Edit tour

Windows Analysis Report
mode11_UVo6.exe

Overview

General Information

Sample name:	mode11_UVo6.exe
Analysis ID:	1583722
MD5:	c5998338d72151c919124611f8cdff26
SHA1:	a2d50bf7f200a82ff142ab8f0092ec53e0a5b064
SHA256:	ef1967d9e33cbed9f12a504bdc642c9c12cfbac79a4421617f32e1aa2dc82c6f
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Performs DNS queries to domains with low reputation

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

IP address seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

mode11_UVo6.exe (PID: 5108 cmdline: "C:\Users\user\Desktop\mode11_UVo6.exe" MD5: C5998338D72151C919124611F8CDFF26)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 8443, "SleepTime": 12000, "MaxGetSize": 1403642, "Jitter": 60, "C2Server": "632313373.xyz,/js/jquery-3.3.1.min.js", "HttpPostUri": "/post", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 4016 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": "Host: 632313373.xyz\r\n"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30d60:$a39: %s as %s\%s: %d 0x401e2:$a41: beacon.x64.dll 0x31f70:$a46: %s (admin) 0x30ed8:$a48: %s%s: %s 0x30d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x30db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31fd9:$a51: Content-Length: %d
00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x32760:$a39: %s as %s\%s: %d 0x41be2:$a41: beacon.x64.dll 0x33970:$a46: %s (admin) 0x328d8:$a48: %s%s: %s 0x3278c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x327b8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x339d9:$a51: Content-Length: %d
00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1a4ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x1986e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000000.00000002.2682782635.000000C000088000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x54d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2682782635.000000C000088000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x5096a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x51c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x5ad60:$a39: %s as %s\%s: %d 0x90d60:$a39: %s as %s\%s: %d 0xd4d60:$a39: %s as %s\%s: %d 0xa01e2:$a41: beacon.x64.dll 0xe41e2:$a41: beacon.x64.dll 0x5bf70:$a46: %s (admin) 0x91f70:$a46: %s (admin) 0xd5f70:$a46: %s (admin) 0x5aed8:$a48: %s%s: %s 0x90ed8:$a48: %s%s: %s 0xd4ed8:$a48: %s%s: %s 0x5ad8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x5adb8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x90d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x90db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xd4d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xd4db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x5bfd9:$a51: Content-Length: %d 0x91fd9:$a51: Content-Length: %d 0xd5fd9:$a51: Content-Length: %d
00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x46d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x7cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0xc0d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x4296a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x43c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x7896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x79c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xbc96a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xbdc9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Process Memory Space: mode11_UVo6.exe PID: 5108	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_UVo6.exe PID: 5108	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_UVo6.exe PID: 5108	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: mode11_UVo6.exe PID: 5108	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x349319:$a39: %s as %s\%s: %d 0x770cac:$a39: %s as %s\%s: %d 0x7766ec:$a39: %s as %s\%s: %d 0x34d0d4:$a41: beacon.x64.dll 0x77485b:$a41: beacon.x64.dll 0x77a29b:$a41: beacon.x64.dll 0x34969f:$a46: %s (admin) 0x34971e:$a46: %s (admin) 0x771032:$a46: %s (admin) 0x7710b1:$a46: %s (admin) 0x776a72:$a46: %s (admin) 0x776af1:$a46: %s (admin) 0x349437:$a48: %s%s: %s 0x770dca:$a48: %s%s: %s 0x77680a:$a48: %s%s: %s 0x349333:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x34935c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x3494df:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x770cc6:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x770cef:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x770e72:$a50: %02d/%02d/%02d %02d:%02d:%02d
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.mode11_UVo6.exe.c000102000.3.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x4513c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_UVo6.exe.c000102000.3.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1909b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x40d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x4209b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_UVo6.exe.c000088000.2.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x4873c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30d60:$a39: %s as %s\%s: %d 0x401e2:$a41: beacon.x64.dll 0x31f70:$a46: %s (admin) 0x30ed8:$a48: %s%s: %s 0x30d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x30db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31fd9:$a51: Content-Length: %d
0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.mode11_UVo6.exe.c0000f0000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x2e13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_UVo6.exe.c0000f0000.1.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x29d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x2b09b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x4836a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x4969b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_UVo6.exe.2a062b10000.4.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.2a062b10000.4.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.2a062b10000.4.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.2a062b10000.4.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_UVo6.exe.2a062b10000.4.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1909b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_UVo6.exe.c000088000.2.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x54d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_UVo6.exe.c000088000.2.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x5096a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x51c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.mode11_UVo6.exe.c000102000.3.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.c000102000.3.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.c000102000.3.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.c000102000.3.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.mode11_UVo6.exe.c000102000.3.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x5ad60:$a39: %s as %s\%s: %d 0x90d60:$a39: %s as %s\%s: %d 0xd4d60:$a39: %s as %s\%s: %d 0xa01e2:$a41: beacon.x64.dll 0xe41e2:$a41: beacon.x64.dll 0x5bf70:$a46: %s (admin) 0x91f70:$a46: %s (admin) 0xd5f70:$a46: %s (admin) 0x5aed8:$a48: %s%s: %s 0x90ed8:$a48: %s%s: %s 0xd4ed8:$a48: %s%s: %s 0x5ad8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x5adb8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x90d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x90db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xd4d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xd4db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x5bfd9:$a51: Content-Length: %d 0x91fd9:$a51: Content-Length: %d 0xd5fd9:$a51: Content-Length: %d
0.2.mode11_UVo6.exe.c000102000.3.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x46d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x7cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0xc0d3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.mode11_UVo6.exe.c000102000.3.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x4296a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x43c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x7896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x79c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xbc96a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0xbdc9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Click to see the 22 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://632313373.xyz/a	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderP	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsW	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/0af=	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderK	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsV	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsH	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder=N&	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsF	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/soft	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/1N	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jseO	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsf=	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/phy	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsYN	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderyO	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js~	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsm	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderiO	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/eO	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/UN	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jst	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsyO	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/0hf=	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/eO	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js.5.7Y	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/AN	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js:	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsB	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder1N	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/9N	Avira URL Cloud: Label: malware
Source: https://632313373.xyz/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/i	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js1N	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js-N6	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js=N&	Avira URL Cloud: Label: malware
Source: 632313373.xyz	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/QN	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js%N	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/p	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/js/jquery-3.3.1.min.js.	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 8443, "SleepTime": 12000, "MaxGetSize": 1403642, "Jitter": 60, "C2Server": "632313373.xyz,/js/jquery-3.3.1.min.js", "HttpPostUri": "/post", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 4016 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": "Host: 632313373.xyz\r\n"}

Multi AV Scanner detection for submitted file

Source: mode11_UVo6.exe	Virustotal: Detection: 30%			Perma Link
Source: mode11_UVo6.exe	ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: mode11_UVo6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 632313373.xyz

Performs DNS queries to domains with low reputation

Source:

DNS query: 632313373.xyz

Source: global traffic

TCP traffic: 192.168.2.9:49707 -> 188.114.96.3:8443

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\mode11_UVo6.exe

Code function: 0_2_000002A062B7E68C _snprintf,_snprintf,_snprintf,InternetReadFile,InternetCloseHandle,

0_2_000002A062B7E68C

Source: global traffic

DNS traffic detected: DNS query: 632313373.xyz

Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1
Source: mode11_UVo6.exe, 00000000.00000003.1504619916.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D67F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: mode11_UVo6.exe, 00000000.00000003.1504619916.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523083868.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D67F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D616000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/PCUeQViQlYc.crl0
Source: mode11_UVo6.exe, 00000000.00000003.1504619916.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D67F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: mode11_UVo6.exe, 00000000.00000003.1504619916.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523083868.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D67F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D616000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt0
Source: mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D616000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/lk00%
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz/
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz/a
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/0af=
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/0hf=
Source: mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/1N
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/9N
Source: mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/QN
Source: mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/UN
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/eO
Source: mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/i
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js%N
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js-N6
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js.
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js.5.7Y
Source: mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js1N
Source: mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/AN
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/eO
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js:
Source: mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js=N&
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsB
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsF
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsH
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsV
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsW
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsYN
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder1N
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder=N&
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderK
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderP
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderiO
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderyO
Source: mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jseO
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsf=
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy
Source: mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsh
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsm
Source: mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jst
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.jsyO
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/js/jquery-3.3.1.min.js~
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/p
Source: mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/phy
Source: mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/soft
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/what?indextype=1&__cfduid=
Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/what?indextype=1&__cfduid=rwi0xpEmEo3vEBSra9Zfs7RkEWRNxbmYp9S5sk0XTxVkCLbB1Xp

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.mode11_UVo6.exe.c000102000.3.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_UVo6.exe.c000102000.3.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_UVo6.exe.c000088000.2.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.mode11_UVo6.exe.c0000f0000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_UVo6.exe.c0000f0000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_UVo6.exe.c000088000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_UVo6.exe.c000088000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.mode11_UVo6.exe.c000102000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.mode11_UVo6.exe.c000102000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.mode11_UVo6.exe.c000102000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.2682782635.000000C000088000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2682782635.000000C000088000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: Process Memory Space: mode11_UVo6.exe PID: 5108, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown

Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B31928	0_2_000002A062B31928
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B1916C	0_2_000002A062B1916C
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B35914	0_2_000002A062B35914
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B31264	0_2_000002A062B31264
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B26F38	0_2_000002A062B26F38
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B3B7B0	0_2_000002A062B3B7B0
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B3CFF0	0_2_000002A062B3CFF0
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B1CE3C	0_2_000002A062B1CE3C
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B19680	0_2_000002A062B19680
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B3C680	0_2_000002A062B3C680
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B2F5A8	0_2_000002A062B2F5A8
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B3E600	0_2_000002A062B3E600
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B20334	0_2_000002A062B20334
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B3C397	0_2_000002A062B3C397
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B3239C	0_2_000002A062B3239C
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B30374	0_2_000002A062B30374
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B3AAB0	0_2_000002A062B3AAB0
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B9D280	0_2_000002A062B9D280
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B901A8	0_2_000002A062B901A8
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B92F9C	0_2_000002A062B92F9C
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B92528	0_2_000002A062B92528
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B91E64	0_2_000002A062B91E64
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B87B38	0_2_000002A062B87B38
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B9DBF0	0_2_000002A062B9DBF0

Source: 0.2.mode11_UVo6.exe.c000102000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_UVo6.exe.c000102000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_UVo6.exe.c000088000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.mode11_UVo6.exe.c0000f0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_UVo6.exe.c0000f0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_UVo6.exe.2a062b10000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_UVo6.exe.c000088000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_UVo6.exe.c000088000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.mode11_UVo6.exe.c000102000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.mode11_UVo6.exe.c000102000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.mode11_UVo6.exe.c000102000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.2682782635.000000C000088000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2682782635.000000C000088000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: Process Memory Space: mode11_UVo6.exe PID: 5108, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.winEXE@2/0@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_03

Source: mode11_UVo6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mode11_UVo6.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mode11_UVo6.exe	Virustotal: Detection: 30%
Source: mode11_UVo6.exe	ReversingLabs: Detection: 26%

Source: mode11_UVo6.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoned" not supported for cpu option "MapIter.Value called before Nextuse of closed network connectioncrypto/aes: output not full blockCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyW142108547152020037174224853515625710542735760100185871124267578125too many levels of symbolic linksslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeGODEBUG: no value specified for "reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangewaiting for unsupported file typecrypto/aes: invalid buffer overlapillegal base64 data at input byte CM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModes3552713678800500929355621337890625too many references: cannot spliceslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeunexpected runtime.netpoll error: encoding/hex: odd length hex stringSubscribeServiceChangeNotifications1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9network dropped connection on resettransport endpoint is not connectedpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid
Source: mode11_UVo6.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoned" not supported for cpu option "MapIter.Value called before Nextuse of closed network connectioncrypto/aes: output not full blockCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyW142108547152020037174224853515625710542735760100185871124267578125too many levels of symbolic linksslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeGODEBUG: no value specified for "reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangewaiting for unsupported file typecrypto/aes: invalid buffer overlapillegal base64 data at input byte CM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModes3552713678800500929355621337890625too many references: cannot spliceslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeunexpected runtime.netpoll error: encoding/hex: odd length hex stringSubscribeServiceChangeNotifications1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9network dropped connection on resettransport endpoint is not connectedpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid
Source: mode11_UVo6.exe	String found in binary or memory: net/addrselect.go

Source: unknown	Process created: C:\Users\user\Desktop\mode11_UVo6.exe "C:\Users\user\Desktop\mode11_UVo6.exe"
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\mode11_UVo6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: mode11_UVo6.exe

Static file information: File size 3900416 > 1048576

Source: mode11_UVo6.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2dac00

Source: mode11_UVo6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: mode11_UVo6.exe	Static PE information: section name: .xdata
Source: mode11_UVo6.exe	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B4776C push 0000006Ah; retf	0_2_000002A062B47784
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B7C91C pushad ; retf	0_2_000002A062B7C91D
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B80901 push ebx; iretd	0_2_000002A062B80902
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B7A71E push cs; retf	0_2_000002A062B7A71F
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B9B84F push ebp; iretd	0_2_000002A062B9B850
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B9B898 push ebp; iretd	0_2_000002A062B9B899
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B9B86F push ebp; iretd	0_2_000002A062B9B870
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B7BD58 push ebp; iretd	0_2_000002A062B7BD59
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062B7A35D push edi; iretd	0_2_000002A062B7A35E
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Code function: 0_2_000002A062BA03FC push ebp; iretd	0_2_000002A062BA0401

Source: C:\Users\user\Desktop\mode11_UVo6.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\mode11_UVo6.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mode11_UVo6.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\mode11_UVo6.exe

Last function: Thread delayed

Source: mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\mode11_UVo6.exe

Code function: 0_2_000002A062B85E28 GetUserNameA,strrchr,_snprintf,

0_2_000002A062B85E28

Source: C:\Users\user\Desktop\mode11_UVo6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 0.2.mode11_UVo6.exe.2a062b10000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mode11_UVo6.exe.2a062b10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mode11_UVo6.exe.c000102000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mode11_UVo6.exe PID: 5108, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Obfuscated Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mode11_UVo6.exe	31%	Virustotal		Browse
mode11_UVo6.exe	26%	ReversingLabs	Win64.Adware.RedCap

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://632313373.xyz/a	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderP	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsW	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/0af=	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderK	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsV	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsH	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder=N&	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsF	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/soft	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/1N	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jseO	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsf=	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/phy	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsYN	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderyO	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js~	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsm	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderiO	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/eO	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/UN	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jst	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsyO	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/0hf=	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/eO	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js.5.7Y	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/AN	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js:	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsB	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder1N	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/9N	100%	Avira URL Cloud	malware
https://632313373.xyz/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/i	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js1N	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js-N6	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js=N&	100%	Avira URL Cloud	malware
632313373.xyz	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/QN	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js%N	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/p	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/js/jquery-3.3.1.min.js.	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
632313373.xyz	188.114.96.3	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
632313373.xyz	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://o.pki.goog/s/we1/lk00%	mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D616000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz/a	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsV	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsW	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderK	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderP	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder=N&	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/0af=	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsH	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsF	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/soft	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/1N	mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/what?indextype=1&__cfduid=	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.js	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jseO	mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderyO	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsf=	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/r4.crl0	mode11_UVo6.exe, 00000000.00000003.1504619916.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523083868.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D67F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsYN	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/phy	mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js~	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/r4.crt0	mode11_UVo6.exe, 00000000.00000003.1504619916.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523083868.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D67F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsm	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsh	mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsgraphy	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsderiO	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jst	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/eO	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/UN	mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/gsr1	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsyO	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/0hf=	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/we1.crt0	mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D616000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3011b87bd06	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/gsr1.crl0	mode11_UVo6.exe, 00000000.00000003.1504619916.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D67F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/	mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/eO	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js.5.7Y	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js3/AN	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder1N	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/9N	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js:	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/we1/PCUeQViQlYc.crl0	mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D616000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i.pki.goog/gsr1.crt0-	mode11_UVo6.exe, 00000000.00000003.1504619916.000002A03D693000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659960473.000002A03D695000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1694165216.000002A03D698000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2224039979.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D67F000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D643000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D6A1000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D692000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.2207025405.000002A03D692000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsB	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz/	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D625000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D61F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/i	mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.jsder	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1503122551.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js1N	mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js-N6	mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1523031283.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js=N&	mode11_UVo6.exe, 00000000.00000003.1694069968.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js%N	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/QN	mode11_UVo6.exe, 00000000.00000003.1659387521.000002A03D687000.00000004.00000020.00020000.00000000.sdmp, mode11_UVo6.exe, 00000000.00000003.1540845558.000002A03D687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/js/jquery-3.3.1.min.js.	mode11_UVo6.exe, 00000000.00000002.2684085306.000002A03D5BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/p	mode11_UVo6.exe, 00000000.00000003.1659976583.000002A03D65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	632313373.xyz	European Union		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583722
Start date and time:	2025-01-03 13:04:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mode11_UVo6.exe
Detection:	MAL
Classification:	mal100.troj.winEXE@2/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:05:25	API Interceptor	72x Sleep call for process: mode11_UVo6.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
632313373.xyz	m.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
632313373.xyz	svchostinter.exe	Get hash	malicious	CobaltStrike	Browse	172.67.175.230

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://t1.awagama2.org	Get hash	malicious	Unknown	Browse	188.114.96.3
	m.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
	http://www.escudier-sas.fr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.18.11.207
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	http://www.technoafriwave.rw	Get hash	malicious	Unknown	Browse	1.1.1.1
	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.667911696458422
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mode11_UVo6.exe
File size:	3'900'416 bytes
MD5:	c5998338d72151c919124611f8cdff26
SHA1:	a2d50bf7f200a82ff142ab8f0092ec53e0a5b064
SHA256:	ef1967d9e33cbed9f12a504bdc642c9c12cfbac79a4421617f32e1aa2dc82c6f
SHA512:	c417722c8581b080ef43128a01a2123f645a09b8bedf84c255e31adee1633794dcd15f5efa62d505e5f32d973d58978869f503de88d38df3c985782c9f70c5e5
SSDEEP:	49152:+NRXQ7qCnFXnjjC4mkZMyITWt1U4yP21Qsq8VT/0+2Tw2:+kDN
TLSH:	6D06CF0B7CE118B5C0AD92328A76A5567A71BC440F3267DB3E80B37C2F76BD49A36744
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........;......."..........n................@..............................`@...........`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46ec80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	d42595b695fc008ef2c56aabd8efd68e

Entrypoint Preview

Instruction
jmp 00007F581C527DD0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [003857B2h]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007F581C52B675h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007F581C535C4Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ff000	0x53e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3f8000	0x5370	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x400000	0x4998	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x398140	0x178	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbbbfc	0xbbc00	1a97391c0cd82935c171ecdf6508c540	False	0.4750762004826897	data	6.265474720869454	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xbd000	0x2daa60	0x2dac00	416a06f6e21ea23d71d9f391279e8de7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x398000	0x5fde0	0x16e00	3c71d2db7ad8c69275c86fac5c3c336d	False	0.28516692281420764	data	3.1982752260554626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3f8000	0x5370	0x5400	fc3b99f47d06069d9ec70b0231e784c4	False	0.4015997023809524	data	5.217699495435684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x3fe000	0xb4	0x200	d5a432b15ea1de5871ba1b040f244088	False	0.228515625	shared library	1.787112262798912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x3ff000	0x53e	0x600	947ae433b372351ebe424ca890a488f2	False	0.3776041666666667	OpenPGP Public Key	4.017189066074398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x400000	0x4998	0x4a00	46f2016ce2e595f91dd55afddd06a0e6	False	0.31228885135135137	data	5.410806733395624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x405000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 13:05:25.085664034 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:25.090483904 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:25.090567112 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:25.120198011 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:25.125128984 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:25.545847893 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:25.545908928 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:25.545921087 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:25.545945883 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:25.545967102 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:25.577289104 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:25.582143068 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:25.672636032 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:25.672738075 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:25.683784008 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:25.688564062 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:26.792293072 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:26.792320967 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:26.792334080 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:26.792346001 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:26.792357922 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:26.792368889 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:26.792370081 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:26.792407036 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:26.792452097 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:26.902800083 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:26.907722950 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:26.907816887 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:26.908128977 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:26.912854910 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:27.355401993 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:27.355509043 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:27.356131077 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:27.357131958 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:27.360913038 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:27.361989975 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.457730055 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.457746029 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.457763910 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.457776070 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.457787037 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.457799911 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.457812071 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.457814932 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:28.457843065 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:28.457889080 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:28.574501038 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:28.575093985 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:28.579595089 CET	8443	49707	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.579657078 CET	49707	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:28.579930067 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:28.580009937 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:28.580429077 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:28.585273027 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:29.048839092 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:29.048908949 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:29.069112062 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:29.073965073 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:29.087282896 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:29.092127085 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.177560091 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.177580118 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.177592039 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.177602053 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.177613974 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.177624941 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.177638054 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.177659988 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.177715063 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.293148994 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.293631077 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.298403025 CET	8443	49708	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.298481941 CET	49708	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.298696041 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.298758984 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.298933029 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.304055929 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.756522894 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.756712914 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.757427931 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.758568048 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:30.762196064 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:30.763433933 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:31.826380014 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:31.826419115 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:31.826430082 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:31.826441050 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:31.826452971 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:31.826456070 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:31.826466084 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:31.826493979 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:31.826518059 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.001838923 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.007088900 CET	8443	49709	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:32.007147074 CET	49709	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.159271955 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.164268017 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:32.164355040 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.164668083 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.169487953 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:32.713227034 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:32.713352919 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.714103937 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.715415955 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:32.718900919 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:32.720179081 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:33.884922028 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:33.884952068 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:33.884969950 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:33.884982109 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:33.884994984 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:33.885008097 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:33.885036945 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:33.885067940 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:33.885112047 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:33.996335030 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:34.005106926 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:34.100733042 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:34.100744963 CET	8443	49710	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:34.100820065 CET	49710	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:34.100837946 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:34.101303101 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:34.106064081 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:34.563702106 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:34.563791990 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:34.564106941 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:34.565047026 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:34.568888903 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:34.569866896 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.669317007 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.669377089 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.669384003 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.669389963 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.669390917 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:35.669397116 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.669411898 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.669430017 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:35.669478893 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:35.777689934 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:35.782740116 CET	8443	49711	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.782814980 CET	49711	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:35.794120073 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:35.798916101 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:35.798986912 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:35.799220085 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:35.803989887 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:36.248924017 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:36.249044895 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:36.249561071 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:36.250657082 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:36.254384041 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:36.255495071 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.347407103 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.347424030 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.347435951 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.347454071 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.347465992 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.347479105 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.347487926 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.347511053 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.347564936 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.449388981 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.449886084 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.454401970 CET	8443	49712	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.454469919 CET	49712	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.454663992 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.454734087 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.455015898 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.459794044 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.936852932 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.936928988 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.937622070 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.938668013 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:37.942482948 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:37.943494081 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.091186047 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.091200113 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.091212034 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.091269016 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.091280937 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.091293097 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.091295958 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.091345072 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.091362000 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.199585915 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.200071096 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.204577923 CET	8443	49713	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.204647064 CET	49713	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.204889059 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.204958916 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.205199003 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.209969997 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.654906034 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.655013084 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.655404091 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.656476021 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:39.662157059 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:39.663749933 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.754925013 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.754946947 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.754957914 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.754997969 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.755009890 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.755021095 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.755022049 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.755033970 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.755080938 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.755080938 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.781275988 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.781352043 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.856307983 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.856777906 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.861660004 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.861747026 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.862020969 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.864885092 CET	8443	49714	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:40.864940882 CET	49714	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:40.866780043 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:41.317743063 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:41.317801952 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:41.318279028 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:41.319199085 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:41.323029995 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:41.323987961 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.425103903 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.425117016 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.425128937 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.425138950 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.425158978 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.425168991 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.425177097 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.425230980 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.425230980 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.528217077 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.528753042 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.533364058 CET	8443	49716	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.533479929 CET	49716	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.533552885 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.533620119 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.533855915 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.538677931 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.998394012 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:42.998450041 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:42.999202013 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:43.000339031 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:43.003973961 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:43.005086899 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.101824045 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.101891994 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.101905107 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.101917982 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.101932049 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.101943016 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.102027893 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.102027893 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.215627909 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.216290951 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.220634937 CET	8443	49719	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.221090078 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.222539902 CET	49719	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.222564936 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.222819090 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.227680922 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.679651976 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.679717064 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.686528921 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.691304922 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:44.706487894 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:44.712742090 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.814846992 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.814862013 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.814873934 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.814896107 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.814908981 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.814923048 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.814929008 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:45.814941883 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.814954042 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:45.814987898 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:45.928637981 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:45.929653883 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:45.933578014 CET	8443	49720	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.933641911 CET	49720	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:45.934448957 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:45.934608936 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:45.934720039 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:45.939470053 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:46.401608944 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:46.401731014 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:46.402301073 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:46.403379917 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:46.407103062 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:46.408222914 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.485379934 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.485394955 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.485407114 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.485482931 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.485496044 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.485503912 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:47.485508919 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.485519886 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.485548973 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:47.485585928 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:47.632167101 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:47.637064934 CET	8443	49721	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.637135983 CET	49721	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:47.701922894 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:47.706741095 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:47.706823111 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:47.707906008 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:47.712656021 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:48.163531065 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:48.163590908 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:48.164587975 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:48.169378042 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:48.173953056 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:48.178769112 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.269663095 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.269699097 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.269718885 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.269737005 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.269748926 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.269761086 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.269776106 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.269823074 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.269823074 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.269869089 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.381763935 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.382227898 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.386769056 CET	8443	49722	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.386841059 CET	49722	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.387058973 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.387131929 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.387545109 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.392299891 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.865510941 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.865812063 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.866405964 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.867373943 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:49.871165037 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:49.872138023 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:50.991085052 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:50.991101027 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:50.991111994 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:50.991122961 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:50.991134882 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:50.991134882 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:50.991148949 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:50.991162062 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:50.991164923 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:50.991197109 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.100423098 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.105458021 CET	8443	49723	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:51.105509043 CET	49723	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.111833096 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.116614103 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:51.116676092 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.116909981 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.121658087 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:51.581208944 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:51.581279039 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.581733942 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.583137035 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:51.586524010 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:51.587868929 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.689225912 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.689266920 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.689284086 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.689307928 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.689320087 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.689332962 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.689344883 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.689351082 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:52.689403057 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:52.689413071 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:52.804588079 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:52.805007935 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:52.809524059 CET	8443	49724	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.809691906 CET	49724	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:52.809765100 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:52.809837103 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:52.810081959 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:52.814845085 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:53.255141020 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:53.255211115 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:53.255645037 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:53.256661892 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:53.260396957 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:53.261394978 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.324536085 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.324604034 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.324630976 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.324645042 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.324659109 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.324668884 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.324681997 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.324712038 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.324712038 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.324712038 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.324744940 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.428980112 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.429883957 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.433969021 CET	8443	49725	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.434019089 CET	49725	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.434653044 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.434708118 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.435053110 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.439915895 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.881207943 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.881321907 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.882282972 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.883199930 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:54.887022018 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:54.887993097 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:55.974101067 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:55.974133968 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:55.974145889 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:55.974158049 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:55.974174023 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:55.974179983 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:55.974186897 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:55.974215984 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:55.974251986 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.084913969 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.085392952 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.089961052 CET	8443	49726	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:56.090116978 CET	49726	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.090261936 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:56.090329885 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.090636015 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.095402956 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:56.544650078 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:56.544729948 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.545186996 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.546134949 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:56.550004005 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:56.550928116 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.612607002 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.612620115 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.612636089 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.612663031 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.612675905 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.612694025 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.612765074 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:57.612840891 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:57.725394011 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:57.725837946 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:57.730464935 CET	8443	49727	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.730532885 CET	49727	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:57.730727911 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:57.730792999 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:57.730966091 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:57.735702991 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:58.186911106 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:58.186999083 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:58.187443018 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:58.188445091 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:58.192179918 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:58.193187952 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.286180973 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.286221981 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.286245108 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.286264896 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.286279917 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.286292076 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.286355972 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.286392927 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.397267103 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.397732973 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.402551889 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.402580023 CET	8443	49728	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.402638912 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.402664900 CET	49728	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.402851105 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.407638073 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.868993044 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.869060993 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.869507074 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.870420933 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:05:59.874336004 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:05:59.875298023 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.043658972 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.043693066 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.043714046 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.043730021 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.043745995 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.043749094 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.043778896 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.043812037 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.134196997 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.134257078 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.243696928 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.244177103 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.248982906 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.249063969 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.249234915 CET	8443	49729	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.249250889 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.249290943 CET	49729	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.254023075 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.709331989 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.709438086 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.734173059 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.735289097 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:01.739011049 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:01.740125895 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815380096 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815393925 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815414906 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815428972 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815443993 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815455914 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815473080 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815489054 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.815536976 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:02.815568924 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:02.928564072 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:02.929028988 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:02.933492899 CET	8443	49730	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.933589935 CET	49730	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:02.933861971 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:02.934072018 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:02.934392929 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:02.939165115 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:03.396614075 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:03.396737099 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:03.397214890 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:03.398161888 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:03.401969910 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:03.402956963 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.506242990 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.506256104 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.506274939 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.506289005 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.506308079 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.506320953 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.506350994 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:04.506422043 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:04.616281033 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:04.619992971 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:04.621222973 CET	8443	49731	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.621279001 CET	49731	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:04.624866962 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:04.624931097 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:04.628045082 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:04.632797956 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:05.088371038 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:05.088443995 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:05.113219976 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:05.115179062 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:05.123743057 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:05.123754025 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.232110023 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.232130051 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.232146978 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.232156992 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.232176065 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.232187033 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.232198954 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.232249022 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.335105896 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.336247921 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.340111971 CET	8443	49732	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.341054916 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.341120958 CET	49732	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.341162920 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.341463089 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.346777916 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.794542074 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.794609070 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.794954062 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.795977116 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:06.799664974 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:06.800714970 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:07.913744926 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:07.913769007 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:07.913781881 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:07.913822889 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:07.913835049 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:07.913846970 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:07.913961887 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.022484064 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.022906065 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.027519941 CET	8443	49733	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:08.027627945 CET	49733	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.027667999 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:08.027769089 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.028161049 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.033018112 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:08.483262062 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:08.483362913 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.483814955 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.484797001 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:08.488660097 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:08.489558935 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.592303991 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.592322111 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.592336893 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.592350006 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.592364073 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.592377901 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.592374086 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:09.592396975 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.592411995 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:09.592443943 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:09.710293055 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:09.710912943 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:09.715976000 CET	8443	49734	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.716058016 CET	49734	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:09.716588020 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:09.716653109 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:09.716939926 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:09.722800970 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:10.166094065 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:10.166157007 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:10.178839922 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:10.180278063 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:10.183697939 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:10.185153008 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.264944077 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.264957905 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.264969110 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.264980078 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.264991999 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.265007973 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.265199900 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.381735086 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.382288933 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.386799097 CET	8443	49735	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.386914015 CET	49735	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.387093067 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.387170076 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.387386084 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.392205954 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.865539074 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.865734100 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.866161108 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.867136002 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:11.870877028 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:11.871922970 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:12.984610081 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:12.984635115 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:12.984647036 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:12.984724045 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:12.984724045 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:12.984733105 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:12.984745979 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:12.984755993 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:12.984775066 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:12.984816074 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.101326942 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.102091074 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.106597900 CET	8443	49736	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:13.106648922 CET	49736	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.106899023 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:13.106956005 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.107234001 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.111968040 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:13.581948996 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:13.582031012 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.582504988 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.583508015 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:13.587295055 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:13.588351965 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.685606003 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.685621977 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.685632944 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.685645103 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.685655117 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.685724974 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.685764074 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.685801029 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.685815096 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.685847044 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.685870886 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.788008928 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.788479090 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.792977095 CET	8443	49737	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.793093920 CET	49737	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.793282986 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:14.793365955 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.797667027 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:14.802390099 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:15.238729000 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:15.238791943 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:15.239243984 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:15.240413904 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:15.244050026 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:15.245213985 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.373600960 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.373613119 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.373630047 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.373641968 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.373652935 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.373663902 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.373676062 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.373691082 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.373691082 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.373719931 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.475552082 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.476054907 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.480653048 CET	8443	49738	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.480720043 CET	49738	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.480952978 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.481017113 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.481259108 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.486073017 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.930767059 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.930839062 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.931325912 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.932279110 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:16.936096907 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:16.937009096 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.082506895 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.082532883 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.082559109 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.082575083 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.082586050 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.082613945 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.082640886 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.082653046 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.082667112 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.082680941 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.082684040 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.082694054 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.082706928 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.082737923 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.194228888 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.194890022 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.199176073 CET	8443	49739	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.199264050 CET	49739	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.199739933 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.199801922 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.202420950 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.207227945 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.650420904 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.650474072 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.662231922 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.667016983 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:18.716640949 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:18.721602917 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.820760012 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.820771933 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.820785046 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.820802927 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.820813894 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.820825100 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:19.820827007 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.820837021 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.820868969 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:19.929137945 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:19.929550886 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:19.934179068 CET	8443	49740	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.934233904 CET	49740	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:19.934389114 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:19.934453964 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:19.934912920 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:19.939716101 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:20.399333000 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:20.399468899 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:20.407099962 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:20.408122063 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:20.411919117 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:20.412934065 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.557799101 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.557813883 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.557825089 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.557873011 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.557883978 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.557895899 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.557931900 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:21.557985067 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:21.691955090 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:21.692481995 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:21.696891069 CET	8443	49742	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.696944952 CET	49742	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:21.697276115 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:21.697348118 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:21.697609901 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:21.702409029 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:22.144200087 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:22.144253016 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:22.144689083 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:22.145890951 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:22.149430990 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:22.150665998 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.251167059 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.251182079 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.251193047 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.251203060 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.251214027 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.251228094 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.251255989 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.251311064 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.366293907 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.366605043 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.371246099 CET	8443	49743	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.371401072 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.371459961 CET	49743	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.371503115 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.371726036 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.376472950 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.830780983 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.830912113 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.831321955 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.832292080 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:23.836513996 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:23.837089062 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:24.924305916 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:24.924352884 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:24.924365044 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:24.924376965 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:24.924388885 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:24.924397945 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:24.924402952 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:24.924413919 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:24.924421072 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:24.924484968 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.038003922 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.038543940 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.043097019 CET	8443	49744	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:25.043174982 CET	49744	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.043370008 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:25.043437004 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.043611050 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.048352957 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:25.508377075 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:25.508440018 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.508797884 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.509826899 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:25.513509035 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:25.515239000 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.692048073 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.692105055 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.692116022 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.692126989 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.692137957 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.692150116 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.692166090 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:26.692166090 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:26.692205906 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:26.803579092 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:26.804045916 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:26.808670044 CET	8443	49745	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.808739901 CET	49745	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:26.808921099 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:26.808979988 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:26.809148073 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:26.813961029 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:27.256628990 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:27.256720066 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:27.259867907 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:27.264647961 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:27.267692089 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:27.272404909 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.368428946 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.368505001 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.368592978 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.368604898 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.368617058 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.368628979 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.368643999 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.368664026 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.368700027 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.453950882 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.454010963 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.569344044 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.569866896 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.574399948 CET	8443	49746	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.574493885 CET	49746	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.574676037 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:28.574767113 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.574990988 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:28.579746962 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:29.057894945 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:29.058001995 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:29.058382988 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:29.059245110 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:29.063133955 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:29.064023018 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.151484013 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.151514053 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.151525974 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.151537895 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.151547909 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.151559114 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.151573896 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.151619911 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.339118004 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.340116978 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.344165087 CET	8443	49747	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.344295025 CET	49747	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.344918013 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.344980955 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.350313902 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.355143070 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.868100882 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.868189096 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.868577957 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.869527102 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:30.873984098 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:30.874947071 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.062796116 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.062859058 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.062861919 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.062874079 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.062886000 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.062896967 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.062906027 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.062907934 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.062931061 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.062959909 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.178956985 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.179553032 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.184138060 CET	8443	49748	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.184223890 CET	49748	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.185448885 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.185574055 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.185817957 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.191581011 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.662347078 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.662420034 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.668242931 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.673269033 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:32.692019939 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:32.697402954 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.760813951 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.760831118 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.760850906 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.760867119 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.760880947 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.760895967 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.760909081 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.760948896 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:33.761013031 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:33.866815090 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:33.867477894 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:33.871822119 CET	8443	49749	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.871953011 CET	49749	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:33.872397900 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:33.872493029 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:33.879801035 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:33.884535074 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:34.327083111 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:34.327184916 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:34.327918053 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:34.329047918 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:34.332916975 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:34.333965063 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.449007988 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.449028015 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.449038982 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.449049950 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.449060917 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.449071884 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.449187994 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:35.449256897 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:35.553919077 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:35.554461956 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:35.558948994 CET	8443	49750	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.559051991 CET	49750	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:35.559360027 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:35.559439898 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:35.560129881 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:35.564963102 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:36.023582935 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:36.023751974 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:36.086910963 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:36.088155031 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:36.091761112 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:36.092932940 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.195543051 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.195561886 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.195573092 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.195585012 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.195595026 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.195606947 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.195617914 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.195671082 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.195710897 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.304074049 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.304661036 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.309292078 CET	8443	49751	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.309396029 CET	49751	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.309547901 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.309631109 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.309981108 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.314784050 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.768891096 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.768996000 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.769531965 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.770687103 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:37.774317980 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:37.775492907 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:38.905822039 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:38.905841112 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:38.905853987 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:38.905864000 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:38.905875921 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:38.905885935 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:38.905894041 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:38.905932903 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:38.905951977 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.054868937 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.060058117 CET	8443	49752	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:39.060173035 CET	49752	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.090303898 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.095230103 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:39.095334053 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.103727102 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.108568907 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:39.579060078 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:39.579130888 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.579722881 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.580849886 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:39.584525108 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:39.585639000 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.694329977 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.694400072 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.694411993 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.694413900 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.694426060 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.694436073 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.694447041 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.694447041 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.694469929 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.694493055 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.803915024 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.804527998 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.808944941 CET	8443	49753	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.809010983 CET	49753	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.809350014 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:40.809412956 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.809644938 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:40.814397097 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:41.283044100 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:41.283139944 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:41.283555031 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:41.286798000 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:41.288309097 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:41.291640043 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.393513918 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.393564939 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.393573046 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.393584013 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.393596888 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.393610001 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.393611908 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.393625975 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.393631935 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.393650055 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.393678904 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.506918907 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.507644892 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.512000084 CET	8443	49754	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.512079954 CET	49754	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.512411118 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:42.512480974 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.512773991 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:42.517626047 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:43.001960039 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:43.002032995 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:43.002494097 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:43.005552053 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:43.007255077 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:43.010354996 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.095390081 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.095416069 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.095436096 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.095448971 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.095459938 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.095469952 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.095602989 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.209983110 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.210458994 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.215099096 CET	8443	49757	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.215181112 CET	49757	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.215238094 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.215317011 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.219243050 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.224066973 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.662322044 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.662386894 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.662839890 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.663913012 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:44.667582989 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:44.668689966 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.757246017 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.757262945 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.757401943 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.757415056 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.757427931 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.757432938 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.757457018 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.757474899 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.843995094 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.844104052 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.954776049 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.955450058 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.959877014 CET	8443	49759	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.959980011 CET	49759	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.960210085 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:45.960314035 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.960546017 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:45.965388060 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:46.402818918 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:46.402905941 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:46.403548956 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:46.404767036 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:46.408301115 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:46.409616947 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.469228029 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.469245911 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.469264984 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.469276905 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.469285965 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:47.469288111 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.469301939 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.469312906 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.469317913 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:47.469357967 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:47.579771996 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:47.580444098 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:47.584842920 CET	8443	49760	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.584909916 CET	49760	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:47.585228920 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:47.585302114 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:47.585556030 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:47.590404987 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:48.054697990 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:48.054806948 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:48.115334988 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:48.120203972 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:48.126523972 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:48.131350040 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.233844042 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.233860016 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.233870983 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.233886957 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.233897924 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.233908892 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.233927011 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.233983040 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.345352888 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.345844984 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.350392103 CET	8443	49761	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.350451946 CET	49761	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.350672960 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.350734949 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.350936890 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.355721951 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.820641994 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.820728064 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.821156979 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.822180986 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:49.825917006 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:49.827013969 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:50.917566061 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:50.917582035 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:50.917593002 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:50.917604923 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:50.917617083 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:50.917630911 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:50.917642117 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:50.917656898 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:50.917701960 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.032902956 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.033387899 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.038021088 CET	8443	49762	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:51.038093090 CET	49762	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.038252115 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:51.038351059 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.038516998 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.043282032 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:51.494091988 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:51.494160891 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.494545937 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.495592117 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:51.499339104 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:51.500433922 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812588930 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812604904 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812628031 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812640905 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812653065 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812673092 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812683105 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812693119 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.812803030 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:52.812803030 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:52.812803030 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:52.923636913 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:52.924134016 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:52.928704977 CET	8443	49763	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.928752899 CET	49763	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:52.929085016 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:52.929168940 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:52.929502964 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:52.934333086 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:53.380466938 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:53.380537987 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:53.381323099 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:53.383085012 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:53.386085033 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:53.387856960 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.473078966 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.473094940 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.473166943 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.473231077 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.473275900 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.473278046 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.473295927 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.473309040 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.473320007 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.473331928 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.473360062 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.579916954 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.580570936 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.587006092 CET	8443	49764	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.587109089 CET	49764	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.587385893 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:54.587465048 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.587896109 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:54.595120907 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:55.059844017 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:55.060019016 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:55.060741901 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:55.061908960 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:55.065515995 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:55.066720963 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.170141935 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.170201063 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.170212030 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.170223951 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.170237064 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.170247078 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.170258999 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.170330048 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.282737970 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.283214092 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.287741899 CET	8443	49765	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.287810087 CET	49765	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.287977934 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.288039923 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.288237095 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.293026924 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.734188080 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.734240055 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.734734058 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.735665083 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:56.739577055 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:56.740407944 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.833350897 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.833414078 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.833425045 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.833442926 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.833455086 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.833467007 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.833477974 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.833511114 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:57.833543062 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:57.939064980 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:57.939534903 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:57.944027901 CET	8443	49766	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.944288969 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:57.944355011 CET	49766	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:57.944379091 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:57.944626093 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:57.949384928 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:58.391875982 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:58.392362118 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:58.392900944 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:58.393882990 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:58.397697926 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:58.398658991 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.496151924 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.496167898 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.496181965 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.496200085 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.496217012 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.496227980 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.496268034 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:59.496320963 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:59.610990047 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:59.611460924 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:59.616022110 CET	8443	49767	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.616117001 CET	49767	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:59.616319895 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:06:59.616391897 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:59.619770050 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:06:59.624586105 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:00.063404083 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:00.063474894 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:00.063980103 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:00.064944029 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:00.068711996 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:00.069747925 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.167237043 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.167258978 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.167274952 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.167288065 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.167299986 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.167319059 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.167336941 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.167375088 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.167401075 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.282733917 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.283222914 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.287847996 CET	8443	49768	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.287920952 CET	49768	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.288048983 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.288117886 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.288343906 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.293088913 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.748054028 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.748176098 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.748684883 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.749614000 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:01.753488064 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:01.754601955 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.843877077 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.843900919 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.843911886 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.843924999 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.843961000 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.843987942 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:02.844002008 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.844037056 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:02.844050884 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:02.954808950 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:02.955336094 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:02.959908009 CET	8443	49769	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.960005045 CET	49769	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:02.960177898 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:02.960256100 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:02.960597038 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:02.965411901 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:03.410116911 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:03.410202026 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:03.451663017 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:03.456595898 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:03.460335970 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:03.465220928 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.625292063 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.625310898 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.625320911 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.625332117 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.625343084 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.625355005 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.625365019 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.625401020 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:04.625448942 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:04.736129999 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:04.736620903 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:04.741070986 CET	8443	49770	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.741477013 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:04.741561890 CET	49770	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:04.741579056 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:04.741794109 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:04.746511936 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:05.186158895 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:05.188700914 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:05.189372063 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:05.190315008 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:05.194180965 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:05.195070028 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.281490088 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.281502008 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.281512976 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.281528950 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.281538010 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.281548977 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.281559944 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.281565905 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:06.281605005 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:06.368186951 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.368325949 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:06.551228046 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:06.556168079 CET	8443	49771	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.556225061 CET	49771	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:06.560559988 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:06.565346003 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:06.565421104 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:06.578425884 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:06.583182096 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:07.037477016 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:07.037559986 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:07.037967920 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:07.039066076 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:07.042680025 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:07.043816090 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.154930115 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.154944897 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.154956102 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.155005932 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.155033112 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.155067921 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.155080080 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.155129910 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.155241013 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.155251980 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.155445099 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.267402887 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.267887115 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.272435904 CET	8443	49772	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.272531033 CET	49772	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.272834063 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.272912025 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.273257971 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.278084040 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.719633102 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.719695091 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.720144987 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.721227884 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:08.724910975 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:08.725970984 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.822861910 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.822885036 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.822897911 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.822909117 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.822921038 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.822932959 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.822987080 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:09.823029041 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:09.939308882 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:09.939770937 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:09.944276094 CET	8443	49773	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.944552898 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:09.944623947 CET	49773	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:09.944662094 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:09.945031881 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:09.949765921 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:10.416671991 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:10.418711901 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:10.419044971 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:10.420033932 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:10.423871040 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:10.424926043 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.523777962 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.523798943 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.523809910 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.523821115 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.523832083 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.523844004 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.523902893 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:11.523946047 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:11.626854897 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:11.627599955 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:11.631772041 CET	8443	49774	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.631820917 CET	49774	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:11.632433891 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:11.632494926 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:11.632833004 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:11.637588978 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:12.079821110 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:12.079890966 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:12.080312967 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:12.081245899 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:12.085172892 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:12.086025953 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.184365988 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.184384108 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.184395075 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.184405088 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.184417009 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.184431076 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.184468985 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.184509993 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.298556089 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.298947096 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.303550005 CET	8443	49775	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.303608894 CET	49775	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.303832054 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.303900957 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.304271936 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.309026957 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.767611027 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.767700911 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.768052101 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.768927097 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:13.772823095 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:13.773675919 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.818660975 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.818679094 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.818691969 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.818751097 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.818785906 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.818898916 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.818911076 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.818922043 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.818952084 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.818980932 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.923722982 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.924165010 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.928719997 CET	8443	49776	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.928783894 CET	49776	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.928955078 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:14.929018974 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.929246902 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:14.934005022 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:15.481070042 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:15.481158018 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:15.481730938 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:15.482672930 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:15.486463070 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:15.487440109 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.590209961 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.590270996 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.590281010 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.590293884 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.590306044 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.590317965 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.590329885 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.590329885 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.590343952 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.590390921 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.768582106 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.769686937 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.773520947 CET	8443	49777	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.773638964 CET	49777	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.774454117 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:16.774516106 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.774861097 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:16.779587984 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:17.250802040 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:17.250870943 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:17.256278038 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:17.260761976 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:17.261014938 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:17.265587091 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.410192966 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.410204887 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.410214901 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.410226107 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.410235882 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.410243034 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.410250902 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.410262108 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.410295963 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.517987013 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.518471003 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.522906065 CET	8443	49778	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.522983074 CET	49778	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.523286104 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.528695107 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.528966904 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.533781052 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.982564926 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.982646942 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.983047009 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.983982086 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:18.987848997 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:18.988815069 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.097178936 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.097203016 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.097213984 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.097224951 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.097239971 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.097249985 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.097378969 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.204694033 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.205168009 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.209671021 CET	8443	49779	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.209738016 CET	49779	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.210042953 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.210108995 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.210335970 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.215056896 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.664968967 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.665033102 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.665476084 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.666594982 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:20.670197964 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:20.671406031 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.783819914 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.783833981 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.783876896 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.783890009 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.783901930 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.783900976 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.783915997 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.783926964 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.783945084 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.783945084 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.783981085 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.892359018 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.892843962 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.897272110 CET	8443	49780	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.897341013 CET	49780	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.897730112 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:21.897794008 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.897988081 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:21.902813911 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:22.343739986 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:22.343825102 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:22.344230890 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:22.345525980 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:22.349004984 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:22.350337982 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.436362982 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.436381102 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.436392069 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.436402082 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.436414003 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.436424017 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.436441898 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:23.436484098 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:23.548928022 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:23.549377918 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:23.554076910 CET	8443	49781	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.554111004 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:23.554146051 CET	49781	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:23.554189920 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:23.554471970 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:23.559318066 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:24.002767086 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:24.002831936 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:24.003185034 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:24.004085064 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:24.007957935 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:24.008872986 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.099569082 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.099589109 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.099601984 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.099612951 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.099625111 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.099637985 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.099633932 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.099679947 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.099679947 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.204662085 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.205110073 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.209649086 CET	8443	49782	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.209716082 CET	49782	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.209928989 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.209989071 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.210189104 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.214936018 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.672905922 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.672964096 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.673450947 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.674349070 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:25.679188013 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:25.679907084 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.820508957 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.820523024 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.820549011 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.820559978 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.820559025 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.820573092 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.820580959 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.820588112 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.820595980 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.820630074 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.923597097 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.924048901 CET	49785	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.928709984 CET	8443	49783	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.928774118 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:26.928780079 CET	49783	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.928843975 CET	49785	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.929064989 CET	49785	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:26.933805943 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:27.393879890 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:27.393944025 CET	49785	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:27.394301891 CET	49785	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:27.395179987 CET	49785	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:27.399050951 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:27.399987936 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.463108063 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.463120937 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.463130951 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.463148117 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.463160038 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.463171005 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.463180065 CET	8443	49785	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.463191986 CET	49785	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:28.463244915 CET	49785	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:28.579804897 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:28.580239058 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:28.584861040 CET	8443	49784	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.585082054 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:28.585133076 CET	49784	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:28.585175037 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:28.585454941 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:28.590305090 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:29.060754061 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:29.060878992 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:29.061338902 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:29.062275887 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:29.066077948 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:29.067025900 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:30.145721912 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:30.145740032 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:30.145751953 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:30.145761967 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:30.145775080 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:30.145776987 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:30.145786047 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:30.145802975 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:30.145807028 CET	8443	49786	188.114.96.3	192.168.2.9
Jan 3, 2025 13:07:30.145827055 CET	49786	8443	192.168.2.9	188.114.96.3
Jan 3, 2025 13:07:30.145850897 CET	49786	8443	192.168.2.9	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 13:05:25.062414885 CET	63304	53	192.168.2.9	1.1.1.1
Jan 3, 2025 13:05:25.081684113 CET	53	63304	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 13:05:25.062414885 CET	192.168.2.9	1.1.1.1	0x4e36	Standard query (0)	632313373.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 13:05:25.081684113 CET	1.1.1.1	192.168.2.9	0x4e36	No error (0)	632313373.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 13:05:25.081684113 CET	1.1.1.1	192.168.2.9	0x4e36	No error (0)	632313373.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	07:05:22
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\mode11_UVo6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mode11_UVo6.exe"
Imagebase:	0xc40000
File size:	3'900'416 bytes
MD5 hash:	C5998338D72151C919124611F8CDFF26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2682782635.000000C000088000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2682782635.000000C000088000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2683351416.000000C000102000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:05:22
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.3%
Total number of Nodes:	54
Total number of Limit Nodes:	7

Executed Functions

Function 000002A062B7E68C Relevance: 7.8, APIs: 5, Instructions: 260
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000002A062B7E725

Part of subcall function 000002A062B8F63C: _errno.LIBCMT ref: 000002A062B8F673
Part of subcall function 000002A062B8F63C: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B8F67E

_snprintf.LIBCMT ref: 000002A062B7E7BD

Part of subcall function 000002A062B82D70: strchr.LIBCMT ref: 000002A062B82DD6
Part of subcall function 000002A062B82D70: _snprintf.LIBCMT ref: 000002A062B82E0C

Part of subcall function 000002A062B82C0C: strchr.LIBCMT ref: 000002A062B82C69
Part of subcall function 000002A062B82C0C: _snprintf.LIBCMT ref: 000002A062B82CB3

_snprintf.LIBCMT ref: 000002A062B7E7D4

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$_errno_invalid_parameter_noinfo
String ID:
API String ID: 199363273-0
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: 4be6c2e6d396fb4122f111b0444b8c0b2eb61928da5bc896851a246a38c6acea
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: D581B631B18A484FEB54EB28D8C97AEF3E9FB9D715F00152EE44AC3192DE74D9018782

Function 000002A062B85E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A062B85FEC: malloc.LIBCMT ref: 000002A062B86008

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,?,-00000001,?,00000002,000002A062B7CC89), ref: 000002A062B85EAF
strrchr.LIBCMT ref: 000002A062B85EED
_snprintf.LIBCMT ref: 000002A062B85F9B

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: NameUser_snprintfmallocstrrchr
String ID:
API String ID: 1238167203-0
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: 73e3652c6143b0e705900ded4e919577cf56655796405aecf5f0763485b036c0
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: 76518830B18A080FE648AB68949A7BDB3C6EBDE704F14551DF08FC3293DD38D8524746

Function 000002A062B7CA74 Relevance: 7.9, APIs: 6, Instructions: 411
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A062B85FEC: malloc.LIBCMT ref: 000002A062B86008

malloc.LIBCMT ref: 000002A062B7CB3B

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

Part of subcall function 000002A062B8C230: malloc.LIBCMT ref: 000002A062B8C29C

Part of subcall function 000002A062B8EAA8: malloc.LIBCMT ref: 000002A062B8EAF8

Part of subcall function 000002A062B8EAA8: realloc.LIBCMT ref: 000002A062B8EB07

malloc.LIBCMT ref: 000002A062B7CC4A
_snprintf.LIBCMT ref: 000002A062B7CCC1
_snprintf.LIBCMT ref: 000002A062B7CCE7
_snprintf.LIBCMT ref: 000002A062B7CD0E
free.LIBCMT ref: 000002A062B7CEC6

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction ID: ff6a1bb3bef66c0f80153d166f71bf0489234feb83f178d228daf2e9e23ef324
Opcode Fuzzy Hash: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction Fuzzy Hash: 44D1A520B14A0547EB58BB7484DA7A9F3DDEBDEB08F54212DA44AC32D3DE38D9258743

Function 000002A062B7F014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000002A062B7F042
WSAIoctl.WS2_32 ref: 000002A062B7F08F
closesocket.WS2_32 ref: 000002A062B7F0EE

Strings

_Cy, xrefs: 000002A062B7F0A1

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: IoctlSocketclosesocket
String ID: _Cy
API String ID: 3445158922-1085951347
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: 11f6f6dd653ea51ff4e9cb9bb42d79cfb5f882ef97fd636aaa8be6e1c430c18b
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: 4F31B330608A484BDB54AE2898C8766B7E5FBED315F10062EE84AC3291DF34C5518746

Function 000002A062B7EA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000002A062B7EB0C
InternetConnectA.WININET ref: 000002A062B7EB7A

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction ID: 8e530441c89894590f16b99c8b2a5cae1cce6838ce80f599817d48c8c2eb1c94
Opcode Fuzzy Hash: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction Fuzzy Hash: 9651B330B18A054FEB48DB28D4DA769B3D9FB9E708F15142DE08BC3292DE3C99128743

Function 000002A062B296B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002A062B2977B

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction ID: 57f61f05f2e7d3b16f07530a0a932846b7caec9d00a0af64961286e110542a23
Opcode Fuzzy Hash: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction Fuzzy Hash: 69719B36719B8486CA60CB09E49036AB7A4F7CDB94F509125EBCE83B68DF3DD555CB00

Function 000002A062B29324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002A062B29471

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction ID: 8793324d881bfdc31bb1f7a655dce232849ba7c58b1bfb131f3621de19e137f8
Opcode Fuzzy Hash: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction Fuzzy Hash: 3D41C772619B84C7DB60CB1AE48471AB7A1F7CDB94F105225FA9E83BA8DF3CD5518B00

Function 00CAF220 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2682339418.0000000000C41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2682318208.0000000000C40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682416707.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682591172.0000000000FD8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682610092.0000000000FDA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682625052.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682640972.0000000000FEC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.0000000000FED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.0000000001006000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.0000000001009000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.000000000100C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.0000000001034000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682737134.0000000001038000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682752010.000000000103F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682767243.0000000001040000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_mode11_UVo6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a83c295b55d1fb3924cfc6086ff6026e810ee76d85704118357723c5304dc2
Instruction ID: 9e4f66e8ba247997566c3495616e4a13c5855e68556b362e5fbdf2fb50692b15
Opcode Fuzzy Hash: a2a83c295b55d1fb3924cfc6086ff6026e810ee76d85704118357723c5304dc2
Instruction Fuzzy Hash: 7F319D6391CFC482D3218B24F5413AAB364F7A9798F15A715EFC912A1ADF38E1E5CB40

Function 00CAB5C0 Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2682339418.0000000000C41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2682318208.0000000000C40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682416707.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682591172.0000000000FD8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682610092.0000000000FDA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682625052.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682640972.0000000000FEC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.0000000000FED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.0000000001006000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.0000000001009000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.000000000100C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682654506.0000000001034000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682737134.0000000001038000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682752010.000000000103F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682767243.0000000001040000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_mode11_UVo6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f426410239744f5ba57e2b78151ac65bfe157d6a2c0a85e8369f5e0dce230c44
Instruction ID: 1dfbc4ea6df6fee2abcbb63d1ddaeda0e23e16f120db4fbbbcf81a0b293d1b0c
Opcode Fuzzy Hash: f426410239744f5ba57e2b78151ac65bfe157d6a2c0a85e8369f5e0dce230c44
Instruction Fuzzy Hash:

Non-executed Functions

Function 000002A062B3239C Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002A062B323FD

Part of subcall function 000002A062B30A00: _getptd.LIBCMT ref: 000002A062B30A16
Part of subcall function 000002A062B30A00: __updatetlocinfo.LIBCMT ref: 000002A062B30A4B
Part of subcall function 000002A062B30A00: __updatetmbcinfo.LIBCMT ref: 000002A062B30A72

_errno.LIBCMT ref: 000002A062B32402

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

_fileno.LIBCMT ref: 000002A062B3242F

Part of subcall function 000002A062B34E54: _errno.LIBCMT ref: 000002A062B34E5D
Part of subcall function 000002A062B34E54: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B34E68

write_multi_char.LIBCMT ref: 000002A062B32A6B
write_string.LIBCMT ref: 000002A062B32A88
write_multi_char.LIBCMT ref: 000002A062B32AA5
write_string.LIBCMT ref: 000002A062B32B04
write_string.LIBCMT ref: 000002A062B32B3B
write_multi_char.LIBCMT ref: 000002A062B32B5D
free.LIBCMT ref: 000002A062B32B71
_isleadbyte_l.LIBCMT ref: 000002A062B32C42
write_char.LIBCMT ref: 000002A062B32C58
write_char.LIBCMT ref: 000002A062B32C79
_errno.LIBCMT ref: 000002A062B32D7C
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B32D87

Strings

, xrefs: 000002A062B32A3F
@, xrefs: 000002A062B3241B

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction ID: de8d32a2ca1f6afdad0783b19c4a2df85bf26ed058d0b2b3b6b1331c8d529f27
Opcode Fuzzy Hash: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction Fuzzy Hash: 0352B022F0469487FB65CA1595C83AEABA8F74FF88F146005DE4616ED5DF38DC608782

Function 000002A062B92F9C Relevance: 30.8, APIs: 15, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

Part of subcall function 000002A062B91600: _getptd.LIBCMT ref: 000002A062B91616
Part of subcall function 000002A062B91600: __updatetlocinfo.LIBCMT ref: 000002A062B9164B
Part of subcall function 000002A062B91600: __updatetmbcinfo.LIBCMT ref: 000002A062B91672

_errno.LIBCMT ref: 000002A062B93002

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

_fileno.LIBCMT ref: 000002A062B9302F

Part of subcall function 000002A062B95A54: _errno.LIBCMT ref: 000002A062B95A5D
Part of subcall function 000002A062B95A54: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B95A68

write_multi_char.LIBCMT ref: 000002A062B9366B
write_string.LIBCMT ref: 000002A062B93688
write_multi_char.LIBCMT ref: 000002A062B936A5
write_string.LIBCMT ref: 000002A062B93704
write_multi_char.LIBCMT ref: 000002A062B9375D
free.LIBCMT ref: 000002A062B93771
_isleadbyte_l.LIBCMT ref: 000002A062B93842
write_char.LIBCMT ref: 000002A062B93858
write_char.LIBCMT ref: 000002A062B93879
_errno.LIBCMT ref: 000002A062B9397C
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B93987

Strings

@, xrefs: 000002A062B9301B
, xrefs: 000002A062B9363F

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3613058218-1077428164
Opcode ID: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction ID: c253a3d89b8cbf090993d1a29603d68e7d25451842cc410723c42e91361ac969
Opcode Fuzzy Hash: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction Fuzzy Hash: 9D620930F186444BF7688A1884DD7E9F7D8FB9FB18F24621DD68BC31D2DE2598928643

Function 000002A062B92528 Relevance: 29.0, APIs: 15, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002A062B91600: _getptd.LIBCMT ref: 000002A062B91616
Part of subcall function 000002A062B91600: __updatetlocinfo.LIBCMT ref: 000002A062B9164B
Part of subcall function 000002A062B91600: __updatetmbcinfo.LIBCMT ref: 000002A062B91672

_errno.LIBCMT ref: 000002A062B9258E

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

_fileno.LIBCMT ref: 000002A062B925BB

Part of subcall function 000002A062B95A54: _errno.LIBCMT ref: 000002A062B95A5D
Part of subcall function 000002A062B95A54: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B95A68

write_multi_char.LIBCMT ref: 000002A062B92BEB
write_string.LIBCMT ref: 000002A062B92C08
write_multi_char.LIBCMT ref: 000002A062B92C25
write_string.LIBCMT ref: 000002A062B92C84
write_multi_char.LIBCMT ref: 000002A062B92CDD
free.LIBCMT ref: 000002A062B92CF1
_isleadbyte_l.LIBCMT ref: 000002A062B92DC2
write_char.LIBCMT ref: 000002A062B92DD8
write_char.LIBCMT ref: 000002A062B92DF9
_errno.LIBCMT ref: 000002A062B92EF3
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B92EFE

Strings

, xrefs: 000002A062B92BBF

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3613058218-3916222277
Opcode ID: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction ID: baca43e43462d95fb2af8e3bd7311bb6790948b7ec673a03450e59efdfa0ee3e
Opcode Fuzzy Hash: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction Fuzzy Hash: E8621A30F18A458BF76C9B1C84C93A9F7D8FB5FB18F24611DD686C39D2DE2498928643

Function 000002A062B31928 Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 645COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002A062B31989

Part of subcall function 000002A062B30A00: _getptd.LIBCMT ref: 000002A062B30A16
Part of subcall function 000002A062B30A00: __updatetlocinfo.LIBCMT ref: 000002A062B30A4B
Part of subcall function 000002A062B30A00: __updatetmbcinfo.LIBCMT ref: 000002A062B30A72

_errno.LIBCMT ref: 000002A062B3198E

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

_fileno.LIBCMT ref: 000002A062B319BB

Part of subcall function 000002A062B34E54: _errno.LIBCMT ref: 000002A062B34E5D
Part of subcall function 000002A062B34E54: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B34E68

write_multi_char.LIBCMT ref: 000002A062B31FEB
write_string.LIBCMT ref: 000002A062B32008
_errno.LIBCMT ref: 000002A062B322F3
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B322FE

Strings

0, xrefs: 000002A062B31D28
-, xrefs: 000002A062B31F9C

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$0
API String ID: 3246410048-417717675
Opcode ID: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction ID: 26674365d25df84757cf5be85cbde76cddbe640ba914f8ccf6b5fbb285161478
Opcode Fuzzy Hash: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction Fuzzy Hash: 9D42E322F28A9487FB65CA15D5C836EEBACF74FF48F186005DA4646AD4DF39C860C742

Function 000002A062B35914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 000002A062B3596A
_errno.LIBCMT ref: 000002A062B35971
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B3597C

Strings

U, xrefs: 000002A062B35EDE

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction ID: f0382805b651c91ad9924548dba420a18fde6cbed64e4cb625d32250b3a66d2c
Opcode Fuzzy Hash: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction Fuzzy Hash: 0512F232B1464187EB20CF28D4C839EE7A8F78EF5CF542116EA8987694DF39C465CB16

Function 000002A062B87B38 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000002A062B87CA5
_snprintf.LIBCMT ref: 000002A062B87D66
_snprintf.LIBCMT ref: 000002A062B87D83
_snprintf.LIBCMT ref: 000002A062B87FD8
_snprintf.LIBCMT ref: 000002A062B880E8
_snprintf.LIBCMT ref: 000002A062B881A6
_snprintf.LIBCMT ref: 000002A062B8825E
_snprintf.LIBCMT ref: 000002A062B88002

Part of subcall function 000002A062B8F63C: _errno.LIBCMT ref: 000002A062B8F673
Part of subcall function 000002A062B8F63C: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B8F67E

_snprintf.LIBCMT ref: 000002A062B88276
_snprintf.LIBCMT ref: 000002A062B88334

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: 5f344db48d18bbce240a82a3851510eb4a4baee667135b7d8e377d07454fc498
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: C952E820B18D8997E759AB2CD4867E1F3E8FF6D309F406208D989C7552EF38D5938782

Function 000002A062B26F38 Relevance: 13.0, APIs: 10, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000002A062B27166
_snprintf.LIBCMT ref: 000002A062B27183
_snprintf.LIBCMT ref: 000002A062B270A5

Part of subcall function 000002A062B2EA3C: _errno.LIBCMT ref: 000002A062B2EA73
Part of subcall function 000002A062B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B2EA7E

_snprintf.LIBCMT ref: 000002A062B273D8
_snprintf.LIBCMT ref: 000002A062B27734

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: 934f11e736e6c915b94fc11506cf487bedd05f1b52e6a2aa7dfd9fee97c21e8c
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: 6A42B361B15F85D3EA258B29D0852F8E3A4FF9EB5DF046101DF8817A65EF38D2B29301

Function 000002A062B3B7B0 Relevance: 5.9, Strings: 4, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

e ', xrefs: 000002A062B3C405, 000002A062B3C47E, 000002A062B3C4F7, 000002A062B3C570
, xrefs: 000002A062B3BE63
<, xrefs: 000002A062B3BE6E
ailure #%d - %s, xrefs: 000002A062B3C41F, 000002A062B3C498, 000002A062B3C511, 000002A062B3C58A

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID: $<$ailure #%d - %s$e '
API String ID: 0-963976815
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: 679de82d8004fe47b59bbffe93b6aff46f6db4c813887c0af34a6d5542e7614e
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: 089223B2725A8087DB58CB1DE4A573AB7A1F3C9B84F44112AE79B87798CE3CC451CB04

Function 000002A062B3C397 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

e ', xrefs: 000002A062B3C405, 000002A062B3C47E, 000002A062B3C4F7, 000002A062B3C570
ailure #%d - %s, xrefs: 000002A062B3C41F, 000002A062B3C498, 000002A062B3C511, 000002A062B3C58A

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID: ailure #%d - %s$e '
API String ID: 0-4163927988
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: 9756bf81f42939e7fc0ee7a39dc6798953011cc64bc570a40a9752748945c3ba
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: A8613BB6714A508BD714CB1CE4D062AB7E1F3CDB88F84521AE38A877A9CE3CD655CB41

Function 000002A062B901A8 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 000002A062B901DC

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction ID: 2844a26c3953e0d6d404685ab0d9d7ff059c22c67a41c0b784d026f8dcd8a80e
Opcode Fuzzy Hash: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction Fuzzy Hash: E3A1EE71619A098FEF54FF75E8986AA37B2F768301721893A910AC3174DABCD585CF40

Function 000002A062B9DBF0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: b304af9599f373738c5149b9c45c5b9d34b748aae414e597b5f915bee0764dbc
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 9F620A31228A558FD31CCB1CC5B1B7AB7E1FB89340F44896DE287CB692C639DA45CB91

Function 000002A062B9D280 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 642e93ec9550dea5e782b187b5400839a8a4a62e784e708995ded9ae6c282ad1
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: ED52FE312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE28ACB692C639E545CB91

Function 000002A062B3CFF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: 42542810ef862b2b88bb0c69d057a5b48cf90b6400204dabdf126fc3fd17c9fe
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: EE5239B27149818BD708CB1CE4A173AB7E1F3CDB80F44952AE79A8B799CE2DD554CB40

Function 000002A062B3C680 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 3fbd65cb02db2bdedb2047172e3a3b11dca248c17d342f5fb7c4d54157635e36
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 43523AB26149808BD708CB1DE4E473AB7E1F3CDB84F44952AE7868B799CA3DD954CB40

Function 000002A062B19680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction ID: 6fa8cf7a3c45e892fccb3a70b6b87f5ad1162db24ece860e18cd0971a79ad0f6
Opcode Fuzzy Hash: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction Fuzzy Hash: BFF19A32B04A8287EB20CB15D4EC39EE3A9F79EB9CF506115DA4987689EF34C935C741

Function 000002A062B1CE3C Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74bee57ece39a3ee739721ddd6b8b7c874878cbec99e002ba7fd2a6b2694298
Instruction ID: 7843ebdfba878d1478b266606e83a8eaeac8359d304141cccca527607a6de511
Opcode Fuzzy Hash: f74bee57ece39a3ee739721ddd6b8b7c874878cbec99e002ba7fd2a6b2694298
Instruction Fuzzy Hash: 16E1E672F1070183FB64CB35E8993AAA3A5F74EB48F046125DB8A97686DF3CE165C341

Function 000002A062B1916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction ID: c0631bdc050b005302a1cc54baa03086e90de38b6f927a4a884c24c4d705ca0e
Opcode Fuzzy Hash: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction Fuzzy Hash: 16E1C932B04E8293EB209B15D4EC39EE7A9F79EB8CF806011DA4D87695EE34C975C741

Function 000002A062B20334 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction ID: 9cb45a04e9f72e48abd46696714720289d4070d764572ccf08219e8474da2d01
Opcode Fuzzy Hash: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction Fuzzy Hash: 46719C32B15B40C7EB209F21E4D836EB3E8F75EF88F046525DA4947A99DF38C5648B42

Function 000002A062B96E1C Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B96E4E

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

__doserrno.LIBCMT ref: 000002A062B96E45

Part of subcall function 000002A062B91CA8: _getptd_noexit.LIBCMT ref: 000002A062B91CAC

__doserrno.LIBCMT ref: 000002A062B96EAB
_errno.LIBCMT ref: 000002A062B96EB2
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B96F16

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction ID: 9d35a75ea73cde329e7eeb37b36603c242e722007f5ff1b53e0f322b745c1f15
Opcode Fuzzy Hash: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction Fuzzy Hash: B331F630F186054FE319AF6888CA378B798EB4FB24F556259E612872D3DE3098919393

Function 000002A062B31B48 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

write_multi_char.LIBCMT ref: 000002A062B31FEB
write_string.LIBCMT ref: 000002A062B32008
write_multi_char.LIBCMT ref: 000002A062B32025
write_string.LIBCMT ref: 000002A062B32084
write_multi_char.LIBCMT ref: 000002A062B320DD
free.LIBCMT ref: 000002A062B320F1

Strings

, xrefs: 000002A062B31FBF

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: write_multi_char$write_string$free
String ID:
API String ID: 2630409672-3916222277
Opcode ID: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction ID: d17b38e26a6ab914b236dcf8c2ef79f3dc080232bedc9e30a1b1a80bddd0a777
Opcode Fuzzy Hash: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction Fuzzy Hash: 43A1E522F1465487FB21CB55D4883AEABACF78EF8CF182005DE4957A98DF39C954CB42

Function 000002A062B97C08 Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B97C33

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

__doserrno.LIBCMT ref: 000002A062B97C2B

Part of subcall function 000002A062B91CA8: _getptd_noexit.LIBCMT ref: 000002A062B91CAC

__lock_fhandle.LIBCMT ref: 000002A062B97C77
_lseeki64_nolock.LIBCMT ref: 000002A062B97C90
_unlock_fhandle.LIBCMT ref: 000002A062B97CB3

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction ID: 7fb275fffd7ad411be12ca39681fd0ad260549f711fb4aafe7f6fd23d0e173be
Opcode Fuzzy Hash: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction Fuzzy Hash: 3821F630F186000FF3196B6898CA369B3E8EB4F725F551249E2168B1D3DEA458A1D2A3

Function 000002A062B97A90 Relevance: 15.1, APIs: 10, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B97ABB

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

__doserrno.LIBCMT ref: 000002A062B97AB3

Part of subcall function 000002A062B91CA8: _getptd_noexit.LIBCMT ref: 000002A062B91CAC

__lock_fhandle.LIBCMT ref: 000002A062B97AFF
_lseek_nolock.LIBCMT ref: 000002A062B97B18
_unlock_fhandle.LIBCMT ref: 000002A062B97B39

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction ID: a95c3bdd2f26bc2937402b511201296bbd4c63622eb42a2b0baee6261e6665c2
Opcode Fuzzy Hash: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction Fuzzy Hash: 70212931F182000FF3196B18D8DA3BCB7D8DF4F729F192248E2568B1D3DEA458A16293

Function 000002A062B3621C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B3624E

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

__doserrno.LIBCMT ref: 000002A062B36245

Part of subcall function 000002A062B310A8: _getptd_noexit.LIBCMT ref: 000002A062B310AC

__doserrno.LIBCMT ref: 000002A062B362AB
_errno.LIBCMT ref: 000002A062B362B2
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B36316

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction ID: 07c7b185389085ec8124a733a2fd70d144597795229e7635f2672b9b08ec1a16
Opcode Fuzzy Hash: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction Fuzzy Hash: 40310331F1068187E302EF6598C935DA75CE78FFA8F49A129AA21173C3CE78C4618716

Function 000002A062B3F150 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B3F176
_errno.LIBCMT ref: 000002A062B3F16B

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction ID: a551d34ef84f1def7da73b4f42525fffa3085ed00d69a9418abfc21ad3077506
Opcode Fuzzy Hash: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction Fuzzy Hash: 66410375F10751C3FB60EB1298883A9F3A8F75EF9CF945121EE94436C5DF2888A18642

Function 000002A062B96434 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B9645F

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

__doserrno.LIBCMT ref: 000002A062B96457

Part of subcall function 000002A062B91CA8: _getptd_noexit.LIBCMT ref: 000002A062B91CAC

__lock_fhandle.LIBCMT ref: 000002A062B964A3
_unlock_fhandle.LIBCMT ref: 000002A062B964DD

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction ID: cc3132344f51127eab4d8d604e84b47427a9e96074ab236d663478b4b57868b7
Opcode Fuzzy Hash: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction Fuzzy Hash: D421F630F186000FF3196B5898DA36CB7D8DB4F729F592258E2158B2D7DE6458A142A3

Function 000002A062B95C58 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B95C79

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

__doserrno.LIBCMT ref: 000002A062B95C71

Part of subcall function 000002A062B91CA8: _getptd_noexit.LIBCMT ref: 000002A062B91CAC

__lock_fhandle.LIBCMT ref: 000002A062B95CBD
_close_nolock.LIBCMT ref: 000002A062B95CD0
_unlock_fhandle.LIBCMT ref: 000002A062B95CE9

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction ID: da7d8ab28c2ef0b05c7250a575ba7ebf0954d51ce7115b4e45acb7549d19fef3
Opcode Fuzzy Hash: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction Fuzzy Hash: 90212631F19A004FF3156B2888CD368B7A8EF4F72AF65251CE606871D3CE7448908767

Function 000002A062B37008 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B37033

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

__doserrno.LIBCMT ref: 000002A062B3702B

Part of subcall function 000002A062B310A8: _getptd_noexit.LIBCMT ref: 000002A062B310AC

__lock_fhandle.LIBCMT ref: 000002A062B37077
_lseeki64_nolock.LIBCMT ref: 000002A062B37090

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction ID: 576c0fa4933c7c26a304b5ebe332cea57db6d3a67cf686ecfffff04f37290e11
Opcode Fuzzy Hash: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction Fuzzy Hash: 7921F522F1054083F701AF2598C93ADE759E78EFB9F096314AA351B3D2CFB884619723

Function 000002A062B36E90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B36EBB

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

__doserrno.LIBCMT ref: 000002A062B36EB3

Part of subcall function 000002A062B310A8: _getptd_noexit.LIBCMT ref: 000002A062B310AC

__lock_fhandle.LIBCMT ref: 000002A062B36EFF
_lseek_nolock.LIBCMT ref: 000002A062B36F18

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction ID: 9d6b95b3fc67e17470013f7c959ef0148c3fb788ea44e76350532aa6f6c3a9b9
Opcode Fuzzy Hash: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction Fuzzy Hash: EF213532F1054147F702EF2598CD3ADE758E78EFA9F096124AA15073D2CF78C861871A

Function 000002A062B8FF6C Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000002A062B8FF9A

Part of subcall function 000002A062B8F244: _errno.LIBCMT ref: 000002A062B8F264

free.LIBCMT ref: 000002A062B8FFAF
free.LIBCMT ref: 000002A062B8FFD0
free.LIBCMT ref: 000002A062B8FFE5
free.LIBCMT ref: 000002A062B8FFF9
free.LIBCMT ref: 000002A062B90005
free.LIBCMT ref: 000002A062B90030
free.LIBCMT ref: 000002A062B90051
free.LIBCMT ref: 000002A062B9006A
free.LIBCMT ref: 000002A062B9009B

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: 7ec63abab37407f7ddfdb36ddbcced6bfd7c601ea29eba6fa002f312d7f0c136
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 6941C730B5190E8FFB94EF58D8D8764B3D8F75E309F906069A809C21E1CE6C89A1C712

Function 000002A062B2F36C Relevance: 12.6, APIs: 10, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000002A062B2F39A

Part of subcall function 000002A062B2E644: _errno.LIBCMT ref: 000002A062B2E664

free.LIBCMT ref: 000002A062B2F3AF
free.LIBCMT ref: 000002A062B2F3D0
free.LIBCMT ref: 000002A062B2F3E5
free.LIBCMT ref: 000002A062B2F3F9
free.LIBCMT ref: 000002A062B2F405
free.LIBCMT ref: 000002A062B2F430
free.LIBCMT ref: 000002A062B2F451
free.LIBCMT ref: 000002A062B2F46A
free.LIBCMT ref: 000002A062B2F49B

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction ID: 7645caa3f793166257eb6cf96cfa27fe530a0ff9ca6e22bb7b498acef030cb4a
Opcode Fuzzy Hash: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction Fuzzy Hash: 7D31F821F02B4183FE559F12E8DD378A3A8FB5EF5CF4C621599191A6A2CF6C85708253

Function 000002A062B9FD50 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B9FD76
_errno.LIBCMT ref: 000002A062B9FD6B

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction ID: 2b160f060c47b0aa5b522ec8143abca93612523c621c567118e13a7a7c430bec
Opcode Fuzzy Hash: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction Fuzzy Hash: 2B51F930F14E0A4BEB64AB1944C93B5B3D8EF1FB39F64116AF959C71D6DE2488E18243

Function 000002A062B35834 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B3585F

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

__doserrno.LIBCMT ref: 000002A062B35857

Part of subcall function 000002A062B310A8: _getptd_noexit.LIBCMT ref: 000002A062B310AC

__lock_fhandle.LIBCMT ref: 000002A062B358A3

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction ID: f801a812588253a703ecaea32555234c33607ba5e96aa3c5a61a2dacbae5dda0
Opcode Fuzzy Hash: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction Fuzzy Hash: 45213822F1068043F701EF259CC93ADE758E78EFA9F096114AA15173D2CF7884A1C767

Function 000002A062B35058 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B35079

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

__doserrno.LIBCMT ref: 000002A062B35071

Part of subcall function 000002A062B310A8: _getptd_noexit.LIBCMT ref: 000002A062B310AC

__lock_fhandle.LIBCMT ref: 000002A062B350BD
_close_nolock.LIBCMT ref: 000002A062B350D0

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction ID: 14272f4be59ea7fc635fae898a468a689cb12aa65644744c2f251cae81d87ba9
Opcode Fuzzy Hash: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction Fuzzy Hash: D6110322F10A8447F305EF259CCE3ACE758E78FF68F1966249915073C2CEB884A1835A

Function 000002A062B7460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B746A9

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

malloc.LIBCMT ref: 000002A062B746B3

Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F318
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F31D

malloc.LIBCMT ref: 000002A062B746BE
free.LIBCMT ref: 000002A062B7487E
free.LIBCMT ref: 000002A062B74886
free.LIBCMT ref: 000002A062B7488E

Part of subcall function 000002A062B754F0: malloc.LIBCMT ref: 000002A062B7553A
Part of subcall function 000002A062B754F0: malloc.LIBCMT ref: 000002A062B75545
Part of subcall function 000002A062B754F0: free.LIBCMT ref: 000002A062B7562C
Part of subcall function 000002A062B754F0: free.LIBCMT ref: 000002A062B75634

free.LIBCMT ref: 000002A062B7489A
free.LIBCMT ref: 000002A062B748A7
free.LIBCMT ref: 000002A062B748B4

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction ID: 4968c9c9e0d089e113ee3d308897a797c0ed35f810fc9759f73ac03d1f696f86
Opcode Fuzzy Hash: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction Fuzzy Hash: 3E91FB30B18B8C4BD759AA5C948577AB3E9E7DEB09F40125DD88AC32C3DE24D8128783

Function 000002A062B13A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B13AA9

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

malloc.LIBCMT ref: 000002A062B13AB3

Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E718
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E71D

malloc.LIBCMT ref: 000002A062B13ABE
free.LIBCMT ref: 000002A062B13C7E
free.LIBCMT ref: 000002A062B13C86
free.LIBCMT ref: 000002A062B13C8E

Part of subcall function 000002A062B148F0: malloc.LIBCMT ref: 000002A062B1493A
Part of subcall function 000002A062B148F0: malloc.LIBCMT ref: 000002A062B14945
Part of subcall function 000002A062B148F0: free.LIBCMT ref: 000002A062B14A2C
Part of subcall function 000002A062B148F0: free.LIBCMT ref: 000002A062B14A34

free.LIBCMT ref: 000002A062B13C9A
free.LIBCMT ref: 000002A062B13CA7
free.LIBCMT ref: 000002A062B13CB4

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction ID: ddbcaf4fb2a963cc1da5c1ac1f02092688635b932f6f3e08360863ef09f02374
Opcode Fuzzy Hash: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction Fuzzy Hash: F1711522B0538487EA219B2694AC7AEF798F79EFCCF0460149D4607B86EE38C565C702

Function 000002A062B8FE10 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B8FE36

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B8FE42
__crtIsPackagedApp.LIBCMT ref: 000002A062B8FE53
_dosmaperr.LIBCMT ref: 000002A062B8FE9D

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction ID: 65c0050ad8f19b829f8794d96db0ba765d2b5e483c0dd2f399ace27ab70981c6
Opcode Fuzzy Hash: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction Fuzzy Hash: 7031E430B14A098FEB44AF689889369B7D8FB9E719F54515DE80EC32D2DB38C8508743

Function 000002A062B9A73C Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B9A755

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

__lock_fhandle.LIBCMT ref: 000002A062B9A79D
__doserrno.LIBCMT ref: 000002A062B9A7D2
_errno.LIBCMT ref: 000002A062B9A7D9
_unlock_fhandle.LIBCMT ref: 000002A062B9A7E9

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction ID: 57826d5cbdc6f1e4969d69457c419df47f169af8e498f080b42e43240783669c
Opcode Fuzzy Hash: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction Fuzzy Hash: 5C21F830F186004FE3146B6898EA36DB7A8EF4F718F55111CE216872D3DE685CD04B93

Function 000002A062B2F210 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B2F236

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B2F242
__crtIsPackagedApp.LIBCMT ref: 000002A062B2F253
_dosmaperr.LIBCMT ref: 000002A062B2F29D

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction ID: 8de411cbd91102899f2bb60f99ad93561559c578c6f543ad0e6d0d45fe0d62a4
Opcode Fuzzy Hash: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction Fuzzy Hash: F631C161B11B4083FB20AB669888369E7DDEB8FF98F185624AE45437D6DF38C5208702

Function 000002A062B3EFD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002A062B3F004

Part of subcall function 000002A062B30A00: _getptd.LIBCMT ref: 000002A062B30A16
Part of subcall function 000002A062B30A00: __updatetlocinfo.LIBCMT ref: 000002A062B30A4B
Part of subcall function 000002A062B30A00: __updatetmbcinfo.LIBCMT ref: 000002A062B30A72

_errno.LIBCMT ref: 000002A062B3F01F
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B3F02A

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction ID: 1b613b0fe94a0c5eddea023114a6d36610545c01b974bd93329c904ec2816ea8
Opcode Fuzzy Hash: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction Fuzzy Hash: 35318972B0478486EA20DF15948879DE7A8E7AEFE8F189121AE5803B85CF74C8618702

Function 000002A062B90B10 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B90B4C

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B90B57
memcpy_s.LIBCMT ref: 000002A062B90C1C
_fileno.LIBCMT ref: 000002A062B90C87
_filbuf.LIBCMT ref: 000002A062B90CB5
_errno.LIBCMT ref: 000002A062B90D05

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: 843e8273c3e971e4a912f9dc12decaede22ddc0a3d23e7e539c4d1644480984f
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: EB61C630F18F094BE66C562C548D239F3D5EB9FB28F24171DD656C32D2EE6098A681C3

Function 000002A062B2FF10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B2FF4C

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B2FF57
memcpy_s.LIBCMT ref: 000002A062B3001C
_fileno.LIBCMT ref: 000002A062B30087
_filbuf.LIBCMT ref: 000002A062B300B5
_errno.LIBCMT ref: 000002A062B30105

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction ID: 363ee8c1bcb2c359aa1bc18aa4ea1d2134d33b694c83c26d3734eb2f1cab8d5d
Opcode Fuzzy Hash: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction Fuzzy Hash: BC51F521F0675483FA18CA26558876AE798E74FFFCF146B11AE3943BD5CF34C5A18242

Function 000002A062B9FBD0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 000002A062B91600: _getptd.LIBCMT ref: 000002A062B91616
Part of subcall function 000002A062B91600: __updatetlocinfo.LIBCMT ref: 000002A062B9164B
Part of subcall function 000002A062B91600: __updatetmbcinfo.LIBCMT ref: 000002A062B91672

_errno.LIBCMT ref: 000002A062B9FC1F
_invalid_parameter_noinfo.LIBCMT ref: 000002A062B9FC2A

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: __updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808835054-0
Opcode ID: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction ID: b772b5fdb6557088e754e248ce1dfa365aa1bf5dd1359bd54f5be3f1984aff59
Opcode Fuzzy Hash: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction Fuzzy Hash: 56317C30F18A084FD7589F1890C8769B3E4FB5E724F5592A9E959C7292DF70DC90C782

Function 000002A062B90620 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B90577

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B90582
_getstream.LIBCMT ref: 000002A062B905A2
_errno.LIBCMT ref: 000002A062B905B4
_errno.LIBCMT ref: 000002A062B905C6
_openfile.LIBCMT ref: 000002A062B905F4

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction ID: ac8ecedd692112ae709ec69163b002fe8f861cf7ec3cdaa8bf3c2d2e9c42e96b
Opcode Fuzzy Hash: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction Fuzzy Hash: A2219270F18A0A8FF794AB285489369B7D9EB9F714F041969E549C31A2DE24CCD14392

Function 000002A062B2FA20 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B2F977

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B2F982
_getstream.LIBCMT ref: 000002A062B2F9A2
_errno.LIBCMT ref: 000002A062B2F9B4
_errno.LIBCMT ref: 000002A062B2F9C6
_openfile.LIBCMT ref: 000002A062B2F9F4

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction ID: a0519848c9550caf606b780ed816d351e6185d5a00dcaa55f18d6b8c62131bd9
Opcode Fuzzy Hash: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction Fuzzy Hash: F4210561B15786D3FB209B21984936EE39DE74FFC8F4864219E48A7B96DF3CC5608702

Function 000002A062B39B3C Relevance: 9.1, APIs: 6, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B39B55

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

__lock_fhandle.LIBCMT ref: 000002A062B39B9D
__doserrno.LIBCMT ref: 000002A062B39BD2
_errno.LIBCMT ref: 000002A062B39BD9

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2102446242-0
Opcode ID: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction ID: 9881397ee64d2159ed8f9208c22a7ce48925f8760414dd68c79cbe4299f7b68f
Opcode Fuzzy Hash: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction Fuzzy Hash: A321D121F10A4083F701AF6998CD3ACE79CD78FF68F09A1289A16073D2DE7888618316

Function 000002A062B2E3EC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B2E40F

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

malloc.LIBCMT ref: 000002A062B2E41D

Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E718
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E71D

malloc.LIBCMT ref: 000002A062B2E43F
_snprintf.LIBCMT ref: 000002A062B2E45A

Part of subcall function 000002A062B2EA3C: _errno.LIBCMT ref: 000002A062B2EA73
Part of subcall function 000002A062B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B2EA7E

malloc.LIBCMT ref: 000002A062B2E475

Strings

dpoolWait, xrefs: 000002A062B2E444

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID: dpoolWait
API String ID: 2026495703-1875951006
Opcode ID: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction ID: 379f08d42b0b12657d3541c5eb24dd26d53b69b6418a8adadcc2a41d0c621094
Opcode Fuzzy Hash: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction Fuzzy Hash: 5101C871B0179082EA04DB23B88876DA79DF79EFD4F056219EE6947BC6CF38C1518741

Function 000002A062B831F4 Relevance: 9.0, APIs: 7, Instructions: 264stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000002A062B8322E
strchr.LIBCMT ref: 000002A062B8324C
malloc.LIBCMT ref: 000002A062B83264
malloc.LIBCMT ref: 000002A062B83271
rand.LIBCMT ref: 000002A062B8333D
free.LIBCMT ref: 000002A062B8345B
free.LIBCMT ref: 000002A062B83463

Part of subcall function 000002A062B8F244: _errno.LIBCMT ref: 000002A062B8F264

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$_errnorand
String ID:
API String ID: 2126518082-0
Opcode ID: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction ID: 9764e153047a8248a73d3d041cb98e70a6ea7b52e95cf9ba31c2c8c9c08d8d5d
Opcode Fuzzy Hash: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction Fuzzy Hash: D881E820B18E884BE766AB2C94853F6F3D8FF9E709F445169D58DC3192DE3888568342

Function 000002A062B225F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000002A062B2262E
strchr.LIBCMT ref: 000002A062B2264C
malloc.LIBCMT ref: 000002A062B22664
malloc.LIBCMT ref: 000002A062B22671
rand.LIBCMT ref: 000002A062B2273D
free.LIBCMT ref: 000002A062B2285B
free.LIBCMT ref: 000002A062B22863

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction ID: 5bb5aa27221c35b294efaa46188c6b00e20ab6e3303f0e00662319637fa2842c
Opcode Fuzzy Hash: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction Fuzzy Hash: CC711A61F15BC4C2FB259B2994443FAE394EF9EF88F086110DB8557B96DE2CD2628701

Function 000002A062B74170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B741BD

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

malloc.LIBCMT ref: 000002A062B741C8

Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F318
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F31D

free.LIBCMT ref: 000002A062B742AF
free.LIBCMT ref: 000002A062B742B7
free.LIBCMT ref: 000002A062B742BF
free.LIBCMT ref: 000002A062B742CB
free.LIBCMT ref: 000002A062B742D8

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction ID: 75e893a5bbf2d3c913a8548e3685c0c57d632f853c781f0b431b7f49abddbe2e
Opcode Fuzzy Hash: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction Fuzzy Hash: 2451CC34B28E094BE7599B289485675B3E8F79E705F50116DDC8AC3247EF10D83687C6

Function 000002A062B13570 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B135BD

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

malloc.LIBCMT ref: 000002A062B135C8

Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E718
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E71D

free.LIBCMT ref: 000002A062B136AF
free.LIBCMT ref: 000002A062B136B7
free.LIBCMT ref: 000002A062B136BF
free.LIBCMT ref: 000002A062B136CB
free.LIBCMT ref: 000002A062B136D8

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction ID: ad35655e5cd4110eb37bdf9b5ed8bccaec4e4ed2691cc01f8b6837af2fb2eaaa
Opcode Fuzzy Hash: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction Fuzzy Hash: 4D41D121B0479197EB25DF2695AC2A9A798F70FFC8F441020DE464BB42EF34D432C702

Function 000002A062B2B630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 000002A062B2B654

Part of subcall function 000002A062B2F84C: _getptd.LIBCMT ref: 000002A062B2F854

malloc.LIBCMT ref: 000002A062B2B69C
strtok.LIBCMT ref: 000002A062B2B700
strtok.LIBCMT ref: 000002A062B2B711

Strings

eThreadpoolTimer, xrefs: 000002A062B2B6DA

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: strtok$_getptd_time64malloc
String ID: eThreadpoolTimer
API String ID: 1522986614-2707337283
Opcode ID: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction ID: dec6abceea480bcffa95772060119c76a15efed718d76e928fd2ea602fbff8a9
Opcode Fuzzy Hash: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction Fuzzy Hash: D521A572B0179482EB00DF52A0C866DB7ACF75EF98F165615EE1A43785CE34D5518780

Function 000002A062B1BE74 Relevance: 7.8, APIs: 6, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002A062B253EC: malloc.LIBCMT ref: 000002A062B25408

malloc.LIBCMT ref: 000002A062B1BF3B

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

Part of subcall function 000002A062B2B630: _time64.LIBCMT ref: 000002A062B2B654
Part of subcall function 000002A062B2B630: malloc.LIBCMT ref: 000002A062B2B69C
Part of subcall function 000002A062B2B630: strtok.LIBCMT ref: 000002A062B2B700
Part of subcall function 000002A062B2B630: strtok.LIBCMT ref: 000002A062B2B711

Part of subcall function 000002A062B228A0: _time64.LIBCMT ref: 000002A062B228AE

Part of subcall function 000002A062B2DEA8: malloc.LIBCMT ref: 000002A062B2DEF8

Part of subcall function 000002A062B2DEA8: realloc.LIBCMT ref: 000002A062B2DF07

malloc.LIBCMT ref: 000002A062B1C04A
_snprintf.LIBCMT ref: 000002A062B1C0C1
_snprintf.LIBCMT ref: 000002A062B1C0E7
_snprintf.LIBCMT ref: 000002A062B1C10E
free.LIBCMT ref: 000002A062B1C2C6

Part of subcall function 000002A062B2A144: malloc.LIBCMT ref: 000002A062B2A178
Part of subcall function 000002A062B2A144: free.LIBCMT ref: 000002A062B2A32F

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freestrtok$_callnewhrealloc
String ID:
API String ID: 1314452303-0
Opcode ID: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction ID: 8d279f75bcd3ac32f8c66e20df6334968f2de0afbd02d48113b0b82498245dd0
Opcode Fuzzy Hash: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction Fuzzy Hash: 22C17E21F0134183FA14FB6294ED7A9A39DEB8FF88F446024A9554B6C7DE38D6368743

Function 000002A062B81694 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000002A062B85FEC: malloc.LIBCMT ref: 000002A062B86008

Part of subcall function 000002A062B90620: _errno.LIBCMT ref: 000002A062B90577
Part of subcall function 000002A062B90620: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B90582

fseek.LIBCMT ref: 000002A062B81730

Part of subcall function 000002A062B90EA4: _errno.LIBCMT ref: 000002A062B90ECC
Part of subcall function 000002A062B90EA4: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B90ED7

_ftelli64.LIBCMT ref: 000002A062B81738

Part of subcall function 000002A062B90F18: _errno.LIBCMT ref: 000002A062B90F36
Part of subcall function 000002A062B90F18: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B90F41

fseek.LIBCMT ref: 000002A062B81748

Part of subcall function 000002A062B90EA4: _fseek_nolock.LIBCMT ref: 000002A062B90EF5

malloc.LIBCMT ref: 000002A062B81788

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

fclose.LIBCMT ref: 000002A062B81845

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction ID: 9f3ce0cc1a145b1abd1e24c5f0c2f3b3dbd2f10a55385774afa17808d2cff1a3
Opcode Fuzzy Hash: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction Fuzzy Hash: 0451D931B28A084BD749EB2894D97B9B3D9FB8D704F50525DE44FC32D7DE2499128782

Function 000002A062B9A348 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000002A062B9A375

Part of subcall function 000002A062B93E58: _FF_MSGBANNER.LIBCMT ref: 000002A062B93E75
Part of subcall function 000002A062B93E58: _NMSG_WRITE.LIBCMT ref: 000002A062B93E7F

_lock.LIBCMT ref: 000002A062B9A388
_lock.LIBCMT ref: 000002A062B9A3E3
_calloc_crt.LIBCMT ref: 000002A062B9A49A

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction ID: d7249427c83fabfbb9d77f119ea4fab96dbdf9bf48e04ccd84217a9058b47a80
Opcode Fuzzy Hash: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction Fuzzy Hash: E3510430E18A088BE7549F18C8C9369F7D4FB5F718F15525DE94AC32A2DA74D8928B83

Function 000002A062B754F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B7553A

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

malloc.LIBCMT ref: 000002A062B75545

Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F318
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F31D

free.LIBCMT ref: 000002A062B7562C
free.LIBCMT ref: 000002A062B75634
free.LIBCMT ref: 000002A062B75640
free.LIBCMT ref: 000002A062B7564D

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction ID: 99da196caa425fa555491724b8ad3c3f4263c432bb2e9262d5f31346021fc80c
Opcode Fuzzy Hash: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction Fuzzy Hash: 06410730B18B0D0BE7589A28488927AB7D9E7DFB54F14512DDC8BC3283ED24D82787C6

Function 000002A062B9239C Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000002A062B923B9

Part of subcall function 000002A062B95A54: _errno.LIBCMT ref: 000002A062B95A5D
Part of subcall function 000002A062B95A54: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B95A68

_errno.LIBCMT ref: 000002A062B923C9

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

_errno.LIBCMT ref: 000002A062B923E5
_isatty.LIBCMT ref: 000002A062B92446
_getbuf.LIBCMT ref: 000002A062B92452

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction ID: 812e3b987fb9b8ce217f1f0f48640f0ec6d05b376689b36193aa4cc9ee5fbd58
Opcode Fuzzy Hash: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction Fuzzy Hash: B751C030E14A084FEB98DF28C4D9765B7D4FB4FB14F185259DA15CB2C6DA34C8E18782

Function 000002A062B89220 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B8924F

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

_snprintf.LIBCMT ref: 000002A062B89267

Part of subcall function 000002A062B8F63C: _errno.LIBCMT ref: 000002A062B8F673
Part of subcall function 000002A062B8F63C: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B8F67E

free.LIBCMT ref: 000002A062B8927E

Part of subcall function 000002A062B8F244: _errno.LIBCMT ref: 000002A062B8F264

malloc.LIBCMT ref: 000002A062B892CE
_snprintf.LIBCMT ref: 000002A062B892E6
free.LIBCMT ref: 000002A062B8930E

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction ID: e4e42d3f0c98f070cdaf08dda7501ea78f482e44783fdaab8dba1f02d0877410
Opcode Fuzzy Hash: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction Fuzzy Hash: C041A920B0CD480FEB98AB6C64557B4B7DAE78E714F449259E4CEC3396DE289C128782

Function 000002A062B20A94 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 000002A062B253EC: malloc.LIBCMT ref: 000002A062B25408

Part of subcall function 000002A062B2FA20: _errno.LIBCMT ref: 000002A062B2F977
Part of subcall function 000002A062B2FA20: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B2F982

fseek.LIBCMT ref: 000002A062B20B30

Part of subcall function 000002A062B302A4: _errno.LIBCMT ref: 000002A062B302CC
Part of subcall function 000002A062B302A4: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B302D7

_ftelli64.LIBCMT ref: 000002A062B20B38

Part of subcall function 000002A062B30318: _errno.LIBCMT ref: 000002A062B30336
Part of subcall function 000002A062B30318: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B30341

fseek.LIBCMT ref: 000002A062B20B48

Part of subcall function 000002A062B302A4: _fseek_nolock.LIBCMT ref: 000002A062B302F5

malloc.LIBCMT ref: 000002A062B20B88

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

Part of subcall function 000002A062B1C444: malloc.LIBCMT ref: 000002A062B1C457

fclose.LIBCMT ref: 000002A062B20C45

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 1756087678-0
Opcode ID: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction ID: 138bfe79d8a75b7d10a720cad4b9982e28654361b761ca1fb461625f3bfc031b
Opcode Fuzzy Hash: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction Fuzzy Hash: 5241E921B1574083EA14EB12A4AD3BDE359F78EFD8F406121AE5A07BD6DE3CC6258702

Function 000002A062B2FA2C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B2FA64

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B2FA6F
_flush.LIBCMT ref: 000002A062B2FB21
_fileno.LIBCMT ref: 000002A062B2FB42
_flsbuf.LIBCMT ref: 000002A062B2FB85

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction ID: 47217bb3c619eb5cc7a47c50ca64f05649e50f727e10923ef53a3c24c3784663
Opcode Fuzzy Hash: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction Fuzzy Hash: EB410721B01340C7FE649A6255DC37EE399F74FFD8F1862209E65477D5DE38C6618202

Function 000002A062B148F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B1493A

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

malloc.LIBCMT ref: 000002A062B14945

Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E718
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E71D

free.LIBCMT ref: 000002A062B14A2C
free.LIBCMT ref: 000002A062B14A34
free.LIBCMT ref: 000002A062B14A40
free.LIBCMT ref: 000002A062B14A4D

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction ID: 9c12dbcfeaf6b866991c0dcb785c258059b358818a7806a0ca52ce6dad2ce221
Opcode Fuzzy Hash: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction Fuzzy Hash: 7A41C42272438587EA15DF26549C669E7ACF75FF8CF0A6020DD258B782EE38C527C306

Function 000002A062B7FC64 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B7FC85

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

free.LIBCMT ref: 000002A062B7FCC0
fwrite.LIBCMT ref: 000002A062B7FD01
fclose.LIBCMT ref: 000002A062B7FD09
free.LIBCMT ref: 000002A062B7FD16

Part of subcall function 000002A062B8F244: _errno.LIBCMT ref: 000002A062B8F264

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction ID: 1249838c704623e87532be03c97704411043e92ac029f92b84cccdf0944f221b
Opcode Fuzzy Hash: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction Fuzzy Hash: 5D217720B28A094BE684FB2844D93ADF3D5FBDD748F50155DA44EC32C6DD28C9518387

Function 000002A062B28620 Relevance: 7.6, APIs: 6, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B2864F

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

_snprintf.LIBCMT ref: 000002A062B28667

Part of subcall function 000002A062B2EA3C: _errno.LIBCMT ref: 000002A062B2EA73
Part of subcall function 000002A062B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B2EA7E

free.LIBCMT ref: 000002A062B2867E

Part of subcall function 000002A062B2E644: _errno.LIBCMT ref: 000002A062B2E664

malloc.LIBCMT ref: 000002A062B286CE
_snprintf.LIBCMT ref: 000002A062B286E6
free.LIBCMT ref: 000002A062B2870E

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction ID: 9fd368ab7610e3028ff817e3211a7568c9b8dca1166139849e5bbd6a3fbbd656
Opcode Fuzzy Hash: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction Fuzzy Hash: 8D31B611B0138186E615AB2268983B9EB99F34FFD8F4861119DA507B9BCE38D5728312

Function 000002A062B1F064 Relevance: 7.6, APIs: 5, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B1F085

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

free.LIBCMT ref: 000002A062B1F0C0
fwrite.LIBCMT ref: 000002A062B1F101
fclose.LIBCMT ref: 000002A062B1F109
free.LIBCMT ref: 000002A062B1F116

Part of subcall function 000002A062B2E644: _errno.LIBCMT ref: 000002A062B2E664

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction ID: 3fc7c09963624cac08b4af4e685ae8a5ccf6d98cc1267930755ffb2d5884c301
Opcode Fuzzy Hash: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction Fuzzy Hash: 4811A851B0574082EA10E622A09D3BED399E79EFD8F445121AE594BBCFDE2CC6258742

Function 000002A062B9A5EC Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B9A5FD

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

__doserrno.LIBCMT ref: 000002A062B9A5F5

Part of subcall function 000002A062B91CA8: _getptd_noexit.LIBCMT ref: 000002A062B91CAC

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: 0d3654779b7df047bea78497fbae05f9cbe1913b1dc217b0939de24c7f2291ad
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: BB01A220F254044FF759A72888C9358B3A8FF1F72DF956244D2058B2E2DE2804E1DA13

Function 000002A062B399EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B399FD

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

__doserrno.LIBCMT ref: 000002A062B399F5

Part of subcall function 000002A062B310A8: _getptd_noexit.LIBCMT ref: 000002A062B310AC

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction ID: fe73ce92b702f3c1102afba755a8b4729fdb450871d65c51314748e57bc744b6
Opcode Fuzzy Hash: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction Fuzzy Hash: 2B01D161F21A4447FA04AB24C8C93ACE358DB9FF3AF99A301C539073D2CE3844614713

Function 000002A062B7EC04 Relevance: 6.5, APIs: 5, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000002A062B7ECD3
_snprintf.LIBCMT ref: 000002A062B7ECFE
_snprintf.LIBCMT ref: 000002A062B7ED1A
_snprintf.LIBCMT ref: 000002A062B7EDCF
_snprintf.LIBCMT ref: 000002A062B7EDE6

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 0ab15ea84b12cc0fa8d5e20be296e42f95fed92f5586333a1f695d29b4d055a9
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: 3D91A630618A484FEB55EF18D8C9BEAB3E9FB9E704F001569E44AC3192DE38D955C742

Function 000002A062B1E004 Relevance: 6.4, APIs: 5, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000002A062B1E0D3
_snprintf.LIBCMT ref: 000002A062B1E0FE
_snprintf.LIBCMT ref: 000002A062B1E11A
_snprintf.LIBCMT ref: 000002A062B1E1CF
_snprintf.LIBCMT ref: 000002A062B1E1E6

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 8524ece4fd0db8c697306635efd5ba39246799484378fe1388b9356b9ae34369
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: C9817D31B10B4487EB009B61D8D83EDB7A8F78EB8CF442122DA5917B99DF38C565C752

Function 000002A062B8EFEC Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B8F00F

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

malloc.LIBCMT ref: 000002A062B8F01D

Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F318
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F31D

malloc.LIBCMT ref: 000002A062B8F03F
_snprintf.LIBCMT ref: 000002A062B8F05A

Part of subcall function 000002A062B8F63C: _errno.LIBCMT ref: 000002A062B8F673
Part of subcall function 000002A062B8F63C: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B8F67E

malloc.LIBCMT ref: 000002A062B8F075

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction ID: 3d949bd111908a28f579c37a502ee5dc061e21f6f918f65713e78f6bc11f0d02
Opcode Fuzzy Hash: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction Fuzzy Hash: A5117F30A1CB040FE7A8AF68A089355B6D5E78D710F50555EF48EC3396EE38985147C2

Function 000002A062B9062C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B90664

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B9066F
_flush.LIBCMT ref: 000002A062B90721
_fileno.LIBCMT ref: 000002A062B90742

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction ID: 46bddc664a2f710ba69ac297a13ad17d0270fda12394e9f2ba38f426e5c56399
Opcode Fuzzy Hash: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction Fuzzy Hash: 08510930F08F094BE668596C54CD335B3C4EB9FB24F14262DD55AC31E2EE61CCA24583

Function 000002A062B2B3C0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: cac9561e1360292eb7c9754e7c7a1ca275bfcde661fca7b45709c7ef5ed098eb
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: 51615832F02700C7E7148F19A5D9378B3A9E75EF98F2865299A154F3A1CF38C5618B82

Function 000002A062B710D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000002A062B71117
clock.LIBCMT ref: 000002A062B71124
clock.LIBCMT ref: 000002A062B7112D
clock.LIBCMT ref: 000002A062B7113A

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: e63b16cafe3d891be51c3126e593526b39ca1c68b7d8df3b4a8fa691d039fd00
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 7C212931E0C7080FE764A99854C6766F3D4E78F754F19122EE9C683142ED508CD283E3

Function 000002A062B900EC Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 000002A062B90109

Part of subcall function 000002A062B94540: _FindPESection.LIBCMT ref: 000002A062B94569

_initp_misc_cfltcvt_tab.LIBCMT ref: 000002A062B9011A
_initterm_e.LIBCMT ref: 000002A062B9012D
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A062B90176

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 4030f444e10e83babf63ca456711778ffaca7bb986e35c3fe88b540d1c4421cc
Instruction ID: 35680ba9024c8ff343131be4032d028a0fda5772a499b08b5bae30aa7eac633e
Opcode Fuzzy Hash: 4030f444e10e83babf63ca456711778ffaca7bb986e35c3fe88b540d1c4421cc
Instruction Fuzzy Hash: 1F119831F14D188BF746AB60EDDD7E6B3A9E74F708F405925E502C60E2EE3486D48A41

Function 000002A062B3E9D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002A062B3E9FC

Part of subcall function 000002A062B30A00: _getptd.LIBCMT ref: 000002A062B30A16
Part of subcall function 000002A062B30A00: __updatetlocinfo.LIBCMT ref: 000002A062B30A4B
Part of subcall function 000002A062B30A00: __updatetmbcinfo.LIBCMT ref: 000002A062B30A72

_errno.LIBCMT ref: 000002A062B3EA08

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B3EA13
strchr.LIBCMT ref: 000002A062B3EA29

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction ID: 757ae0e935cd758a1c2fea21d1108ae5049eb2cc8f2813a2e7efce43f1f39fdd
Opcode Fuzzy Hash: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction Fuzzy Hash: 5521F662B081A442EB60D61190D837DE798FB4EFDDF1C7122E6A606AC5CE2CC9618702

Function 000002A062B104D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000002A062B10517
clock.LIBCMT ref: 000002A062B10524
clock.LIBCMT ref: 000002A062B1052D
clock.LIBCMT ref: 000002A062B1053A

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: 4b1a2120facb6d54b64d8a85fcf02fcc94f6e3b58fc35cc3c2b469148b5f52ec
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 3311E322B0478586F770DE6664D822BF798FB8DB98F192825EE4443246ED74C8B58702

Function 000002A062B213B0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B213D2

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

_snprintf.LIBCMT ref: 000002A062B213F1

Part of subcall function 000002A062B2EA3C: _errno.LIBCMT ref: 000002A062B2EA73
Part of subcall function 000002A062B2EA3C: _invalid_parameter_noinfo.LIBCMT ref: 000002A062B2EA7E

remove.LIBCMT ref: 000002A062B213FD
remove.LIBCMT ref: 000002A062B21404

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID:
API String ID: 2566950902-0
Opcode ID: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction ID: 6ab07733e7688020b8765e20c2ca141f2e3623ef76529537a0172799c3b7a980
Opcode Fuzzy Hash: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction Fuzzy Hash: 5CF09621B05750C7E214DB12B8853AEE358E78EFC4F5C5520AF9817B5BCE38C5618746

Function 000002A062B8F860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B8F8B1

Part of subcall function 000002A062B91D18: _getptd_noexit.LIBCMT ref: 000002A062B91D1C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B8F8BC

Strings

B, xrefs: 000002A062B8F8E8

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: 5385e70ec243a73d704675a9d53e45d270e49c24ac9148554625c74545fd71c9
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: 86119330A18B088FD754EF5C9489765B3D5FB9D728F60426EA41DC32A1CF38D940C782

Function 000002A062B2EC60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002A062B2ECB1

Part of subcall function 000002A062B31118: _getptd_noexit.LIBCMT ref: 000002A062B3111C

_invalid_parameter_noinfo.LIBCMT ref: 000002A062B2ECBC

Strings

B, xrefs: 000002A062B2ECE8

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction ID: 5eb6599615d93dfe9df6fd4cd31f31af04daec3f4e0100b21809547cf1bedb69
Opcode Fuzzy Hash: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction Fuzzy Hash: 8411ACB2B20B4082EB109B12D4843ADB768F79DFE8F585321AB5817B95CF38C250CB01

Function 000002A062B110C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 000002A062B1116A

Part of subcall function 000002A062B3E208: _calloc_impl.LIBCMT ref: 000002A062B3E218
Part of subcall function 000002A062B3E208: _errno.LIBCMT ref: 000002A062B3E22B
Part of subcall function 000002A062B3E208: _errno.LIBCMT ref: 000002A062B3E235

free.LIBCMT ref: 000002A062B112F3
free.LIBCMT ref: 000002A062B112FD
free.LIBCMT ref: 000002A062B1130F

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction ID: 98c344460c9c6845f166e6137ded8de595fb05be78cb26d434815d5b919509d0
Opcode Fuzzy Hash: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction Fuzzy Hash: 8EC1FA32714B848AE764CF65E49839EB7A8F38DB88F145129EB8D47B58DF38C465CB01

Function 000002A062B8AD44 Relevance: 5.2, APIs: 4, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B8AD78

Part of subcall function 000002A062B8F284: _FF_MSGBANNER.LIBCMT ref: 000002A062B8F2B4
Part of subcall function 000002A062B8F284: _NMSG_WRITE.LIBCMT ref: 000002A062B8F2BE
Part of subcall function 000002A062B8F284: _callnewh.LIBCMT ref: 000002A062B8F2F2
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F2FD
Part of subcall function 000002A062B8F284: _errno.LIBCMT ref: 000002A062B8F308

free.LIBCMT ref: 000002A062B8AEBF
free.LIBCMT ref: 000002A062B8AF23
free.LIBCMT ref: 000002A062B8AF2F

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction ID: 36e32f9a33524f10caa3e167972f60e3e3fa279f0017978a551f7a2ea19ef64b
Opcode Fuzzy Hash: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction Fuzzy Hash: E261DA31B149094BE758EB2894D97BDB3D9EB9EB04F10192DE54AC31D3DE38D8628783

Function 000002A062B74300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B74363

Memory Dump Source

Source File: 00000000.00000002.2684658343.000002A062B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A062B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b70000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction ID: b943bbd1a475475ffe4b3387a37dbcb295b0c1fbf601f0dcc9a5ce0978d9b80a
Opcode Fuzzy Hash: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction Fuzzy Hash: 7F51B830B18A054BDB589F2894C5269B3F9FBCE705F44556DE85BC3286EE20DC228782

Function 000002A062B2A144 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B2A178

Part of subcall function 000002A062B2E684: _FF_MSGBANNER.LIBCMT ref: 000002A062B2E6B4
Part of subcall function 000002A062B2E684: _NMSG_WRITE.LIBCMT ref: 000002A062B2E6BE
Part of subcall function 000002A062B2E684: _callnewh.LIBCMT ref: 000002A062B2E6F2
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E6FD
Part of subcall function 000002A062B2E684: _errno.LIBCMT ref: 000002A062B2E708

free.LIBCMT ref: 000002A062B2A2BF
free.LIBCMT ref: 000002A062B2A323
free.LIBCMT ref: 000002A062B2A32F

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction ID: e4fd3eb9ce99b6b5590185ad678e8d6dcebe10ab5972bf911f3047e0bb93b01d
Opcode Fuzzy Hash: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction Fuzzy Hash: B651E221B01704C3EA18AB2195D83BDE399F74EFD8F54A5159E061BB86DF39D6318B03

Function 000002A062B13700 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002A062B13763

Memory Dump Source

Source File: 00000000.00000002.2684627117.000002A062B10000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002A062B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a062b10000_mode11_UVo6.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction ID: 3845c610a27b8ddc1b46b611956d7f259e5b9b3b18bd5bc58619686b9167dbf2
Opcode Fuzzy Hash: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction Fuzzy Hash: EA41A272B0078087EB54DF26A4AC6ADA3A8F74EF88F445424DE1A47B45EF34E965C702

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mode11_UVo6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
mode11_UVo6.exe

Function 000002A062B7E68C Relevance: 7.8, APIs: 5, Instructions: 260
COMMONLIBRARYCODE

Function 000002A062B85E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Function 000002A062B7CA74 Relevance: 7.9, APIs: 6, Instructions: 411
COMMONLIBRARYCODE

Function 000002A062B7F014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Function 000002A062B7EA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Function 000002A062B296B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Function 000002A062B29324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Function 00CAF220 Relevance: .1, Instructions: 57
COMMON

Function 00CAB5C0 Relevance: .0, Instructions: 2
COMMON

Function 000002A062B35914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE