleep call for process: mode11_qLf2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
632313373.xyz	m.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
632313373.xyz	svchostinter.exe	Get hash	malicious	CobaltStrike	Browse	172.67.175.230

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://t1.awagama2.org	Get hash	malicious	Unknown	Browse	188.114.96.3
	m.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
	http://www.escudier-sas.fr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.18.11.207
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	http://www.technoafriwave.rw	Get hash	malicious	Unknown	Browse	1.1.1.1
	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.66579891889152
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mode11_qLf2.exe
File size:	3'906'560 bytes
MD5:	434851e57e2ef7a2298111e7777ba2e3
SHA1:	777c10c935ec323e3397ce32bde2bd5d28143494
SHA256:	e1b6bd9876ca534e99b28403661e09b7a1ab7dac706df3962a0c975ba5b9e8ec
SHA512:	ffd76220d5f7c0c7630d59ab7b711fb754c9d5db3a494ff2619a0a9e0b4906296daf4604824e388fe31f09f09cc3ba706bd728597030242c41c6b481113f1f12
SSDEEP:	49152:OAD5mHuk0r0VnjjC4mkZMyITWt1U4yP21Qsq8VT/0+2Uw2:OJm3
TLSH:	5506DF0BBCE159B5C0AE92328A7661567A71BC040F3267D73A90B37C2F77BD09A36744
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........;......."..........n................@...............................@...........`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46ec80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	d42595b695fc008ef2c56aabd8efd68e

Entrypoint Preview

Instruction
jmp 00007F80AC903D10h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [00387812h]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007F80AC9075B5h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007F80AC911B8Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x401000	0x53e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3fa000	0x5370	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x402000	0x499c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39a1a0	0x178	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbbbfc	0xbbc00	8c8d5e80845b60931c34117d7cfb5a65	False	0.4751139106191744	data	6.267051663242364	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xbd000	0x2dc3e0	0x2dc400	f57fff089b3bfdb7f729caa0199a937f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x39a000	0x5fe40	0x16e00	672a0907deb30cbd7cd638d54a43fe96	False	0.285615181010929	data	3.2084385322811046	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3fa000	0x5370	0x5400	6b7df8b45d2250e08eb91fb84ea19749	False	0.4015531994047619	data	4.9405195822402	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x400000	0xb4	0x200	d5a432b15ea1de5871ba1b040f244088	False	0.228515625	shared library	1.787112262798912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x401000	0x53e	0x600	1eed92b78c29d6c28ea4846d7c7f7421	False	0.3776041666666667	OpenPGP Public Key	4.017189066074398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x402000	0x499c	0x4a00	3b71c6c38ccba8a1a6f65b6bde49f0a1	False	0.3090688344594595	data	5.394513585130103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x407000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 13:05:32.318816900 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:32.323623896 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:32.326586008 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:32.336621046 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:32.341464043 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:32.803637028 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:32.803666115 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:32.803682089 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:32.803770065 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:32.803770065 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:32.828201056 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:32.833046913 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:32.922419071 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:32.922486067 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:32.933089972 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:32.937870026 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100564003 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100581884 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100591898 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100603104 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100615025 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100625992 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100626945 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.100645065 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100656033 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.100658894 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.100696087 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.100717068 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.225156069 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.230001926 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.230063915 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.230406046 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.235143900 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.676686049 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.676822901 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.677323103 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.678545952 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:34.682087898 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:34.683351994 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.806819916 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.806826115 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.806838036 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.806854963 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.806860924 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.806871891 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.806875944 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.806917906 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:35.806945086 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:35.911318064 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:35.911940098 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:35.916471004 CET	8443	49707	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.916529894 CET	49707	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:35.916735888 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:35.916821957 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:35.917234898 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:35.922066927 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:36.363926888 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:36.364063978 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:36.364487886 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:36.365556955 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:36.369290113 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:36.370418072 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.498498917 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.498513937 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.498524904 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.498536110 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.498547077 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.498558044 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.498606920 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:37.498823881 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:37.614406109 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:37.619479895 CET	8443	49708	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.619539976 CET	49708	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:37.624490023 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:37.629359007 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:37.629461050 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:37.629973888 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:37.634794950 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:38.096379995 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:38.096468925 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:38.097119093 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:38.098376989 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:38.101948977 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:38.103231907 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.250839949 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.250861883 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.250874043 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.250885963 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.250897884 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.250906944 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:39.250912905 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.250966072 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:39.250966072 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:39.364468098 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:39.365108013 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:39.549283981 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.549333096 CET	8443	49709	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:39.549463034 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:39.549495935 CET	49709	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:39.550013065 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:39.557408094 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:40.013510942 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:40.013660908 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:40.019663095 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:40.021267891 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:40.025641918 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:40.027116060 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.196223021 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.196253061 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.196264982 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.196275949 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.196288109 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.196346998 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.196383953 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.285954952 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.286046028 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.395673037 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.400623083 CET	8443	49710	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.400700092 CET	49710	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.414545059 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.419368029 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.419465065 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.419801950 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.424628019 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.881608009 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.881679058 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.882287025 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.883338928 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:41.887063026 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:41.888132095 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:42.986001968 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:42.986013889 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:42.986032009 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:42.986046076 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:42.986056089 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:42.986068964 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:42.986078978 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:42.986114025 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:42.986162901 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.098967075 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.099551916 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.103925943 CET	8443	49711	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:43.104017019 CET	49711	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.104403019 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:43.104475021 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.107331038 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.112071991 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:43.551026106 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:43.551139116 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.551848888 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.552820921 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:43.556613922 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:43.557552099 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.638308048 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.638324976 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.638395071 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.638400078 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.638415098 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.638427973 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.638444901 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.638453007 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.638464928 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.638467073 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.638513088 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.755094051 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.760139942 CET	8443	49712	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.760195017 CET	49712	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.769283056 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.774142981 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:44.774225950 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.774481058 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:44.779361010 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:45.221267939 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:45.221349001 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:45.222347975 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:45.223408937 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:45.227155924 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:45.228219032 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.300754070 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.300781965 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.300796986 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.300808907 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.300822973 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.300836086 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.300889969 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.300950050 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.411700010 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.416680098 CET	8443	49713	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.416754007 CET	49713	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.424069881 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.428848982 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.428949118 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.429204941 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.434083939 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.877202034 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.877307892 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.877820969 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.878988028 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:46.882595062 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:46.883707047 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.024600029 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.024617910 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.024672031 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.024679899 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.024688959 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.024693012 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.024727106 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.024729013 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.024739027 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.024749994 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.024775028 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.024805069 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.139441013 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.145865917 CET	8443	49714	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.145924091 CET	49714	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.161164045 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.165956974 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.166049004 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.166326046 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.171084881 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.631856918 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.631910086 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.633826971 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.635210991 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:48.638529062 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:48.640033960 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.825068951 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.825103998 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.825118065 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.825128078 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.825170994 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.825171947 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.825180054 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.825191975 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.825205088 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.825215101 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.825217962 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.825239897 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.825265884 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.936233044 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.941349983 CET	8443	49715	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.941454887 CET	49715	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.972985029 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.977771997 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:49.977842093 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.978288889 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:49.983000994 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:50.067997932 CET	52665	53	192.168.2.7	1.1.1.1
Jan 3, 2025 13:05:50.072710991 CET	53	52665	1.1.1.1	192.168.2.7
Jan 3, 2025 13:05:50.073154926 CET	52665	53	192.168.2.7	1.1.1.1
Jan 3, 2025 13:05:50.077977896 CET	53	52665	1.1.1.1	192.168.2.7
Jan 3, 2025 13:05:50.427575111 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:50.427632093 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:50.428076982 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:50.431359053 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:50.432782888 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:50.436116934 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:50.536356926 CET	52665	53	192.168.2.7	1.1.1.1
Jan 3, 2025 13:05:50.541332006 CET	53	52665	1.1.1.1	192.168.2.7
Jan 3, 2025 13:05:50.541421890 CET	52665	53	192.168.2.7	1.1.1.1
Jan 3, 2025 13:05:51.583296061 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.583322048 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.583334923 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.583358049 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.583385944 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.583393097 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.583396912 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.583412886 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.583424091 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.583425999 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.583462954 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.720743895 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.721251011 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.725750923 CET	8443	49719	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.725992918 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:51.726078987 CET	49719	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.726144075 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.726469040 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:51.731203079 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:52.185785055 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:52.185935020 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:52.186623096 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:52.187709093 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:52.191370010 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:52.192475080 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.300415993 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.300478935 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.300492048 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.300504923 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.300515890 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.300528049 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.300528049 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.300528049 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.300558090 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.300585985 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.405122995 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.405765057 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.410226107 CET	8443	49721	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.410312891 CET	49721	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.410543919 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.410620928 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.414062023 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.419414997 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.873264074 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.873333931 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.873948097 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.874900103 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:53.878700018 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:53.879689932 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:54.967933893 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:54.967961073 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:54.967972040 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:54.967989922 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:54.967998981 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:54.968009949 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:54.968019962 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:54.968022108 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:54.968049049 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:54.968086958 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.057796955 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:55.058043003 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.170747042 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.171530008 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.175841093 CET	8443	52666	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:55.175914049 CET	52666	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.176290989 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:55.176354885 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.176554918 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.181329012 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:55.632783890 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:55.632910013 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.633333921 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.634596109 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:55.638159990 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:55.639451027 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.722156048 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.722183943 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.722196102 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.722213030 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.722225904 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.722249031 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:56.722275972 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:56.810558081 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.810728073 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:56.921230078 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:56.922169924 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:56.926263094 CET	8443	52667	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.926321030 CET	52667	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:56.926994085 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:56.927051067 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:56.927349091 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:56.932110071 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:57.395402908 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:57.395468950 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:57.395888090 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:57.396787882 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:57.400665045 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:57.401519060 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.509810925 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.509844065 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.509869099 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.509886980 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.509902954 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.509923935 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.509933949 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.510005951 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.510005951 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.510005951 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.510005951 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.623759031 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.624346972 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.628818989 CET	8443	52668	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.628906012 CET	52668	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.629189968 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:58.629312038 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.629596949 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:58.634428024 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:59.104294062 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:59.104441881 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:59.105083942 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:59.106133938 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:05:59.109860897 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:05:59.110946894 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.217675924 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.217696905 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.217720985 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.217735052 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.217746973 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.217772007 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.217777014 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.217808008 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.217837095 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.326891899 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.327727079 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.332230091 CET	8443	52669	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.332288027 CET	52669	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.332535982 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.332597971 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.332808971 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.338371038 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.903681993 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.903856993 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.904371023 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.905597925 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:00.910106897 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:00.911278009 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.037008047 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.037043095 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.037136078 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.037169933 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.037182093 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.037198067 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.037208080 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.037214994 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.037225008 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.037242889 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.037256956 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.037270069 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.186702013 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.187167883 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.191812992 CET	8443	52670	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.191881895 CET	52670	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.192054033 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.192112923 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.192320108 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.197076082 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.667058945 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.667174101 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.730663061 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.735491991 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:02.755814075 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:02.760637999 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:03.889771938 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:03.889797926 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:03.889827013 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:03.889836073 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:03.889856100 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:03.889868975 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:03.889875889 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:03.889889002 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:03.889900923 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:03.889910936 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:03.889920950 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:03.889934063 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:03.889940023 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:03.889991999 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:03.998960972 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:03.999497890 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:04.004340887 CET	8443	52671	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:04.004398108 CET	52671	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:04.004417896 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:04.004506111 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:04.004712105 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:04.009588957 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:04.475383043 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:04.478560925 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:04.478995085 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:04.480349064 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:04.483784914 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:04.485197067 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.645210981 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.645226955 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.645246983 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.645262003 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.645275116 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.645292044 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:05.645292044 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:05.645298004 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.645308018 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.645338058 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:05.645338058 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:05.989219904 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:05.994126081 CET	8443	52672	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:05.994193077 CET	52672	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:05.999017000 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:06.004091978 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:06.004170895 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:06.011718035 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:06.016494989 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:06.452039003 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:06.452158928 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:06.452634096 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:06.453572035 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:06.457423925 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:06.458372116 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.621100903 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.621150017 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.621160984 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.621172905 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.621185064 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.621184111 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:07.621196985 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.621228933 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:07.621257067 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:07.733107090 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:07.733728886 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:07.738125086 CET	8443	52673	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.738188982 CET	52673	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:07.738533974 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:07.738612890 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:07.738955021 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:07.743788958 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:08.204999924 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:08.205113888 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:08.205513000 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:08.206383944 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:08.210304022 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:08.211256981 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.387883902 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.387901068 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.387919903 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.387933969 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.387948036 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.387953997 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.387965918 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.387969017 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.388015985 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.498878956 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.499335051 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.503902912 CET	8443	52674	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.503964901 CET	52674	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.504194975 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.504265070 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.504570007 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.509366989 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.966172934 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.966365099 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.966816902 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.967801094 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:09.972623110 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:09.973238945 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.129187107 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.129250050 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.129261971 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.129273891 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.129285097 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.129292965 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.129297972 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.129318953 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.129364014 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.233159065 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.238154888 CET	8443	52675	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.238203049 CET	52675	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.272876978 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.277712107 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.277805090 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.278100967 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.282943964 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.725296021 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.725373983 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.729867935 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.734622955 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:11.745398045 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:11.750193119 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.828735113 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.828874111 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.828890085 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.828902960 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.828913927 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.828924894 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.828936100 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.828953028 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.828979969 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.829019070 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.939549923 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.940037012 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.944550991 CET	8443	52676	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.944617987 CET	52676	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.945004940 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:12.945080042 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.945338011 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:12.950244904 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:13.397957087 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:13.398051023 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:13.398547888 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:13.399499893 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:13.403368950 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:13.404360056 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.515997887 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.516011000 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.516033888 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.516046047 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.516057014 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.516074896 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.516108990 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.516218901 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.516232014 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.516279936 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.516304970 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.627013922 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.627444983 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.632004976 CET	8443	52677	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.632101059 CET	52677	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.632252932 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:14.632332087 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.632481098 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:14.637182951 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:15.079683065 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:15.079754114 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:15.109656096 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:15.114445925 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:15.184688091 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:15.189486027 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:15.618850946 CET	53927	53	192.168.2.7	162.159.36.2
Jan 3, 2025 13:06:15.623708963 CET	53	53927	162.159.36.2	192.168.2.7
Jan 3, 2025 13:06:15.623780012 CET	53927	53	192.168.2.7	162.159.36.2
Jan 3, 2025 13:06:15.628663063 CET	53	53927	162.159.36.2	192.168.2.7
Jan 3, 2025 13:06:16.091146946 CET	53927	53	192.168.2.7	162.159.36.2
Jan 3, 2025 13:06:16.096139908 CET	53	53927	162.159.36.2	192.168.2.7
Jan 3, 2025 13:06:16.096189976 CET	53927	53	192.168.2.7	162.159.36.2
Jan 3, 2025 13:06:16.250422001 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:16.250442028 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:16.250452995 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:16.250504971 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:16.250516891 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:16.250529051 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:16.250550032 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:16.250616074 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.214023113 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.218975067 CET	8443	52678	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:21.219036102 CET	52678	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.234380007 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.239167929 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:21.239228964 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.241661072 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.246483088 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:21.689024925 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:21.689117908 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.689536095 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.690445900 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:21.694299936 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:21.695240021 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.790827036 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.790847063 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.790870905 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.790878057 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.790882111 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.790919065 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.790919065 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.791253090 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.791265011 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.791285038 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.791295052 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.791311026 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.791328907 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.908220053 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.908723116 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.913239002 CET	8443	52679	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.913310051 CET	52679	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.913480043 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:22.913558960 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.913803101 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:22.918530941 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:23.377536058 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:23.377609015 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:23.377978086 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:23.378966093 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:23.382740974 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:23.383812904 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.484394073 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.484411955 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.484424114 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.484435081 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.484447002 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.484457970 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.484476089 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:24.484508038 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:24.611505985 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:24.612066984 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:24.616430998 CET	8443	53930	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.616482973 CET	53930	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:24.616830111 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:24.616908073 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:24.617207050 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:24.621994972 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:25.066272020 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:25.066339016 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:25.066701889 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:25.067723036 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:25.071445942 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:25.072467089 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.167814016 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.167824984 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.167835951 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.167849064 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.167860031 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.167871952 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.167881966 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.167882919 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.167912006 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.167932034 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.283555984 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.284168005 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.288486004 CET	8443	53931	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.288628101 CET	53931	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.288959026 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.289051056 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.289302111 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.294047117 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.748581886 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.748657942 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.749480963 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.750560999 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:26.754272938 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:26.755383968 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.867145061 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.867160082 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.867172956 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.867183924 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.867196083 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.867207050 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.867295980 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:27.867351055 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:27.970788956 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:27.971369982 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:27.975841045 CET	8443	53932	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.975925922 CET	53932	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:27.976156950 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:27.976226091 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:27.976483107 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:27.981255054 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:28.423233032 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:28.423702955 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:28.424285889 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:28.425463915 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:28.429047108 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:28.430336952 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.493809938 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.493853092 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.493869066 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.493877888 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.493885994 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.493901968 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.493905067 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.493920088 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.493931055 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.493976116 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.595671892 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.596133947 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.600716114 CET	8443	53933	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.600784063 CET	53933	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.600899935 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:29.600959063 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.601134062 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:29.605910063 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:30.075191021 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:30.075331926 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:30.097590923 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:30.103127956 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:30.111169100 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:30.116070986 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.262597084 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.262613058 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.262626886 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.262648106 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.262660980 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.262675047 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.262680054 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.262689114 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.262716055 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.262731075 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.377029896 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.377547979 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.382050037 CET	8443	53934	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.382110119 CET	53934	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.382376909 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.382458925 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.382822990 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.387593031 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.847974062 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.848032951 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.848721981 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.849977970 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:31.853460073 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:31.854758978 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:32.931894064 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:32.931916952 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:32.931930065 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:32.931941032 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:32.931952953 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:32.931962967 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:32.931977034 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:32.932030916 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.019428015 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:33.019481897 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.127192020 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.128065109 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.132149935 CET	8443	53935	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:33.132210970 CET	53935	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.132886887 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:33.132963896 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.133220911 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.137984037 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:33.598669052 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:33.598746061 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.599451065 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.600728035 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:33.604253054 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:33.605467081 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.726444006 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.726476908 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.726491928 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.726501942 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.726512909 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.726526976 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.726532936 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.726541996 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.726563931 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.726596117 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.830333948 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.831285000 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.835277081 CET	8443	53936	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.835391045 CET	53936	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.836052895 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:34.836179018 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.836487055 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:34.841268063 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:35.301878929 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:35.301945925 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:35.304522038 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:35.309278011 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:35.315084934 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:35.319927931 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.429881096 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.429909945 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.429922104 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.429941893 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.429955006 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.429964066 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:36.429965973 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.429977894 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.430012941 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:36.430012941 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:36.533349991 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:36.534045935 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:36.538307905 CET	8443	53937	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.538397074 CET	53937	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:36.538789988 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:36.538867950 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:36.539125919 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:36.543848038 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:37.011363029 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:37.011426926 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:37.012361050 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:37.013506889 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:37.017124891 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:37.018243074 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.090483904 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.090507984 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.090524912 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.090539932 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.090555906 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.090573072 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.090573072 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.090617895 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.090639114 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.205401897 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.205887079 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.210391998 CET	8443	53938	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.210480928 CET	53938	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.210726023 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.210800886 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.211050987 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.215878010 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.665911913 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.666004896 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.666451931 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.667443991 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:38.671724081 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:38.672271013 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.753171921 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.753204107 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.753216982 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.753248930 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.753248930 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.753263950 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.753277063 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.753287077 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.753298998 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.753314972 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.753334999 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.861376047 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.862220049 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.867089987 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.867202044 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.867413998 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.869322062 CET	8443	53939	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:39.869386911 CET	53939	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:39.872140884 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:40.316699982 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:40.316791058 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:40.322710037 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:40.327478886 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:40.335011959 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:40.339854002 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.421835899 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.421855927 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.421866894 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.421879053 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.421914101 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.421926022 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.421937943 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.422032118 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.422167063 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.533216953 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.533684015 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.538292885 CET	8443	53940	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.538367987 CET	53940	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.538428068 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.538495064 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.538758039 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.543482065 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.994955063 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:41.995018959 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.995479107 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:41.996417046 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:42.000260115 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:42.001413107 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.144783974 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.144807100 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.144819975 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.144831896 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.144843102 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.144855022 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.144901037 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.144933939 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.252032042 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.252494097 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.256932974 CET	8443	53941	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.257008076 CET	53941	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.257250071 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.257348061 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.257608891 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.262478113 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.714139938 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.714210033 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.717932940 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.718808889 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:43.722774029 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:43.723566055 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:44.848390102 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:44.848406076 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:44.848417997 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:44.848428965 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:44.848440886 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:44.848469973 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:44.848520041 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:44.937063932 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:44.937124014 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.048964024 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.049447060 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.054116964 CET	8443	53942	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:45.054182053 CET	53942	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.054285049 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:45.054351091 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.054536104 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.059386969 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:45.583992958 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:45.584204912 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.584602118 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.585594893 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:45.590101957 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:45.591070890 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.705676079 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.705709934 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.705728054 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.705740929 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.705751896 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.705765009 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.705775023 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.705777884 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:46.705817938 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:46.705842018 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:46.814888954 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:46.816062927 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:46.819963932 CET	8443	53943	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.820038080 CET	53943	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:46.820933104 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:46.821013927 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:46.821346998 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:46.826081991 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:47.274564981 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:47.274751902 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:47.275202990 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:47.276101112 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:47.280128002 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:47.280925035 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357083082 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357099056 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357117891 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357130051 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357141018 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357151985 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357161999 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357173920 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.357248068 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.357394934 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.471210957 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.472368956 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.476190090 CET	8443	53944	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.476305962 CET	53944	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.477113008 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.477227926 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.477519035 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.482310057 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.936997890 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.937092066 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.937908888 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.939897060 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:48.943363905 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:48.945250988 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.094290018 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.094311953 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.094322920 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.094333887 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.094350100 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.094362974 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.094400883 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.094430923 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.205286980 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.205800056 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.210306883 CET	8443	53945	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.210417032 CET	53945	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.210634947 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.210696936 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.211082935 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.215867043 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.676606894 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.676702023 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.677254915 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.678268909 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:50.682028055 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:50.683072090 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.783596039 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.783621073 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.783631086 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.783643961 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.783663034 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.783690929 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.783693075 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.783699036 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.783705950 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.783720016 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.783734083 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.783754110 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.783761978 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.892683029 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.893198967 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.897727966 CET	8443	53946	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.897788048 CET	53946	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.898507118 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:51.898581982 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.898834944 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:51.903695107 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:52.363954067 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:52.364047050 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:52.364522934 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:52.365503073 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:52.369314909 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:52.370340109 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.451170921 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.451191902 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.451205969 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.451217890 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.451231003 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.451244116 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.451246023 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.451280117 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.451280117 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.451288939 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.564522028 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.564966917 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.569588900 CET	8443	53947	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.569658041 CET	53947	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.569878101 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:53.569946051 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.570177078 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:53.574975967 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:54.084785938 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:54.084902048 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:54.085423946 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:54.086714029 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:54.090259075 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:54.091495037 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.203943968 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.204015017 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.204024076 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.204026937 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.204040051 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.204052925 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.204055071 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.204066992 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.204085112 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.204116106 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.315007925 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.315454006 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.320003033 CET	8443	53948	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.320075035 CET	53948	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.320271015 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.320333958 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.320595026 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.325392962 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.770575047 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.770648003 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.771028042 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.772012949 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:55.775820017 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:55.776829004 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.868820906 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.868863106 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.868875027 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.868885994 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.868896008 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.868896961 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.868916035 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.868916988 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.868931055 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.868963957 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.970963001 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.971498966 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.975954056 CET	8443	53949	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.976025105 CET	53949	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.976305008 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:56.976372957 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.976700068 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:56.981476068 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:57.421406984 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:57.421478987 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:57.422122002 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:57.423357964 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:57.426903009 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:57.428157091 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.523575068 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.523602009 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.523613930 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.523633003 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.523643017 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.523653030 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.523658037 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:58.523680925 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:58.523694992 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:58.627118111 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:58.627649069 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:58.632200956 CET	8443	53950	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.632266998 CET	53950	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:58.632416010 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:58.632492065 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:58.632775068 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:58.637526989 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:59.126205921 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:59.126296043 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:59.126655102 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:59.127882957 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:06:59.131395102 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:06:59.132673979 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.242194891 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.242213011 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.242224932 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.242268085 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.242284060 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.242302895 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.242315054 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.242325068 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.242333889 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.242351055 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.242363930 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.346098900 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.347263098 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.351046085 CET	8443	53951	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.351201057 CET	53951	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.352078915 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.352193117 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.352514982 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.357351065 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.828984976 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.829056025 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.829438925 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.830518961 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:00.834254980 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:00.835438967 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:01.937130928 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:01.937159061 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:01.937176943 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:01.937192917 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:01.937192917 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:01.937205076 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:01.937216043 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:01.937216997 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:01.937257051 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:01.937266111 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.056097031 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.057285070 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.061211109 CET	8443	53952	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:02.061280012 CET	53952	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.062164068 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:02.062232018 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.072669983 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.077517033 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:02.527375937 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:02.527434111 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.527837992 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.528949022 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:02.532658100 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:02.533761978 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.602858067 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.602874994 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.602962971 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:03.603163004 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.603176117 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.603183031 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.603188038 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.603241920 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:03.603266954 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:03.705399990 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:03.705938101 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:03.710391045 CET	8443	53953	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.710460901 CET	53953	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:03.710750103 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:03.710822105 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:03.711086035 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:03.715866089 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:04.185518026 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:04.185583115 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:04.185976028 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:04.187401056 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:04.190742016 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:04.192197084 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.281914949 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.281946898 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.281959057 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.281971931 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.281982899 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.281996012 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.282004118 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.282030106 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.282059908 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.392770052 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.393280983 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.398365021 CET	8443	53954	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.398442984 CET	53954	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.398701906 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.398768902 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.398977995 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.403753996 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.845169067 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.845280886 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.845791101 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.846775055 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:05.850564003 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:05.851583958 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:06.939904928 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:06.939938068 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:06.939949989 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:06.939961910 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:06.939973116 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:06.939974070 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:06.939984083 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:06.939995050 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:06.939997911 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:06.940036058 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.049418926 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.049932957 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.054478884 CET	8443	53955	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:07.054567099 CET	53955	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.054792881 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:07.054861069 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.056087017 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.060852051 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:07.501980066 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:07.502054930 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.502811909 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.503704071 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:07.507633924 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:07.508495092 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.569106102 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.569122076 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.569132090 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.569143057 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.569153070 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.569165945 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.569171906 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:08.569175005 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.569210052 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:08.569257021 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:08.673998117 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:08.674478054 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:08.679675102 CET	8443	53956	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.679748058 CET	53956	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:08.680012941 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:08.680083036 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:08.680299997 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:08.685108900 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:09.135854959 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:09.135931015 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:09.136552095 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:09.137590885 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:09.141316891 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:09.142368078 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.325297117 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.325349092 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.325361013 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.325368881 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.325375080 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.325386047 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.325397015 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.325402021 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.325411081 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.325448036 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.439697027 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.440145969 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.444742918 CET	8443	53957	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.444827080 CET	53957	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.445000887 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.445075989 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.445378065 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.450181007 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.908999920 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.909075975 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.909512043 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.910530090 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:10.914269924 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:10.915285110 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.064716101 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.064739943 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.064749956 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.064763069 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.064784050 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.064799070 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.064820051 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.064853907 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.174232006 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.175359964 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.179372072 CET	8443	53958	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.179464102 CET	53958	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.180224895 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.180358887 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.180814981 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.185599089 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.625015020 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.625091076 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.625488043 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.626504898 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:12.630254030 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:12.631329060 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.705550909 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.705566883 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.705578089 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.705589056 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.705600023 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.705611944 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.705641985 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:13.705677032 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:13.792279005 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.792331934 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:13.909763098 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:13.910734892 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:13.914798021 CET	8443	53959	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.914865971 CET	53959	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:13.915548086 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:13.915618896 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:13.918889999 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:13.923717022 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:14.364768028 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:14.364890099 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:14.365480900 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:14.366553068 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:14.370297909 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:14.371335030 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481113911 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481126070 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481137037 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481148005 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481159925 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481170893 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481183052 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481204033 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.481204987 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:15.481234074 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:15.481276035 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:15.596585035 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:15.597053051 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:15.601577044 CET	8443	53960	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.601649046 CET	53960	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:15.601933002 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:15.602000952 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:15.602284908 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:15.607116938 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:16.051872015 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:16.051944017 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:16.052370071 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:16.053323030 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:16.057136059 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:16.058140993 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.130393028 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.130434990 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.130445957 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.130462885 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.130465031 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.130477905 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.130489111 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.130495071 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.130507946 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.130542994 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.237365007 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.238006115 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.242424011 CET	8443	53961	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.242531061 CET	53961	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.242774010 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.242849112 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.243160009 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.247894049 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.689680099 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.689827919 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.690804958 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.691951036 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:17.695583105 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:17.696700096 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.798746109 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.798759937 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.798770905 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.798803091 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.798803091 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.798815966 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.798826933 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.798827887 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.798837900 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.798863888 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.798882961 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.909588099 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.910201073 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.914529085 CET	8443	53962	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.914588928 CET	53962	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.915003061 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:18.915075064 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.915340900 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:18.920092106 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:19.382586002 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:19.382684946 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:19.383117914 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:19.384103060 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:19.387861013 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:19.388838053 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.515917063 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.515930891 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.515943050 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.515954018 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.515965939 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.516064882 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.516141891 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:20.627943993 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:20.628492117 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:20.632915974 CET	8443	53963	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.633014917 CET	53963	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:20.633301020 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:20.633374929 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:20.633697987 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:20.638452053 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:21.079721928 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:21.079808950 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:21.080230951 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:21.081445932 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:21.085036039 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:21.086169958 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.180330992 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.180341959 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.180391073 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.180401087 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.180412054 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.180419922 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.180438995 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.180448055 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.180476904 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.180491924 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.299856901 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.300363064 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.304877996 CET	8443	53964	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.304943085 CET	53964	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.305089951 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.305161953 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.305460930 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.310154915 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.767174006 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.767369986 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.767806053 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.768790007 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:22.772568941 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:22.773592949 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.871615887 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.871649981 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.871660948 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.871671915 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.871674061 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.871682882 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.871696949 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.871701956 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.871723890 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.871740103 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.987284899 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.987795115 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.992348909 CET	8443	53965	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.992424011 CET	53965	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.992588997 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:23.992660999 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.993086100 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:23.997895002 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:24.448811054 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:24.448911905 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:24.449282885 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:24.450262070 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:24.454081059 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:24.455065966 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.524071932 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.524089098 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.524101019 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.524112940 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.524123907 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.524135113 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.524230957 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:25.524318933 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:25.660522938 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:25.661127090 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:25.665601015 CET	8443	53966	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.665666103 CET	53966	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:25.665935040 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:25.666042089 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:25.671190977 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:25.675952911 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:26.114454985 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:26.114552975 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:26.157488108 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:26.159272909 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:26.162280083 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:26.164009094 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.256688118 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.256711960 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.256722927 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.256767988 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.256778955 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.256791115 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.256850958 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.256901979 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.362617016 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.363251925 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.367686033 CET	8443	53967	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.367750883 CET	53967	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.368105888 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.368175030 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.368406057 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.373135090 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.814522982 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.814623117 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.815233946 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.816342115 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:27.819961071 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:27.821119070 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:28.919069052 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:28.919122934 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:28.919133902 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:28.919145107 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:28.919150114 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:28.919154882 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:28.919167042 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:28.919187069 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:28.919222116 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.242212057 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.242996931 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.247251034 CET	8443	53968	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:29.247319937 CET	53968	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.247872114 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:29.247935057 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.248336077 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.253103018 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:29.722850084 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:29.722932100 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.723335028 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.724308968 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:29.728101015 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:29.729093075 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:30.894726038 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:30.894743919 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:30.894756079 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:30.894828081 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:30.894843102 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:30.894864082 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:30.894874096 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:30.894913912 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:30.894951105 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.003945112 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.004420042 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.008944988 CET	8443	53969	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:31.009061098 CET	53969	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.009193897 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:31.009264946 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.009537935 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.014364004 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:31.470915079 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:31.471152067 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.471419096 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.472379923 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:31.476469994 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:31.477338076 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.567859888 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.567879915 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.567890882 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.567900896 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.567915916 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.567928076 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.568042994 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:32.568042994 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:32.674819946 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:32.675323963 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:32.680058956 CET	8443	53970	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.680143118 CET	53970	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:32.680157900 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:32.680227041 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:32.680474043 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:32.685292006 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:33.137470961 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:33.137559891 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:33.138042927 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:33.138977051 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:33.142808914 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:33.143744946 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.250806093 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.250853062 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.250875950 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.250891924 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.250905037 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.250910044 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:34.250921011 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.250945091 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:34.250972986 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:34.387587070 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:34.388086081 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:34.392657995 CET	8443	53971	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.392746925 CET	53971	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:34.392940998 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.393011093 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:34.407032013 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:34.412117004 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.842885971 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:34.842963934 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:35.576661110 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:35.578489065 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:35.769397974 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:35.769409895 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:36.894727945 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:36.894742012 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:36.894757986 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:36.894768000 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:36.894778967 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:36.894789934 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:36.894795895 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:36.894798040 CET	8443	53973	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:36.894826889 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:36.894839048 CET	53973	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.003035069 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.003539085 CET	53974	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.008332968 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:37.008354902 CET	8443	53972	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:37.008440971 CET	53972	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.008440971 CET	53974	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.008687973 CET	53974	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.013418913 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:37.454607964 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:37.454674959 CET	53974	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.458769083 CET	53974	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.460187912 CET	53974	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:37.463641882 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:37.465034008 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:38.569727898 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:38.569746971 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:38.569757938 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:38.569767952 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:38.569778919 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:38.569789886 CET	8443	53974	188.114.97.3	192.168.2.7
Jan 3, 2025 13:07:38.569813967 CET	53974	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:38.569873095 CET	53974	8443	192.168.2.7	188.114.97.3
Jan 3, 2025 13:07:38.569873095 CET	53974	8443	192.168.2.7	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 13:05:32.304071903 CET	52186	53	192.168.2.7	1.1.1.1
Jan 3, 2025 13:05:32.313467979 CET	53	52186	1.1.1.1	192.168.2.7
Jan 3, 2025 13:05:50.067614079 CET	53	52862	1.1.1.1	192.168.2.7
Jan 3, 2025 13:06:15.617764950 CET	53	53435	162.159.36.2	192.168.2.7
Jan 3, 2025 13:06:16.123615026 CET	53	60329	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 13:05:32.304071903 CET	192.168.2.7	1.1.1.1	0x9930	Standard query (0)	632313373.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 13:05:32.313467979 CET	1.1.1.1	192.168.2.7	0x9930	No error (0)	632313373.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 13:05:32.313467979 CET	1.1.1.1	192.168.2.7	0x9930	No error (0)	632313373.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	07:05:30
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\mode11_qLf2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mode11_qLf2.exe"
Imagebase:	0x850000
File size:	3'906'560 bytes
MD5 hash:	434851E57E2EF7A2298111E7777BA2E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.2711917062.000000C00047C000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:05:30
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.3%
Total number of Nodes:	54
Total number of Limit Nodes:	7

Executed Functions

Function 000001C67380E68C Relevance: 10.8, APIs: 7, Instructions: 260
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000001C67380E725

Part of subcall function 000001C67381F63C: _errno.LIBCMT ref: 000001C67381F673
Part of subcall function 000001C67381F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001C67381F67E

_snprintf.LIBCMT ref: 000001C67380E7BD
_snprintf.LIBCMT ref: 000001C67380E7D4
HttpOpenRequestA.WININET ref: 000001C67380E818
InternetQueryDataAvailable.WININET ref: 000001C67380E87A

Part of subcall function 000001C673812D70: strchr.LIBCMT ref: 000001C673812DD6
Part of subcall function 000001C673812D70: _snprintf.LIBCMT ref: 000001C673812E0C

Part of subcall function 000001C673812C0C: strchr.LIBCMT ref: 000001C673812C69
Part of subcall function 000001C673812C0C: _snprintf.LIBCMT ref: 000001C673812CB3

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$AvailableDataHttpInternetOpenQueryRequest_errno_invalid_parameter_noinfo
String ID:
API String ID: 2488036128-0
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: 428dcb58d63f5f0abd823da747d5433b518a7e33e1095dab9efea461249ecd26
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: 4D81A631658B4C8FEB55EB14D886BEAB3E5FB94715F10093EE44AC3291DF74E9018781

Function 000001C673815E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001C673815FEC: malloc.LIBCMT ref: 000001C673816008

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,?,-00000001,?,00000002,000001C67380CC89), ref: 000001C673815EAF
strrchr.LIBCMT ref: 000001C673815EED
_snprintf.LIBCMT ref: 000001C673815F9B

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: NameUser_snprintfmallocstrrchr
String ID:
API String ID: 1238167203-0
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: 82be0b35083abd793fcf3f377e259b7cd5a626aaa530d703d2908a6974768fa0
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: 1D518070758B080FFB58AB6C9446BAA72C2EB89704F10493EF49FC3293DA34D8028746

Function 000001C67380CA74 Relevance: 7.9, APIs: 6, Instructions: 411
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001C673815FEC: malloc.LIBCMT ref: 000001C673816008

malloc.LIBCMT ref: 000001C67380CB3B

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

Part of subcall function 000001C67381C230: malloc.LIBCMT ref: 000001C67381C29C

Part of subcall function 000001C67381EAA8: malloc.LIBCMT ref: 000001C67381EAF8

Part of subcall function 000001C67381EAA8: realloc.LIBCMT ref: 000001C67381EB07

malloc.LIBCMT ref: 000001C67380CC4A
_snprintf.LIBCMT ref: 000001C67380CCC1
_snprintf.LIBCMT ref: 000001C67380CCE7
_snprintf.LIBCMT ref: 000001C67380CD0E
free.LIBCMT ref: 000001C67380CEC6

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction ID: fa6bd3f73ab9d853abad8959b74b12498a1454a8f0628a291010045088bc2ce0
Opcode Fuzzy Hash: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction Fuzzy Hash: 75D19430755B044BFB59BB788893BEA72D2EB84B08F50493DA496C72D3DF34D9468781

Function 000001C67380F014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000001C67380F042
WSAIoctl.WS2_32 ref: 000001C67380F08F
closesocket.WS2_32 ref: 000001C67380F0EE

Strings

_Cy, xrefs: 000001C67380F0A1

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: IoctlSocketclosesocket
String ID: _Cy
API String ID: 3445158922-1085951347
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: 1069bbc5e016726ca722e2bfd6e48b7bf6ad5a539b32ab82e1e67923753c62ee
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: 9631B63061EB484BEB54DF2899C5BA6B7D1FBA8715F114A3EE44AC3291DB34C5418741

Function 000001C67380EA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000001C67380EB0C
InternetConnectA.WININET ref: 000001C67380EB7A

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction ID: 765e5d85ac8e356ef8da200d19fbbf011014c5e5cd29a328126f5dde5491a911
Opcode Fuzzy Hash: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction Fuzzy Hash: F251A530759B044FFB59DB28D496BA973D1FB89708F11483EE087D3292DB78E9069742

Function 000001C6720296B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001C67202977B

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction ID: 6f5118b49bf2c8d07a6943de93fcd7974041e59ef1585e3940d85787af144196
Opcode Fuzzy Hash: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction Fuzzy Hash: A571BE36219B8486DAA0CB09E49075AB7A0F7C8B98F544526EFCE83B68DF3DD555CB00

Function 000001C672029324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001C672029471

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction ID: ef7fc9d42ec54194ff76fb37433827bbb79f90fb89082d3a76560b5c2d702fcc
Opcode Fuzzy Hash: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction Fuzzy Hash: 0F41B972618B88C7DB54CB19E484B1AB7E1F7C8B94F101526FB8E83BA8DB3CD5518B00

Function 008BF220 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2710400103.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.2710376007.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710460418.000000000090D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710639288.0000000000BEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710653572.0000000000BEC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710667312.0000000000BF1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710682711.0000000000BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710695478.0000000000BFF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710695478.0000000000C18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710695478.0000000000C1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710695478.0000000000C46000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710756014.0000000000C4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710769632.0000000000C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710782473.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_mode11_qLf2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a83c295b55d1fb3924cfc6086ff6026e810ee76d85704118357723c5304dc2
Instruction ID: 3b475dbb1fb7ddfef0a4dfed8a9999ac42df2ca5629e210ada23bd3dc4cd3f0a
Opcode Fuzzy Hash: a2a83c295b55d1fb3924cfc6086ff6026e810ee76d85704118357723c5304dc2
Instruction Fuzzy Hash: 57319D6391CFC482D3218B28F5413AAB364F7A9784F15A715EFC852A1ADF38E1E5CB40

Function 008BB5C0 Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2710400103.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.2710376007.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710460418.000000000090D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710639288.0000000000BEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710653572.0000000000BEC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710667312.0000000000BF1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710682711.0000000000BFE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710695478.0000000000BFF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710695478.0000000000C18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710695478.0000000000C1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710695478.0000000000C46000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710756014.0000000000C4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710769632.0000000000C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710782473.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_mode11_qLf2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f426410239744f5ba57e2b78151ac65bfe157d6a2c0a85e8369f5e0dce230c44
Instruction ID: 5c0b3fae385a9f44359cc047849e34b2d72a3f3089b019ad3dae5d74eee4f3fa
Opcode Fuzzy Hash: f426410239744f5ba57e2b78151ac65bfe157d6a2c0a85e8369f5e0dce230c44
Instruction Fuzzy Hash:

Non-executed Functions

Function 000001C67203239C Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001C6720323FD

Part of subcall function 000001C672030A00: _getptd.LIBCMT ref: 000001C672030A16
Part of subcall function 000001C672030A00: __updatetlocinfo.LIBCMT ref: 000001C672030A4B
Part of subcall function 000001C672030A00: __updatetmbcinfo.LIBCMT ref: 000001C672030A72

_errno.LIBCMT ref: 000001C672032402

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

_fileno.LIBCMT ref: 000001C67203242F

Part of subcall function 000001C672034E54: _errno.LIBCMT ref: 000001C672034E5D
Part of subcall function 000001C672034E54: _invalid_parameter_noinfo.LIBCMT ref: 000001C672034E68

write_multi_char.LIBCMT ref: 000001C672032A6B
write_string.LIBCMT ref: 000001C672032A88
write_multi_char.LIBCMT ref: 000001C672032AA5
write_string.LIBCMT ref: 000001C672032B04
write_string.LIBCMT ref: 000001C672032B3B
write_multi_char.LIBCMT ref: 000001C672032B5D
free.LIBCMT ref: 000001C672032B71
_isleadbyte_l.LIBCMT ref: 000001C672032C42
write_char.LIBCMT ref: 000001C672032C58
write_char.LIBCMT ref: 000001C672032C79
_errno.LIBCMT ref: 000001C672032D7C
_invalid_parameter_noinfo.LIBCMT ref: 000001C672032D87

Strings

@, xrefs: 000001C67203241B
, xrefs: 000001C672032A3F

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction ID: c083c4e8ba10154f2f6f92d4ac05c3cf1d314c05872dc3d528659c58025d6d03
Opcode Fuzzy Hash: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction Fuzzy Hash: 4252B132688794CBFB658B35954CFEE7BA0B74578CF14580EDA4646AE6DB38CD40CB20

Function 000001C673822F9C Relevance: 30.8, APIs: 15, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

Part of subcall function 000001C673821600: _getptd.LIBCMT ref: 000001C673821616
Part of subcall function 000001C673821600: __updatetlocinfo.LIBCMT ref: 000001C67382164B
Part of subcall function 000001C673821600: __updatetmbcinfo.LIBCMT ref: 000001C673821672

_errno.LIBCMT ref: 000001C673823002

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

_fileno.LIBCMT ref: 000001C67382302F

Part of subcall function 000001C673825A54: _errno.LIBCMT ref: 000001C673825A5D
Part of subcall function 000001C673825A54: _invalid_parameter_noinfo.LIBCMT ref: 000001C673825A68

write_multi_char.LIBCMT ref: 000001C67382366B
write_string.LIBCMT ref: 000001C673823688
write_multi_char.LIBCMT ref: 000001C6738236A5
write_string.LIBCMT ref: 000001C673823704
write_multi_char.LIBCMT ref: 000001C67382375D
free.LIBCMT ref: 000001C673823771
_isleadbyte_l.LIBCMT ref: 000001C673823842
write_char.LIBCMT ref: 000001C673823858
write_char.LIBCMT ref: 000001C673823879
_errno.LIBCMT ref: 000001C67382397C
_invalid_parameter_noinfo.LIBCMT ref: 000001C673823987

Strings

, xrefs: 000001C67382363F
@, xrefs: 000001C67382301B

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3613058218-1077428164
Opcode ID: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction ID: 4008567867273e51e834893a118a77b4beff8d74257bc3ca11b27cddbdf7b529
Opcode Fuzzy Hash: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction Fuzzy Hash: E3623C30998B488AFB69CB18C567BF9B7D0FB95B18F240A3DD487C31C1D6B6DD028A41

Function 000001C673822528 Relevance: 29.0, APIs: 15, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001C673821600: _getptd.LIBCMT ref: 000001C673821616
Part of subcall function 000001C673821600: __updatetlocinfo.LIBCMT ref: 000001C67382164B
Part of subcall function 000001C673821600: __updatetmbcinfo.LIBCMT ref: 000001C673821672

_errno.LIBCMT ref: 000001C67382258E

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

_fileno.LIBCMT ref: 000001C6738225BB

Part of subcall function 000001C673825A54: _errno.LIBCMT ref: 000001C673825A5D
Part of subcall function 000001C673825A54: _invalid_parameter_noinfo.LIBCMT ref: 000001C673825A68

write_multi_char.LIBCMT ref: 000001C673822BEB
write_string.LIBCMT ref: 000001C673822C08
write_multi_char.LIBCMT ref: 000001C673822C25
write_string.LIBCMT ref: 000001C673822C84
write_multi_char.LIBCMT ref: 000001C673822CDD
free.LIBCMT ref: 000001C673822CF1
_isleadbyte_l.LIBCMT ref: 000001C673822DC2
write_char.LIBCMT ref: 000001C673822DD8
write_char.LIBCMT ref: 000001C673822DF9
_errno.LIBCMT ref: 000001C673822EF3
_invalid_parameter_noinfo.LIBCMT ref: 000001C673822EFE

Strings

, xrefs: 000001C673822BBF

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3613058218-3916222277
Opcode ID: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction ID: 025cf10da03a57f5e1c3fee208c3efa9724b46bf28a2d3b22faf64c6fa78b3c7
Opcode Fuzzy Hash: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction Fuzzy Hash: E462F830998B4D8AFBACDB188552BF9B7D1FB95B18F240A3DD887C31D2D635D8428742

Function 000001C672031928 Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 645COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001C672031989

Part of subcall function 000001C672030A00: _getptd.LIBCMT ref: 000001C672030A16
Part of subcall function 000001C672030A00: __updatetlocinfo.LIBCMT ref: 000001C672030A4B
Part of subcall function 000001C672030A00: __updatetmbcinfo.LIBCMT ref: 000001C672030A72

_errno.LIBCMT ref: 000001C67203198E

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

_fileno.LIBCMT ref: 000001C6720319BB

Part of subcall function 000001C672034E54: _errno.LIBCMT ref: 000001C672034E5D
Part of subcall function 000001C672034E54: _invalid_parameter_noinfo.LIBCMT ref: 000001C672034E68

write_multi_char.LIBCMT ref: 000001C672031FEB
write_string.LIBCMT ref: 000001C672032008
_errno.LIBCMT ref: 000001C6720322F3
_invalid_parameter_noinfo.LIBCMT ref: 000001C6720322FE

Strings

-, xrefs: 000001C672031F9C
0, xrefs: 000001C672031D28

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$0
API String ID: 3246410048-417717675
Opcode ID: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction ID: 97ee8b8f2ca9ada242471da07790e4897dd7b3075abef3659730cb6912d28f0b
Opcode Fuzzy Hash: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction Fuzzy Hash: 5642D332698784CAFB648B35954CFEEBBA0B74978CF14680DDB46466D6DB39C940C720

Function 000001C672035914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 000001C67203596A
_errno.LIBCMT ref: 000001C672035971
_invalid_parameter_noinfo.LIBCMT ref: 000001C67203597C

Strings

U, xrefs: 000001C672035EDE

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction ID: 0d562a3e8fbd6e01188241e1513d9b46862cee5e04d7bcacd7945e6b04986cbf
Opcode Fuzzy Hash: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction Fuzzy Hash: 3F12E132254741CAFB208F35D488FDEBFA0F78975CF50091AEA89836A6DB39C445CB20

Function 000001C673817B38 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001C673817CA5
_snprintf.LIBCMT ref: 000001C673817D66
_snprintf.LIBCMT ref: 000001C673817D83
_snprintf.LIBCMT ref: 000001C673817FD8
_snprintf.LIBCMT ref: 000001C6738180E8
_snprintf.LIBCMT ref: 000001C6738181A6
_snprintf.LIBCMT ref: 000001C67381825E
_snprintf.LIBCMT ref: 000001C673818002

Part of subcall function 000001C67381F63C: _errno.LIBCMT ref: 000001C67381F673
Part of subcall function 000001C67381F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001C67381F67E

_snprintf.LIBCMT ref: 000001C673818276
_snprintf.LIBCMT ref: 000001C673818334

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: 0e8e6e2c5a57a87ac4444d991887e88e74b5514620a4800c4cc54ae0bc69d5dc
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: BE52C530558E899BF75AAB2CD443BE1F3E0FF68309F44562CE995C7162EB34E5828781

Function 000001C672026F38 Relevance: 13.0, APIs: 10, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001C672027166
_snprintf.LIBCMT ref: 000001C672027183
_snprintf.LIBCMT ref: 000001C6720270A5

Part of subcall function 000001C67202EA3C: _errno.LIBCMT ref: 000001C67202EA73
Part of subcall function 000001C67202EA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001C67202EA7E

_snprintf.LIBCMT ref: 000001C6720273D8
_snprintf.LIBCMT ref: 000001C672027734

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: 9dce2ba919a08e4fd16a98efccdbdca5bcc3d02bd5441a81dac457bc82839bb8
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: B54280B2654F84D2FA25CB29D0096E9B3E0FF9875DF445902DF8817A61EF38D2A6C350

Function 000001C67203B7B0 Relevance: 5.9, Strings: 4, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 000001C67203BE63
<, xrefs: 000001C67203BE6E
e ', xrefs: 000001C67203C405, 000001C67203C47E, 000001C67203C4F7, 000001C67203C570
ailure #%d - %s, xrefs: 000001C67203C41F, 000001C67203C498, 000001C67203C511, 000001C67203C58A

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID: $<$ailure #%d - %s$e '
API String ID: 0-963976815
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: 104119b341821e63a6da3ab5de322324bf9c90bb7be7dbda94ac89f3481e59cf
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: C592F3B2325A8087EB58CB1DE4A573AB7A1F3C8B84F44512AE79B87794CE3CD551CB04

Function 000001C67203C397 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

e ', xrefs: 000001C67203C405, 000001C67203C47E, 000001C67203C4F7, 000001C67203C570
ailure #%d - %s, xrefs: 000001C67203C41F, 000001C67203C498, 000001C67203C511, 000001C67203C58A

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID: ailure #%d - %s$e '
API String ID: 0-4163927988
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: 9a56e69443bbca860fc75794dad0b944174f62475df58f3fd9dc5275a424d699
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: 85614CB6614A508BD714CB1CE4D4A6AB7E1F3CDBC8F84461AE38B87768CA3CD645CB50

Function 000001C6738201A8 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 000001C6738201DC

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction ID: a0089b4b0cd2522974201992625c2f6514d91c7a74042495c947299675ed21b3
Opcode Fuzzy Hash: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction Fuzzy Hash: D7A1CD71619A098FFF54FF75E898AAA37B2F768301721893A904AC3174DABCD545CB40

Function 000001C67382DBF0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: 277db3281f73a85982876b23be8c0f570962d59456e58c47f7c4e62606eeadbe
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 75620A312286558FD31CCB1CC5B1B7AB7E1FB89340F44896DE287CB692C639EA45CB91

Function 000001C67382D280 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 68a13756acfcd6917f85f092a1e101560af53bfceeb8c5231c4213ca7d538f88
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: FF52EE312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE28ACB692C639D545CB91

Function 000001C67203CFF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: d782476c3a659336ae61edc1f0e28d40f8496f93bc80931f3ebd3ad47449f47e
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: C85261B2214A4187E708CB1CE4A5B7AB7E1F3C9B80F44852AE7978B799CE3DD554CB10

Function 000001C67203C680 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: a2ab39bded5a33fdf50c181bce8b467fd90e3b5b8b3fcfc883aeb1c0921e9afd
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 605275B22146848BD708CF1DE4A4B7AB7E1F3C9B84F44852AE7868B798CA3DD544CF50

Function 000001C672019680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction ID: 59709aa47f792527215a4937a77e4062ee468d7165deaf0fdab45a75a119da45
Opcode Fuzzy Hash: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction Fuzzy Hash: D8F1B632344B46C6FB20CB15E598BEE73A2F79479CF900915EA4987789EB34CE85CB50

Function 000001C67201CE3C Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74bee57ece39a3ee739721ddd6b8b7c874878cbec99e002ba7fd2a6b2694298
Instruction ID: 70e0737dc923081356c8dd3702044d8c406031f76247ebdccfe6e09ea83d6188
Opcode Fuzzy Hash: f74bee57ece39a3ee739721ddd6b8b7c874878cbec99e002ba7fd2a6b2694298
Instruction Fuzzy Hash: 31E193B2690741C7FB64CB25E849BEE73A1F74875CF048925DB8A97A92DB3CE081C350

Function 000001C67201916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction ID: 24caba45e66640b5aa3ec348d5fbcc74fe7465919aa80d91b2f340b22cb1a412
Opcode Fuzzy Hash: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction Fuzzy Hash: DEE1D632344B86D2FF20DB65D488BEE77A2F79478CF800811EA4D97699EB34CA85C750

Function 000001C672020334 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction ID: f33d7faface1a12f5fe4dd4c9b9a18c5f1ab6dd85d3f464635025996662e473d
Opcode Fuzzy Hash: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction Fuzzy Hash: 1A71A272694B40C7FB60CF21E488B9E73E1F7A8B9CF505926DA4943B94DF38C4848B60

Function 000001C673826E1C Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C673826E4E

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

__doserrno.LIBCMT ref: 000001C673826E45

Part of subcall function 000001C673821CA8: _getptd_noexit.LIBCMT ref: 000001C673821CAC

__doserrno.LIBCMT ref: 000001C673826EAB
_errno.LIBCMT ref: 000001C673826EB2
_invalid_parameter_noinfo.LIBCMT ref: 000001C673826F16

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction ID: 9bafd04b24707e5676fe6dc39e69b9fb6de7c34bb0a69a77370a1dfc918389cf
Opcode Fuzzy Hash: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction Fuzzy Hash: 8531E7702887058FF719EF68D983BFD36D0EB42B28F610A79E416872E3DAB4D8014391

Function 000001C672031B48 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

write_multi_char.LIBCMT ref: 000001C672031FEB
write_string.LIBCMT ref: 000001C672032008
write_multi_char.LIBCMT ref: 000001C672032025
write_string.LIBCMT ref: 000001C672032084
write_multi_char.LIBCMT ref: 000001C6720320DD
free.LIBCMT ref: 000001C6720320F1

Strings

, xrefs: 000001C672031FBF

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: write_multi_char$write_string$free
String ID:
API String ID: 2630409672-3916222277
Opcode ID: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction ID: 776952759cc56d8e7cbc255892b7a10e4b8811b0f3d4e0bc7e610e637d3f3f07
Opcode Fuzzy Hash: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction Fuzzy Hash: 29A1B432644744CAFB21CB75E408FEEBBA0F78979CF141809DE4957A9ACB39C945CB20

Function 000001C673827C08 Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C673827C33

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

__doserrno.LIBCMT ref: 000001C673827C2B

Part of subcall function 000001C673821CA8: _getptd_noexit.LIBCMT ref: 000001C673821CAC

__lock_fhandle.LIBCMT ref: 000001C673827C77
_lseeki64_nolock.LIBCMT ref: 000001C673827C90
_unlock_fhandle.LIBCMT ref: 000001C673827CB3

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction ID: 7d36fa78526358c6d880ba1f5214222601f7617233302e3acc233a4671767aa7
Opcode Fuzzy Hash: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction Fuzzy Hash: 2821F730688B044FF319EB69DD43BFD72D0EB86B29F650A79F116872D3DA74D80142A1

Function 000001C673827A90 Relevance: 15.1, APIs: 10, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C673827ABB

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

__doserrno.LIBCMT ref: 000001C673827AB3

Part of subcall function 000001C673821CA8: _getptd_noexit.LIBCMT ref: 000001C673821CAC

__lock_fhandle.LIBCMT ref: 000001C673827AFF
_lseek_nolock.LIBCMT ref: 000001C673827B18
_unlock_fhandle.LIBCMT ref: 000001C673827B39

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction ID: 03bccfd36735467b77553971e013d2a148883ec5c71d706e60d9e4037d2a3106
Opcode Fuzzy Hash: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction Fuzzy Hash: 6021E231A887004FF319EB699993BFD7690EB82B39F250A79F056872D3D674D8014296

Function 000001C67203621C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67203624E

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

__doserrno.LIBCMT ref: 000001C672036245

Part of subcall function 000001C6720310A8: _getptd_noexit.LIBCMT ref: 000001C6720310AC

__doserrno.LIBCMT ref: 000001C6720362AB
_errno.LIBCMT ref: 000001C6720362B2
_invalid_parameter_noinfo.LIBCMT ref: 000001C672036316

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction ID: c3581a6d8fe5440f5f03fd27b417fd64e23de9c6448e869ba1cef734b354ec64
Opcode Fuzzy Hash: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction Fuzzy Hash: 8531E432380784C6F7126F769889FEDB750BB857A8F96592DAA21173D3CA78C4418734

Function 000001C67203F150 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001C67203F176
_errno.LIBCMT ref: 000001C67203F16B

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction ID: 606191a8b8dbaa5b5172d29e4788c0dbe1f60d27a6bb96d03023279b83770a39
Opcode Fuzzy Hash: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction Fuzzy Hash: 1E412475690391C9FF60AB32950CFE973E0F765BACF944929EA5443BC7D728C8418760

Function 000001C673826434 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67382645F

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

__doserrno.LIBCMT ref: 000001C673826457

Part of subcall function 000001C673821CA8: _getptd_noexit.LIBCMT ref: 000001C673821CAC

__lock_fhandle.LIBCMT ref: 000001C6738264A3
_unlock_fhandle.LIBCMT ref: 000001C6738264DD

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction ID: aa39150d0f92ce6b30cb5e5f2ccb4bc96cda2620a10735659fa1cd005a8bc29e
Opcode Fuzzy Hash: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction Fuzzy Hash: F521F730A8C7004FF319EB58DA43BFC76D0EB85B29F650A7DE056872D3DAB4D84142A5

Function 000001C673825C58 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C673825C79

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

__doserrno.LIBCMT ref: 000001C673825C71

Part of subcall function 000001C673821CA8: _getptd_noexit.LIBCMT ref: 000001C673821CAC

__lock_fhandle.LIBCMT ref: 000001C673825CBD
_close_nolock.LIBCMT ref: 000001C673825CD0
_unlock_fhandle.LIBCMT ref: 000001C673825CE9

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction ID: ccf542f0e7c0c2111bbf52a41ced351f14b0d69dc78ee42136901073f62eaf5c
Opcode Fuzzy Hash: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction Fuzzy Hash: 4B21E4715C9B048EF315EB648E87BE8B6D0EF41729F650E7DE416871E3DA74C80087A1

Function 000001C672037008 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C672037033

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

__doserrno.LIBCMT ref: 000001C67203702B

Part of subcall function 000001C6720310A8: _getptd_noexit.LIBCMT ref: 000001C6720310AC

__lock_fhandle.LIBCMT ref: 000001C672037077
_lseeki64_nolock.LIBCMT ref: 000001C672037090

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction ID: 44272a35a4d53d261a45ab8929d19c3100eb9d48112402b2440e566404679175
Opcode Fuzzy Hash: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction Fuzzy Hash: CC21A932680744C5FA112B36984EFEDB750BB85BB9F495A1DAA351B3E3CB78C4818731

Function 000001C672036E90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C672036EBB

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

__doserrno.LIBCMT ref: 000001C672036EB3

Part of subcall function 000001C6720310A8: _getptd_noexit.LIBCMT ref: 000001C6720310AC

__lock_fhandle.LIBCMT ref: 000001C672036EFF
_lseek_nolock.LIBCMT ref: 000001C672036F18

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction ID: fa203eb0de73baa65628741dfd74762af64143d4ce6ea89e9830a79488b52940
Opcode Fuzzy Hash: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction Fuzzy Hash: 7421F332680740C9F7022F369889FEDB760BB807A9F1A591DAA15473D3CBB8C8418738

Function 000001C67381FF6C Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001C67381FF9A

Part of subcall function 000001C67381F244: _errno.LIBCMT ref: 000001C67381F264

free.LIBCMT ref: 000001C67381FFAF
free.LIBCMT ref: 000001C67381FFD0
free.LIBCMT ref: 000001C67381FFE5
free.LIBCMT ref: 000001C67381FFF9
free.LIBCMT ref: 000001C673820005
free.LIBCMT ref: 000001C673820030
free.LIBCMT ref: 000001C673820051
free.LIBCMT ref: 000001C67382006A
free.LIBCMT ref: 000001C67382009B

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: 69b69ab2f5012f37928dc01466206ba167d7218d7ee8971c1cdfd525e18514d3
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 2B41A130296B0A8FFB94EB68D896FE472D0F758719F64457D9615C22E1CE7CC941C710

Function 000001C67202F36C Relevance: 12.6, APIs: 10, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001C67202F39A

Part of subcall function 000001C67202E644: _errno.LIBCMT ref: 000001C67202E664

free.LIBCMT ref: 000001C67202F3AF
free.LIBCMT ref: 000001C67202F3D0
free.LIBCMT ref: 000001C67202F3E5
free.LIBCMT ref: 000001C67202F3F9
free.LIBCMT ref: 000001C67202F405
free.LIBCMT ref: 000001C67202F430
free.LIBCMT ref: 000001C67202F451
free.LIBCMT ref: 000001C67202F46A
free.LIBCMT ref: 000001C67202F49B

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction ID: 1efda606ff0bc2acaa80caa6ed7d7f1e280341505d61db3eedcd9b18fdf1f3ee
Opcode Fuzzy Hash: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction Fuzzy Hash: 6931B9B12C1B85C6FE65DB16E89DFE433E0BB9479CF580D26D91A066E2DF6CC4848231

Function 000001C67382FD50 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001C67382FD76
_errno.LIBCMT ref: 000001C67382FD6B

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction ID: 378038e5a7b0303db43486710b028d0192a2ed4713ee4234e9ed88fa7e0b4fbf
Opcode Fuzzy Hash: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction Fuzzy Hash: 60514934155B0A4BFFA4EB288643BF972D0FB54B29FA40A7AE456CB1D6D634CC41C781

Function 000001C672035834 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67203585F

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

__doserrno.LIBCMT ref: 000001C672035857

Part of subcall function 000001C6720310A8: _getptd_noexit.LIBCMT ref: 000001C6720310AC

__lock_fhandle.LIBCMT ref: 000001C6720358A3

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction ID: 757fa2f80fcfe332eba69261b2674ea13cf40c8e0ea1571d9a29a70bfdc1ae17
Opcode Fuzzy Hash: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction Fuzzy Hash: 9D21D432680780C5F7012F36984AFEDBF607B887A9F59491DAA15277E3CA78C4418770

Function 000001C672035058 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C672035079

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

__doserrno.LIBCMT ref: 000001C672035071

Part of subcall function 000001C6720310A8: _getptd_noexit.LIBCMT ref: 000001C6720310AC

__lock_fhandle.LIBCMT ref: 000001C6720350BD
_close_nolock.LIBCMT ref: 000001C6720350D0

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction ID: 5c01ed7f17ef15cfb075971b49f50ca50353ade62b1baaf264ac1a70063b6d92
Opcode Fuzzy Hash: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction Fuzzy Hash: 3511BE32680784C5F3156F359C8AFECBF60B788769F595E2C9A15072E3C6B9C4818770

Function 000001C67380460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C6738046A9

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

malloc.LIBCMT ref: 000001C6738046B3

Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F318
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F31D

malloc.LIBCMT ref: 000001C6738046BE
free.LIBCMT ref: 000001C67380487E
free.LIBCMT ref: 000001C673804886
free.LIBCMT ref: 000001C67380488E

Part of subcall function 000001C6738054F0: malloc.LIBCMT ref: 000001C67380553A
Part of subcall function 000001C6738054F0: malloc.LIBCMT ref: 000001C673805545
Part of subcall function 000001C6738054F0: free.LIBCMT ref: 000001C67380562C
Part of subcall function 000001C6738054F0: free.LIBCMT ref: 000001C673805634

free.LIBCMT ref: 000001C67380489A
free.LIBCMT ref: 000001C6738048A7
free.LIBCMT ref: 000001C6738048B4

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction ID: 6638a1747a9ec8a391c9f571914190b96ee7b9aec3bd9f79c3d38535fc986437
Opcode Fuzzy Hash: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction Fuzzy Hash: 3A91CC303A9B5D4BF759AB6C9452BF973D1E785B08F540A7DD48AC3283DE30DC028686

Function 000001C672013A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C672013AA9

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

malloc.LIBCMT ref: 000001C672013AB3

Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E718
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E71D

malloc.LIBCMT ref: 000001C672013ABE
free.LIBCMT ref: 000001C672013C7E
free.LIBCMT ref: 000001C672013C86
free.LIBCMT ref: 000001C672013C8E

Part of subcall function 000001C6720148F0: malloc.LIBCMT ref: 000001C67201493A
Part of subcall function 000001C6720148F0: malloc.LIBCMT ref: 000001C672014945
Part of subcall function 000001C6720148F0: free.LIBCMT ref: 000001C672014A2C
Part of subcall function 000001C6720148F0: free.LIBCMT ref: 000001C672014A34

free.LIBCMT ref: 000001C672013C9A
free.LIBCMT ref: 000001C672013CA7
free.LIBCMT ref: 000001C672013CB4

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction ID: 898169df8acf49d62cedff84d50aa238ba2f084d6b46769a5e99588c5e15ee60
Opcode Fuzzy Hash: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction Fuzzy Hash: 5B71C0723847C4C6FA24EB269448FEE7791B795BCCF4448259E4A47B86DA38D486CB20

Function 000001C67381FE10 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67381FE36

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67381FE42
__crtIsPackagedApp.LIBCMT ref: 000001C67381FE53
_dosmaperr.LIBCMT ref: 000001C67381FE9D

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction ID: 3085a2e4b8c9f1c9578a8498064ea7e49ed29b401ab23d57b6565954fe14e550
Opcode Fuzzy Hash: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction Fuzzy Hash: 9731F930654B098FFB54EF789847BA976D1FF88718F144A7DA45AC72E2D738C8418742

Function 000001C67382A73C Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67382A755

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

__lock_fhandle.LIBCMT ref: 000001C67382A79D
__doserrno.LIBCMT ref: 000001C67382A7D2
_errno.LIBCMT ref: 000001C67382A7D9
_unlock_fhandle.LIBCMT ref: 000001C67382A7E9

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction ID: d2489e1e66ac49009219d705f944fbd3d69b5a19b7f38eff36b6676d9b8cb2b3
Opcode Fuzzy Hash: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction Fuzzy Hash: F021F530688B048EF315EB689A93BED76E0EF41728F55093CE5568B2D2DA7CDC408395

Function 000001C67202F210 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67202F236

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67202F242
__crtIsPackagedApp.LIBCMT ref: 000001C67202F253
_dosmaperr.LIBCMT ref: 000001C67202F29D

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction ID: f3c096c313ca44a26323192d951212c9f21fd50667dcae2ea4a9f7e2514e8afa
Opcode Fuzzy Hash: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction Fuzzy Hash: A331B475280B40C6FB209B76980DB99B7E5BB8ABD8F144A299A45477D6DF3CC4048760

Function 000001C67203EFD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001C67203F004

Part of subcall function 000001C672030A00: _getptd.LIBCMT ref: 000001C672030A16
Part of subcall function 000001C672030A00: __updatetlocinfo.LIBCMT ref: 000001C672030A4B
Part of subcall function 000001C672030A00: __updatetmbcinfo.LIBCMT ref: 000001C672030A72

_errno.LIBCMT ref: 000001C67203F01F
_invalid_parameter_noinfo.LIBCMT ref: 000001C67203F02A

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction ID: e5780f36e97c603c8b49517d9d2053209c5e91df0a22a55f2fb08947ddb869b8
Opcode Fuzzy Hash: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction Fuzzy Hash: 60318E72244784C9FB209B25944CFDDB7A4F798BE8F588529EE5847B87CB74C841C720

Function 000001C673820B10 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C673820B4C

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001C673820B57
memcpy_s.LIBCMT ref: 000001C673820C1C
_fileno.LIBCMT ref: 000001C673820C87
_filbuf.LIBCMT ref: 000001C673820CB5
_errno.LIBCMT ref: 000001C673820D05

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: ec24cfe3d9f916f1db7bdfcf72ee5e937ac6d674bce2b84805c0a4ed9b343268
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: DC61D870298F094AF77CD72C5957AB9B2C1E794B29F240B3EE466C32D6DA70D85241C3

Function 000001C67202FF10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67202FF4C

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67202FF57
memcpy_s.LIBCMT ref: 000001C67203001C
_fileno.LIBCMT ref: 000001C672030087
_filbuf.LIBCMT ref: 000001C6720300B5
_errno.LIBCMT ref: 000001C672030105

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction ID: de21e13997287fb5f35f8a893f6ecde076112ec659db8cc3db3ba57e53d015c6
Opcode Fuzzy Hash: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction Fuzzy Hash: 6B51F271785340C6FA68CA365508FEAB7D1F745BFCF144E1AAA3943BD6CB34C4918660

Function 000001C67382FBD0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 000001C673821600: _getptd.LIBCMT ref: 000001C673821616
Part of subcall function 000001C673821600: __updatetlocinfo.LIBCMT ref: 000001C67382164B
Part of subcall function 000001C673821600: __updatetmbcinfo.LIBCMT ref: 000001C673821672

_errno.LIBCMT ref: 000001C67382FC1F
_invalid_parameter_noinfo.LIBCMT ref: 000001C67382FC2A

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: __updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808835054-0
Opcode ID: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction ID: 104517ad97da2bb9845ab5ad8176797f95eebe032492df7bedc41861dfd1905e
Opcode Fuzzy Hash: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction Fuzzy Hash: C031A170258B188FF794DF189186BAA72D0FB98714F500ABDE859C72D6CB70DC40C781

Function 000001C673820620 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C673820577

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001C673820582
_getstream.LIBCMT ref: 000001C6738205A2
_errno.LIBCMT ref: 000001C6738205B4
_errno.LIBCMT ref: 000001C6738205C6
_openfile.LIBCMT ref: 000001C6738205F4

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction ID: f08e367525f6ab8f5c8977abd8d5774556bdba585a27a18124e972cf9ccafc72
Opcode Fuzzy Hash: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction Fuzzy Hash: 0D21F5B0688B498FF790EB284A07BED72D1FB99718F140D7AA459D32A2DB74CC404382

Function 000001C67202FA20 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67202F977

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67202F982
_getstream.LIBCMT ref: 000001C67202F9A2
_errno.LIBCMT ref: 000001C67202F9B4
_errno.LIBCMT ref: 000001C67202F9C6
_openfile.LIBCMT ref: 000001C67202F9F4

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction ID: fe8b5c44e9eadc00c9f3170f3000ca4bd2392d71601a5adadbbefafbcf285695
Opcode Fuzzy Hash: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction Fuzzy Hash: CE21C3B1254786D9FB219B32A80DFDEB7D0B749BC8F445C269A48A7B96DB3CC4408720

Function 000001C672039B3C Relevance: 9.1, APIs: 6, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C672039B55

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

__lock_fhandle.LIBCMT ref: 000001C672039B9D
__doserrno.LIBCMT ref: 000001C672039BD2
_errno.LIBCMT ref: 000001C672039BD9

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2102446242-0
Opcode ID: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction ID: 12943aa4fd3ac99ae6ab8035fe27d2eb037efc09dbf32865ba8cb995a5221e23
Opcode Fuzzy Hash: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction Fuzzy Hash: 4421F031380788C1FB016F79999DFECB7A4BB80768F19592C9A16073D3CA78C9418334

Function 000001C67202E3EC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67202E40F

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

malloc.LIBCMT ref: 000001C67202E41D

Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E718
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E71D

malloc.LIBCMT ref: 000001C67202E43F
_snprintf.LIBCMT ref: 000001C67202E45A

Part of subcall function 000001C67202EA3C: _errno.LIBCMT ref: 000001C67202EA73
Part of subcall function 000001C67202EA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001C67202EA7E

malloc.LIBCMT ref: 000001C67202E475

Strings

dpoolWait, xrefs: 000001C67202E444

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID: dpoolWait
API String ID: 2026495703-1875951006
Opcode ID: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction ID: 5d85ab77f1d8892600feea268eef66c8ccd47f304e93e56b3d7a42d720017d18
Opcode Fuzzy Hash: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction Fuzzy Hash: 1701C0B1740BD081FA04DB12B808B9977D9F799FE4F05862AEFA947BC6CE38D0418780

Function 000001C6738131F4 Relevance: 9.0, APIs: 7, Instructions: 264stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000001C67381322E
strchr.LIBCMT ref: 000001C67381324C
malloc.LIBCMT ref: 000001C673813264
malloc.LIBCMT ref: 000001C673813271
rand.LIBCMT ref: 000001C67381333D
free.LIBCMT ref: 000001C67381345B
free.LIBCMT ref: 000001C673813463

Part of subcall function 000001C67381F244: _errno.LIBCMT ref: 000001C67381F264

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$_errnorand
String ID:
API String ID: 2126518082-0
Opcode ID: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction ID: d1b1e70d1f4821ef08af4950b00c485b768a55b5d6a145cc54a8e9b63eac0372
Opcode Fuzzy Hash: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction Fuzzy Hash: 4581D330258F884AF7AAAB2C9402BF6B3D1FF9970DF040A7DD599C7192DA35C9468741

Function 000001C6720225F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000001C67202262E
strchr.LIBCMT ref: 000001C67202264C
malloc.LIBCMT ref: 000001C672022664
malloc.LIBCMT ref: 000001C672022671
rand.LIBCMT ref: 000001C67202273D
free.LIBCMT ref: 000001C67202285B
free.LIBCMT ref: 000001C672022863

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction ID: 6644171f3e4bb8f6347dc02b95a723ace30dd84d7800c7510b9784475bdaca66
Opcode Fuzzy Hash: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction Fuzzy Hash: 3E712AB1648BC4C6FB25DB79A4187EAB3D0EF95B88F084512DF8917B96DE3CD1428720

Function 000001C673804170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C6738041BD

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

malloc.LIBCMT ref: 000001C6738041C8

Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F318
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F31D

free.LIBCMT ref: 000001C6738042AF
free.LIBCMT ref: 000001C6738042B7
free.LIBCMT ref: 000001C6738042BF
free.LIBCMT ref: 000001C6738042CB
free.LIBCMT ref: 000001C6738042D8

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction ID: 1dea372f4b46b55c71c0c22dd8583aa0e6ab802d5deb621664e998a1fb0da9e9
Opcode Fuzzy Hash: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction Fuzzy Hash: D251C5347A9F194BF759AB389442AB973D0FB49708F50067DD94AC3287EB70E8128A85

Function 000001C672013570 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C6720135BD

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

malloc.LIBCMT ref: 000001C6720135C8

Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E718
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E71D

free.LIBCMT ref: 000001C6720136AF
free.LIBCMT ref: 000001C6720136B7
free.LIBCMT ref: 000001C6720136BF
free.LIBCMT ref: 000001C6720136CB
free.LIBCMT ref: 000001C6720136D8

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction ID: d819a1967b5f597cab70371475bd499c305fd7bcf1bc4d1afdd5e22cde10d53a
Opcode Fuzzy Hash: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction Fuzzy Hash: 2C41CF31380791DBFB24DB26955CA9D3790B709BCCF448821DE4647B42DF38D4A2C710

Function 000001C67202B630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 000001C67202B654

Part of subcall function 000001C67202F84C: _getptd.LIBCMT ref: 000001C67202F854

malloc.LIBCMT ref: 000001C67202B69C
strtok.LIBCMT ref: 000001C67202B700
strtok.LIBCMT ref: 000001C67202B711

Strings

eThreadpoolTimer, xrefs: 000001C67202B6DA

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: strtok$_getptd_time64malloc
String ID: eThreadpoolTimer
API String ID: 1522986614-2707337283
Opcode ID: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction ID: 6be5fea4a54f6d4c09180a7f81997f2b8a360ee32c373f6361897dac90c64e74
Opcode Fuzzy Hash: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction Fuzzy Hash: B021B1B2690B94C5FB00DF12A08CAE977E8F799BD8F164A16EF5A43782CA34C4418790

Function 000001C67201BE74 Relevance: 7.8, APIs: 6, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001C6720253EC: malloc.LIBCMT ref: 000001C672025408

malloc.LIBCMT ref: 000001C67201BF3B

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

Part of subcall function 000001C67202B630: _time64.LIBCMT ref: 000001C67202B654
Part of subcall function 000001C67202B630: malloc.LIBCMT ref: 000001C67202B69C
Part of subcall function 000001C67202B630: strtok.LIBCMT ref: 000001C67202B700
Part of subcall function 000001C67202B630: strtok.LIBCMT ref: 000001C67202B711

Part of subcall function 000001C6720228A0: _time64.LIBCMT ref: 000001C6720228AE

Part of subcall function 000001C67202DEA8: malloc.LIBCMT ref: 000001C67202DEF8

Part of subcall function 000001C67202DEA8: realloc.LIBCMT ref: 000001C67202DF07

malloc.LIBCMT ref: 000001C67201C04A
_snprintf.LIBCMT ref: 000001C67201C0C1
_snprintf.LIBCMT ref: 000001C67201C0E7
_snprintf.LIBCMT ref: 000001C67201C10E
free.LIBCMT ref: 000001C67201C2C6

Part of subcall function 000001C67202A144: malloc.LIBCMT ref: 000001C67202A178
Part of subcall function 000001C67202A144: free.LIBCMT ref: 000001C67202A32F

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freestrtok$_callnewhrealloc
String ID:
API String ID: 1314452303-0
Opcode ID: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction ID: 6ab14133f912b0f8463b6525eb20dacde69c2f8158ca8bc45d07ddb0a99c4cb7
Opcode Fuzzy Hash: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction Fuzzy Hash: F1C1AEB1680381C2FB18EB62945DFED73D5AB85B9CF405C26AE05477C7DE38C8868761

Function 000001C673811694 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000001C673815FEC: malloc.LIBCMT ref: 000001C673816008

Part of subcall function 000001C673820620: _errno.LIBCMT ref: 000001C673820577
Part of subcall function 000001C673820620: _invalid_parameter_noinfo.LIBCMT ref: 000001C673820582

fseek.LIBCMT ref: 000001C673811730

Part of subcall function 000001C673820EA4: _errno.LIBCMT ref: 000001C673820ECC
Part of subcall function 000001C673820EA4: _invalid_parameter_noinfo.LIBCMT ref: 000001C673820ED7

_ftelli64.LIBCMT ref: 000001C673811738

Part of subcall function 000001C673820F18: _errno.LIBCMT ref: 000001C673820F36
Part of subcall function 000001C673820F18: _invalid_parameter_noinfo.LIBCMT ref: 000001C673820F41

fseek.LIBCMT ref: 000001C673811748

Part of subcall function 000001C673820EA4: _fseek_nolock.LIBCMT ref: 000001C673820EF5

malloc.LIBCMT ref: 000001C673811788

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

fclose.LIBCMT ref: 000001C673811845

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction ID: 0e61df58a15c243aa391ce69be34af2c67aabc4bedd4e226de560cb16eb6c9f2
Opcode Fuzzy Hash: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction Fuzzy Hash: 5351C371668B084FF749EB289456BF972D1FB88704F504A7EE49BC32D7DE34D9028681

Function 000001C67382A348 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001C67382A375

Part of subcall function 000001C673823E58: _FF_MSGBANNER.LIBCMT ref: 000001C673823E75
Part of subcall function 000001C673823E58: _NMSG_WRITE.LIBCMT ref: 000001C673823E7F

_lock.LIBCMT ref: 000001C67382A388
_lock.LIBCMT ref: 000001C67382A3E3
_calloc_crt.LIBCMT ref: 000001C67382A49A

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction ID: f5a2490f9abeee9a6faf702810717822b5383c56ea13eb192a2ad119e03284be
Opcode Fuzzy Hash: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction Fuzzy Hash: B8511770558B088FF754DF18C987BA5B3D0FF54724F110A6DD84ACB1A2DA78D9428B82

Function 000001C6738054F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67380553A

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

malloc.LIBCMT ref: 000001C673805545

Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F318
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F31D

free.LIBCMT ref: 000001C67380562C
free.LIBCMT ref: 000001C673805634
free.LIBCMT ref: 000001C673805640
free.LIBCMT ref: 000001C67380564D

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction ID: 87eac98674d6b4252df27a75f1602828714c2428c65c58a6c06f8861cfd35ca8
Opcode Fuzzy Hash: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction Fuzzy Hash: 2041F5702ADB0D0BF7689B688842ABA73D5EB96758F14463DD897C3293ED30D80787D1

Function 000001C67382239C Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001C6738223B9

Part of subcall function 000001C673825A54: _errno.LIBCMT ref: 000001C673825A5D
Part of subcall function 000001C673825A54: _invalid_parameter_noinfo.LIBCMT ref: 000001C673825A68

_errno.LIBCMT ref: 000001C6738223C9

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

_errno.LIBCMT ref: 000001C6738223E5
_isatty.LIBCMT ref: 000001C673822446
_getbuf.LIBCMT ref: 000001C673822452

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction ID: 184c61eac3468248e53a33f6709768305b470c729e46c549d84fbf15bed4eae5
Opcode Fuzzy Hash: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction Fuzzy Hash: FB51C030154B0C8FFBA8EF28C583BA576D0FB48B14F540A69D856CB2D6D774C981C780

Function 000001C673819220 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67381924F

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

_snprintf.LIBCMT ref: 000001C673819267

Part of subcall function 000001C67381F63C: _errno.LIBCMT ref: 000001C67381F673
Part of subcall function 000001C67381F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001C67381F67E

free.LIBCMT ref: 000001C67381927E

Part of subcall function 000001C67381F244: _errno.LIBCMT ref: 000001C67381F264

malloc.LIBCMT ref: 000001C6738192CE
_snprintf.LIBCMT ref: 000001C6738192E6
free.LIBCMT ref: 000001C67381930E

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction ID: 84310503da880e640f096c3a05b463d1d5a2156249651dc926b7e643a1420a58
Opcode Fuzzy Hash: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction Fuzzy Hash: 7241A03034CA480FF698AB7C6412BF4B7D2E789714F545AADE0AEC3296DA34DC4287C1

Function 000001C672020A94 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 000001C6720253EC: malloc.LIBCMT ref: 000001C672025408

Part of subcall function 000001C67202FA20: _errno.LIBCMT ref: 000001C67202F977
Part of subcall function 000001C67202FA20: _invalid_parameter_noinfo.LIBCMT ref: 000001C67202F982

fseek.LIBCMT ref: 000001C672020B30

Part of subcall function 000001C6720302A4: _errno.LIBCMT ref: 000001C6720302CC
Part of subcall function 000001C6720302A4: _invalid_parameter_noinfo.LIBCMT ref: 000001C6720302D7

_ftelli64.LIBCMT ref: 000001C672020B38

Part of subcall function 000001C672030318: _errno.LIBCMT ref: 000001C672030336
Part of subcall function 000001C672030318: _invalid_parameter_noinfo.LIBCMT ref: 000001C672030341

fseek.LIBCMT ref: 000001C672020B48

Part of subcall function 000001C6720302A4: _fseek_nolock.LIBCMT ref: 000001C6720302F5

malloc.LIBCMT ref: 000001C672020B88

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

Part of subcall function 000001C67201C444: malloc.LIBCMT ref: 000001C67201C457

fclose.LIBCMT ref: 000001C672020C45

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 1756087678-0
Opcode ID: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction ID: 2f78d4aac7206cceddd0af7a5078e66d9b5dee84057af4185a20fc2b24fc97b8
Opcode Fuzzy Hash: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction Fuzzy Hash: 7841EF71344780C2FA14EB12A45DBEEB792F7C8BD8F908922AE5A07BD6DE3CC5458710

Function 000001C67202FA2C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67202FA64

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67202FA6F
_flush.LIBCMT ref: 000001C67202FB21
_fileno.LIBCMT ref: 000001C67202FB42
_flsbuf.LIBCMT ref: 000001C67202FB85

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction ID: 5a777a2e9f8d1f8e6b7f3ab40369099c0869cec5d9935925ce6366e4b4294dcf
Opcode Fuzzy Hash: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction Fuzzy Hash: 564104B1380340CEFA69DE22565CFDEB7E1B744FECF188A269E5547BE2D678C4418210

Function 000001C6720148F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67201493A

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

malloc.LIBCMT ref: 000001C672014945

Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E718
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E71D

free.LIBCMT ref: 000001C672014A2C
free.LIBCMT ref: 000001C672014A34
free.LIBCMT ref: 000001C672014A40
free.LIBCMT ref: 000001C672014A4D

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction ID: 8448d4255d9dd02e3b4cf935171c0e4d1acb3f64dd09504d4224dc55a37caf3a
Opcode Fuzzy Hash: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction Fuzzy Hash: 9F41F3323943C5C6FA15DB26540CE9D7B98B755BCCF8A4420DD158BB92FE38C886C324

Function 000001C67380FC64 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67380FC85

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

free.LIBCMT ref: 000001C67380FCC0
fwrite.LIBCMT ref: 000001C67380FD01
fclose.LIBCMT ref: 000001C67380FD09
free.LIBCMT ref: 000001C67380FD16

Part of subcall function 000001C67381F244: _errno.LIBCMT ref: 000001C67381F264

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction ID: f5ad043ce193259b1353aecb758f881542886285aae4f0a430c87131e84e117d
Opcode Fuzzy Hash: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction Fuzzy Hash: 27219530269F084FF784F7288456BEEB2D1FB98B48F50497DA85AC32C6ED34D9018782

Function 000001C672028620 Relevance: 7.6, APIs: 6, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67202864F

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

_snprintf.LIBCMT ref: 000001C672028667

Part of subcall function 000001C67202EA3C: _errno.LIBCMT ref: 000001C67202EA73
Part of subcall function 000001C67202EA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001C67202EA7E

free.LIBCMT ref: 000001C67202867E

Part of subcall function 000001C67202E644: _errno.LIBCMT ref: 000001C67202E664

malloc.LIBCMT ref: 000001C6720286CE
_snprintf.LIBCMT ref: 000001C6720286E6
free.LIBCMT ref: 000001C67202870E

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction ID: 2c0f20e24981ec979c15ee7e57d404f5a76acdf6195234ea494c4b2eb4d02153
Opcode Fuzzy Hash: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction Fuzzy Hash: 9631E2B52803C1C5FA14DB22681CBE5BBA17356FD8F989852DEE507BD6CA38D4428330

Function 000001C67201F064 Relevance: 7.6, APIs: 5, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67201F085

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

free.LIBCMT ref: 000001C67201F0C0
fwrite.LIBCMT ref: 000001C67201F101
fclose.LIBCMT ref: 000001C67201F109
free.LIBCMT ref: 000001C67201F116

Part of subcall function 000001C67202E644: _errno.LIBCMT ref: 000001C67202E664

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction ID: c0e5d921b7ddc4f8d900c1a341aa620b86857227bd51b00d5685608d9bb1adb4
Opcode Fuzzy Hash: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction Fuzzy Hash: 5111A2B1384740C5FA10E612A01DBEEB3D1A795BECF444A22AF594BBCADE2CC5458750

Function 000001C67382A5EC Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67382A5FD

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

__doserrno.LIBCMT ref: 000001C67382A5F5

Part of subcall function 000001C673821CA8: _getptd_noexit.LIBCMT ref: 000001C673821CAC

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: 5d1f73e0a6905079ea920a99322df012ea7765ce81c7474af61f0ffb7129ef95
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: 6101D1301A4A088EF359EB24CA43BD83290FF11B3DFA00A75A0058F0E2EB3CC4418752

Function 000001C6720399EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C6720399FD

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

__doserrno.LIBCMT ref: 000001C6720399F5

Part of subcall function 000001C6720310A8: _getptd_noexit.LIBCMT ref: 000001C6720310AC

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction ID: c6dc3bc2ecefe0aba66c626c99db3afb2a74fc74d6177509511ce6081237b6fb
Opcode Fuzzy Hash: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction Fuzzy Hash: 4B018C72691B48C4FA052B34C899FECB391BB95B3AF929B09D629073D3CA78C5418670

Function 000001C67380EC04 Relevance: 6.5, APIs: 5, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001C67380ECD3
_snprintf.LIBCMT ref: 000001C67380ECFE
_snprintf.LIBCMT ref: 000001C67380ED1A
_snprintf.LIBCMT ref: 000001C67380EDCF
_snprintf.LIBCMT ref: 000001C67380EDE6

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 7fac5ef310983ba4f53aac5884ed2391e8feab2a8d6ddd4ae87e7c6c89e2fbf1
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: E3917131268B4C8FFB55EF18D886BEA73E5FB95708F00097AE45AC3192DB34E9458B41

Function 000001C67201E004 Relevance: 6.4, APIs: 5, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001C67201E0D3
_snprintf.LIBCMT ref: 000001C67201E0FE
_snprintf.LIBCMT ref: 000001C67201E11A
_snprintf.LIBCMT ref: 000001C67201E1CF
_snprintf.LIBCMT ref: 000001C67201E1E6

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 8f27c06f8dd5ba6085cd3e7d95ba04b15c58b126a570ac54139bae14c85eb08b
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: 91817C72680B84C6FB10DB61E888BED77A0F78978CF544926EA4D13B95DF38C985C760

Function 000001C67381EFEC Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67381F00F

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

malloc.LIBCMT ref: 000001C67381F01D

Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F318
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F31D

malloc.LIBCMT ref: 000001C67381F03F
_snprintf.LIBCMT ref: 000001C67381F05A

Part of subcall function 000001C67381F63C: _errno.LIBCMT ref: 000001C67381F673
Part of subcall function 000001C67381F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001C67381F67E

malloc.LIBCMT ref: 000001C67381F075

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction ID: a705e62a0ca2447cffc8b777e8e5e054f3c948b1354aa9831057dfc107aef4df
Opcode Fuzzy Hash: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction Fuzzy Hash: 7D11217061DF044FE7A8EB6CA446795B6D1E78C710F104A6EE19EC3396EA34DD4187C1

Function 000001C67382062C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C673820664

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67382066F
_flush.LIBCMT ref: 000001C673820721
_fileno.LIBCMT ref: 000001C673820742

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction ID: 02bae10bbcd151d1aca22f7762a48c1b0597ad00fef69e20c6a8a5b8bddf8727
Opcode Fuzzy Hash: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction Fuzzy Hash: 8E51F9B0648F094FF668DB6D5647BB571C0E798B14F240A3DD4AAC31E3EA71DC524583

Function 000001C67202B3C0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: be4af576e188637a556f4d7d46b6db65554ff36279c2cbf8235a513f0bbe64ae
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: A2614DB1681740C7FB14CB1AA58DFE837E5E758B9DF18492ADA054B7A1CB38C481CB70

Function 000001C6738010D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001C673801117
clock.LIBCMT ref: 000001C673801124
clock.LIBCMT ref: 000001C67380112D
clock.LIBCMT ref: 000001C67380113A

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: a5183d4017eed6df2d3a6d431eb6c7b14e50d62e153a48b3a50a7c0915c863f6
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 5521F63545D7080EF778AAD8D443AE6B6C0E785764F151A3EE8CA83142F961DC4282C6

Function 000001C6738200EC Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 000001C673820109

Part of subcall function 000001C673824540: _FindPESection.LIBCMT ref: 000001C673824569

_initp_misc_cfltcvt_tab.LIBCMT ref: 000001C67382011A
_initterm_e.LIBCMT ref: 000001C67382012D
_IsNonwritableInCurrentImage.LIBCMT ref: 000001C673820176

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 4030f444e10e83babf63ca456711778ffaca7bb986e35c3fe88b540d1c4421cc
Instruction ID: 86ed16ed81a34643fb68976ebd924133c90bf3e8f69212c0d20af52c2dcae2d0
Opcode Fuzzy Hash: 4030f444e10e83babf63ca456711778ffaca7bb986e35c3fe88b540d1c4421cc
Instruction Fuzzy Hash: 87117331190F098EFB4AEF60EFD6BE673A5EB54709F444D799412C70E1EE38CA448A51

Function 000001C6720104D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001C672010517
clock.LIBCMT ref: 000001C672010524
clock.LIBCMT ref: 000001C67201052D
clock.LIBCMT ref: 000001C67201053A

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: a51336e445ab640381215e042acb62c98f4d2cc876ed882d4bdffc56c062c413
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 59110632544784C5F7709EA6A884FAFB791FB8439CF290925EE8403246E974C8C18720

Function 000001C67203E9D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001C67203E9FC

Part of subcall function 000001C672030A00: _getptd.LIBCMT ref: 000001C672030A16
Part of subcall function 000001C672030A00: __updatetlocinfo.LIBCMT ref: 000001C672030A4B
Part of subcall function 000001C672030A00: __updatetmbcinfo.LIBCMT ref: 000001C672030A72

_errno.LIBCMT ref: 000001C67203EA08

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67203EA13
strchr.LIBCMT ref: 000001C67203EA29

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction ID: a5e17f801e54b0d8dc59c511aae39feabb477736e6ad1f25279959cb0f817f65
Opcode Fuzzy Hash: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction Fuzzy Hash: 9321F072648BE4C0FB609631D058FFDB790FB80BDDF1C4A29EA960AAC7C92CD5418720

Function 000001C6720213B0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C6720213D2

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

_snprintf.LIBCMT ref: 000001C6720213F1

Part of subcall function 000001C67202EA3C: _errno.LIBCMT ref: 000001C67202EA73
Part of subcall function 000001C67202EA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001C67202EA7E

remove.LIBCMT ref: 000001C6720213FD
remove.LIBCMT ref: 000001C672021404

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID:
API String ID: 2566950902-0
Opcode ID: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction ID: 8d17d06d3adab80caf51f41cf5782484c8ff470cd64be1c384b47a42b482d062
Opcode Fuzzy Hash: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction Fuzzy Hash: 48F09071685790CAF214DB12B809BDAB3A0F788BC4F584926AF8817B9BCE38C4418764

Function 000001C67381F860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67381F8B1

Part of subcall function 000001C673821D18: _getptd_noexit.LIBCMT ref: 000001C673821D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67381F8BC

Strings

B, xrefs: 000001C67381F8E8

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: 004d1f759937ba81268c4a227994fd4e9350722c6a8943b7a65e9bbb9a09e4da
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: F3119430668B084FE754EF5C9446BA9B7D1FB98728F6047AEA41DC32A1CB74C944C782

Function 000001C67202EC60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001C67202ECB1

Part of subcall function 000001C672031118: _getptd_noexit.LIBCMT ref: 000001C67203111C

_invalid_parameter_noinfo.LIBCMT ref: 000001C67202ECBC

Strings

B, xrefs: 000001C67202ECE8

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction ID: 86b84e8d6fc7c96ae36e10b2d7deb2e03fd7f79033392e21e40028a390c45209
Opcode Fuzzy Hash: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction Fuzzy Hash: 6511CEB2650B80C2FB10DB12D444BD9B7A0F798FE8F684726AB5807B96CF38C141CB10

Function 000001C6720110C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001C67201116A

Part of subcall function 000001C67203E208: _calloc_impl.LIBCMT ref: 000001C67203E218
Part of subcall function 000001C67203E208: _errno.LIBCMT ref: 000001C67203E22B
Part of subcall function 000001C67203E208: _errno.LIBCMT ref: 000001C67203E235

free.LIBCMT ref: 000001C6720112F3
free.LIBCMT ref: 000001C6720112FD
free.LIBCMT ref: 000001C67201130F

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction ID: 2f699c18b0d903e279f932a22e06564840ab5d55c6b33497214ead50b1295f90
Opcode Fuzzy Hash: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction Fuzzy Hash: 40C1FB36644B84CAE764CF65E48479EB7F4F788B88F10452AEB8D47B58DB38C495CB10

Function 000001C67381AD44 Relevance: 5.2, APIs: 4, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67381AD78

Part of subcall function 000001C67381F284: _FF_MSGBANNER.LIBCMT ref: 000001C67381F2B4
Part of subcall function 000001C67381F284: _NMSG_WRITE.LIBCMT ref: 000001C67381F2BE
Part of subcall function 000001C67381F284: _callnewh.LIBCMT ref: 000001C67381F2F2
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F2FD
Part of subcall function 000001C67381F284: _errno.LIBCMT ref: 000001C67381F308

free.LIBCMT ref: 000001C67381AEBF
free.LIBCMT ref: 000001C67381AF23
free.LIBCMT ref: 000001C67381AF2F

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction ID: 44d027afa844d74d20111935db1db62d4651489706386e1f3877752f8df38a96
Opcode Fuzzy Hash: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction Fuzzy Hash: BF61A470258B094BFB58EB28D492BF972D1EB94B18F100E3DE55AC7197EE38D9028681

Function 000001C673804300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C673804363

Memory Dump Source

Source File: 00000000.00000002.2712904057.000001C673800000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001C673800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c673800000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction ID: 1a7071969ccd1511ea3a2fc0c65053681adb8bb0ffee59a4f0692b9f0ea40527
Opcode Fuzzy Hash: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction Fuzzy Hash: 7751C870699F154BFB58DF2CD482AA973D1FB84704F54497DD85BC3297EA30DD028A81

Function 000001C67202A144 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C67202A178

Part of subcall function 000001C67202E684: _FF_MSGBANNER.LIBCMT ref: 000001C67202E6B4
Part of subcall function 000001C67202E684: _NMSG_WRITE.LIBCMT ref: 000001C67202E6BE
Part of subcall function 000001C67202E684: _callnewh.LIBCMT ref: 000001C67202E6F2
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E6FD
Part of subcall function 000001C67202E684: _errno.LIBCMT ref: 000001C67202E708

free.LIBCMT ref: 000001C67202A2BF
free.LIBCMT ref: 000001C67202A323
free.LIBCMT ref: 000001C67202A32F

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction ID: c3d84a3afe45e198909b15f8ea6e956889dd9bde16fcfe7b3021581b1ff20ee2
Opcode Fuzzy Hash: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction Fuzzy Hash: 3551BEB1280345C6FA18EB22A558FEDB3D1B780BE8F544C27AE0A17B96DF79C5518720

Function 000001C672013700 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001C672013763

Memory Dump Source

Source File: 00000000.00000002.2712869311.000001C672010000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001C672010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c672010000_mode11_qLf2.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction ID: 70d78e355b53b44b0c2c18422cbad22f8ec7737a8bb4e4c11e9565d09c2985db
Opcode Fuzzy Hash: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction Fuzzy Hash: D7417C72640780C7FB68DF26A418AAD77A1F744B8CF444825EE2A47B85EF34D885C710

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mode11_qLf2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
mode11_qLf2.exe

Function 000001C67380E68C Relevance: 10.8, APIs: 7, Instructions: 260
networkCOMMONLIBRARYCODE

Function 000001C673815E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Function 000001C67380CA74 Relevance: 7.9, APIs: 6, Instructions: 411
COMMONLIBRARYCODE

Function 000001C67380F014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Function 000001C67380EA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Function 000001C6720296B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Function 000001C672029324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Function 008BF220 Relevance: .1, Instructions: 57
COMMON

Function 008BB5C0 Relevance: .0, Instructions: 2
COMMON

Function 000001C672035914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE